Privacy policy

• We store your account details, the links you create, and a record of each click on them.
• A visitor's IP address is hashed with a secret before anything is written down. The address itself is never stored.
• There are no advertising cookies and no third-party analytics or tracking scripts on this site. Not one.
• Nothing is sold, rented, or shared for marketing.
• Delete a link and its entire click history is deleted with it, immediately.

Ruflo is a link shortener. This policy covers the site, the dashboard, the API, and the short links this deployment serves. “We” means Ruflo; “you” means someone with an account or someone using the public shortening form.

It also covers people who merely click one of those short links without ever visiting Ruflo directly. They did not sign up for anything, so the section on click records below is written mainly with them in mind.

• Signing up with an email address. Your email and a password. The password is stored only as a bcrypt hash — we cannot read it, and neither can anyone who obtains the database.
• Signing in with Google. Google tells us your email address, your name, and the URL of your profile picture — the standard openid, email, and profile scopes, and nothing else. We keep the tokens Google issues so the sign-in keeps working. We never ask for access to your Gmail, Drive, contacts, or anything else in your Google account.
• Links you create. The destination URL, the short code, and anything optional you fill in: title, tags, expiry date, password, and the social-preview title, description, and image.
• An API key, if you generate one. We store a SHA-256 hash of it plus its first few characters, so the dashboard can show you which key is which. The key itself is shown once and never stored, which is also why we cannot recover it for you.
• A custom domain, if you add one. The domain name and the verification token used to prove you control it.

Following a Ruflo link writes exactly one row, attached to the link. It holds:

• a one-way hash of the visitor's IP address (see below);
• an approximate country and city, derived from that IP address before it is discarded;
• device type, browser, and operating system, read from the browser's user-agent string;
• the hostname of the referring site, where the browser sends one — example.com, never the full page address someone came from;
• the raw user-agent string, truncated to 512 characters;
• the date and time.

That is what the analytics page shows the link's owner. It is keyed to the link, not to the visitor: there is no profile, no cross-site identifier, and no way to follow one person from one link to another.

Requests we identify as bots are recorded as such rather than counted as people.

The IP address is used for three things while the request is being handled — rate limiting, the CAPTCHA check where one applies, and the country/city lookup — and is then thrown away. What reaches the database is a SHA-256 hash of the address combined with this deployment's secret key, kept to 32 hexadecimal characters.

The secret matters. There are only about four billion IPv4 addresses, so a plain hash of an address is trivially reversible by hashing all of them and comparing. Mixing in a secret that never leaves the server makes that attack useless, while still producing the same hash for the same visitor — which is all that is needed to count unique visitors rather than raw hits.

A consequence worth stating plainly: we cannot tell you which IP address a click came from, because we do not know.

Running this service means other companies handle some of the data. These are all of them:

• Vercel. Hosts the site. Its request logs briefly include the IP address and user agent of every visit, including visits to short links.
• Neon. Runs the PostgreSQL database where accounts, links, and click records are stored.
• Google (Sign in with Google). Authenticates you, and only if you choose that button. Google tells us your email address, name, and profile picture; we tell Google nothing about your links.

We may also disclose information if the law actually requires it, or to investigate abuse of the service — a link being used for phishing, for instance.

• Signed-in session. Logging in sets a session cookie plus the cookies that protect the login form against cross-site request forgery. In production they are marked Secure and HttpOnly. These are what being logged in is, so there is no way to refuse them and stay logged in.
• Light or dark mode. Stored in your browser's local storage. It is never sent to us.
• No advertising or analytics cookies. There is no tag manager, no pixel, and no third-party script measuring you.

• Delete a link and its clicks go with it — every click row for that link is removed in the same operation, not marked hidden.
• Delete an account and everything attached goes — links, their click history, the API key, and any custom domains.
• Otherwise we keep it. Being straightforward about this: click history has no automatic expiry. It stays for as long as the link does.
• Links made without an account have no owner and no way to reach whoever made them, so they remain until an administrator removes them.

• See it. Your dashboard lists every link on your account and all the analytics we hold for each one. There is nothing in a hidden profile behind it.
• Correct it. Titles, tags, expiry, destination, and social previews are all editable.
• Delete part of it. Deleting a link deletes its click history immediately.
• Delete all of it. There is not yet a button for this in the dashboard, so full account deletion has to go through whoever operates this deployment. Deleting your links first removes all of their click history straight away.

One thing that catches people out: an email-and-password account and a “Sign in with Google” account that happen to share an address are two separate accounts here, on purpose. Linking them automatically would let anyone who registered your address first inherit access the moment you used Google.

• Sell or rent your data, or anyone's click records.
• Load advertising networks, tracking pixels, or third-party analytics.
• Send you marketing email. This deployment sends no email at all.
• Read the contents of the pages your links point to, beyond checking the URL for known phishing and malware.

Ruflo is not intended for children under 13, and we do not knowingly create accounts for them. If you believe a child has an account here, tell us and we will remove it.

Passwords are hashed with bcrypt, API keys are stored only as hashes, IP addresses are hashed with a secret, sessions use signed tokens, and everything travels over HTTPS. Those are real protections and we take them seriously.

What we will not claim is that any of it makes a breach impossible. Please do not put anything through a link shortener that would be harmful to expose.

If this policy changes, the date at the top of the page changes with it. Material changes to what we collect will be reflected here before they take effect, not after.

This deployment has not published a contact address. Everything described above that you can do yourself, you can do from your dashboard without asking anyone.