Privacy Policy

Last updated: 18 October 2026 (revised)

Shortlink Studio (“we”, “us”) provides short links, QR codes, link-in-bio pages and traffic statistics at go2link.io and app.go2link.io. This policy explains what information the service handles and the choices you have.

Information we collect

Account information

• Your email address and, if you sign up with a password, a salted hash of that password (we never store the password itself).
• If you sign in with Google, we receive your Google account identifier and your verified email address. We request only the “openid” and “email” permissions and do not receive your contacts, files or other Google data.
• The workspace name, display name, profile image, team members and settings you enter.

Content you create

• Destination URLs, aliases, titles, tags, routing rules, QR code settings, domains you connect, link-in-bio pages and any images you upload (stored in our database).

Visitor and click information

When someone opens a short link we record an event for the link owner’s statistics: the time, the device type, the browser and operating system family, the referring website’s host name, whether the request looks automated, and which route variant was used. We do not store the visitor’s IP address or full user-agent string in these events. Statistics are used only to show link owners their traffic and to detect abuse; automated-traffic detection never changes where a link redirects.

Bio pages

When someone opens a public bio page or clicks a block on it we record the page, the type of event (view or click), the device, browser and operating system family, the referring website’s host name and whether the request looks automated, so the page owner can see statistics. If the page owner turns on a marketing or analytics pixel, it only loads after the visitor accepts a consent banner (see “Optional third-party pixels” below).

Other information the service stores

• The address of anyone invited to a workspace, until the invitation is used or revoked.
• Reports about links (the link and the reason text you submit).
• API keys you create (only a hash and a short prefix are stored).
• Sessions: a hash of the sign-in token, its expiry and when it was revoked.

Technical logs

Our servers keep operational logs that can include IP addresses, requested paths and timestamps. They are used for security, abuse prevention and troubleshooting, and are rotated automatically: application logs are kept for about a week and web-server access logs for about two weeks.

Cookies and local storage

• link_session: a strictly necessary, HTTP-only cookie that keeps you signed in (up to 14 days).
• oauth_google and oauth_return_google: short-lived (10 minutes) strictly necessary cookies that protect the “Continue with Google” sign-in.
• studio-language: remembers the interface language you chose (up to a year).
• Your browser’s local storage remembers the language and, on a bio page, your answer to its consent banner.

Shortlink Studio itself sets no advertising or cross-site tracking cookies. Pages created by our users can include optional third-party pixels, described next.

Optional third-party pixels on bio pages

A bio page owner can add a Google Analytics, Meta (Facebook) Pixel or TikTok Pixel identifier to their page. These scripts load only after the visitor presses “accept” on the page’s consent banner, and then the provider may set its own cookies (for example _ga, _fbp, _ttp) and receive information about the visit under its own privacy policy. If you decline, nothing is loaded. We do not control these providers.

How we use information

• To provide, secure and support the service, including redirecting short links.
• To send account emails such as address verification and password reset.
• To show link owners statistics about their own links.
• To prevent, investigate and act on abuse, spam, phishing and malware.
• To meet legal obligations.

We do not sell personal information.

Service providers

• Cloud hosting for our servers and database.
• Resend, to deliver transactional email.
• Google, only if you choose “Continue with Google”.
• Google, Meta and TikTok, only on bio pages whose owner enabled their pixel and only after the visitor accepts (see above).

These providers process data on our behalf to run the service. We may also disclose information when required by law or to protect the rights and safety of users and the public.

Retention

• Account and content data are kept while your account is active.
• Detailed click and bio-page events are deleted from the database after about 90 days; daily aggregate totals may be kept longer. Short-lived processing copies in our event queue may stay longer until they are cleaned up.
• Deleted links move to the trash, where you can restore them; ask us if you need them removed for good.
• Backups are kept for about two weeks and then deleted.

Your choices and rights

You can edit or delete links, pages and workspace content in the dashboard, sign out of your sessions, and revoke Shortlink Studio’s access from your Google account settings. Account deletion is not self-service yet: you may ask us to access, correct or delete the personal information we hold about you, or to delete your account, and we will respond within a reasonable time and as required by applicable law. Use the contact route below.

Security

Traffic is encrypted with HTTPS, passwords are hashed, access to databases is restricted to our own servers and we limit request rates to deter abuse. No system is perfectly secure, so please use a strong, unique password.

Children

The service is not directed to children under 13 and we do not knowingly collect their data.

Changes

We may update this policy. The “Last updated” date shows the latest version, and significant changes will be announced in the service or by email.

Contact

A dedicated privacy contact address has not been published yet. The Report a link page is only for reporting an abusive short link and is not a channel for privacy requests.