Terms of service

• Do not use Ruflo to hide where a link really goes.
• No phishing, malware, spam, or anything illegal where it is being served.
• We can disable any link or account that breaks these rules, and we do not have to warn you first.
• This is a free service with no uptime guarantee. Do not build anything critical on it without accepting that.

Creating a link — with an account or from the public form — means you accept these terms and the privacy policy. If you do not, do not use the service.

• You must be at least 13 years old.
• Give a real email address. It is how an account is recovered and how we would reach you about a problem with your links.
• You are responsible for what happens under your account. Keep your password and your API key to yourself — an API key is a password that skips the login form entirely.
• One person or organisation per account. Do not create accounts to get around a rate limit or a ban.

Do not create Ruflo links that lead to:

• Phishing — pages impersonating a bank, a login screen, a delivery service, a government service, or anyone else, to collect credentials or payment details.
• Malware — anything that installs software, exploits a browser, or attacks the person who clicked.
• Spam — bulk unsolicited messaging, in any medium, using these links to get past filters.
• Sexual content involving minors, or any other content whose mere distribution is a crime.
• Harassment or incitement — targeting a person or a group for abuse, doxxing, or violence.
• Content that is illegal where it is being served, or that you have no right to distribute.

And do not use the service itself to:

• Disguise a destination in order to deceive — the point of a short link is convenience, not concealment. This includes setting a social preview title, description, or image that misrepresents where the link actually goes.
• Chain redirects through other shorteners to obscure the trail.
• Probe, scan, or overload Ruflo, or try to reach data belonging to another account.
• Automate around the published rate limits, or scrape the service in bulk.

A link can be flagged or disabled by us after a report, and a flagged or disabled link stops redirecting — visitors see a notice instead. Automated malicious-URL screening is not switched on for this deployment, so nothing is checked before a link goes live.

We can disable a link, or suspend or ban an account, without notice when we believe these rules have been broken. For something as time-sensitive as a live phishing page, acting first and explaining afterwards is the only responsible order.

A disabled link's short code is not recycled. That is deliberate: reusing it would send old traffic somewhere new.

Requests are limited per hour, by plan for API keys and by IP address for the public form. The current numbers and the response headers that report your remaining quota are in the API documentation.

Limits exist so one heavy user cannot degrade the service for everyone. We may adjust them, and may contact you before doing anything drastic to an account that is merely busy rather than abusive.

The public form lets anyone create a link without signing up. Those links have no owner, which cuts both ways: nobody can edit or delete them afterwards, including the person who made them, and nobody can see their analytics. If you want control over a link, create it while signed in.

You keep whatever rights you have in your destinations, titles, and preview images. You give us only what is needed to run the service: permission to store those things, serve the redirect, and show the preview you configured to whoever the link is shared with.

You also confirm you have the right to share what you are linking to.

Ruflo is provided as it is, free of charge, with no warranty. There is no uptime guarantee and no support commitment. Features can change, and the service could be discontinued.

Two specific things worth being clear about, because people build on them:

• Analytics are indicative, not audited. Bot filtering is best-effort, country and city are approximate, and browsers can withhold referrer information. Do not use these numbers where accuracy has consequences.
• A short link is a dependency. If it matters that a printed or published link keeps working for years, point it at a domain you control.

To the extent the law allows, we are not liable for losses arising from using — or being unable to use — the service, including lost traffic from a link that stopped resolving.

You can stop at any time. Deleting a link removes it and its click history immediately; deleting your account removes your links, their analytics, your API key, and any custom domains.

We can suspend or close an account that breaks these rules. A closed account's links stop working.

This deployment has not published a contact address for abuse reports. In the meantime, a malicious destination can be reported directly to Google Safe Browsing, which warns users of every major browser away from it.

When these terms change, the date at the top of the page changes with them. Continuing to use Ruflo after that means accepting the new version; if you would rather not, delete your account.