Privacy Policy · Short.Link (aishort.link)

1

Data Controller

This service is operated by Short.Link, domain aishort.link. All data processing is handled via Cloudflare, Inc.'s global edge network. Privacy inquiries: contact@aishort.link.

2

Data We Collect

A. Visitor Data (every short link redirect)

Source: logAccessAsync() in redirectUtils.js writes INSERT INTO access_logs.

Field	Description	Purpose
`ip`	Visitor IP (IPv6-mapped ::ffff: prefix removed)	Fraud prevention, rate limiting, geo analytics
`country`	Country code from Cloudflare cf-ipcountry header	Geo-statistics, GEO targeting
`device`	Device type: desktop/mobile/tablet	Device analytics
`browser`	Browser name from User-Agent header	Browser analytics
`accessed_at`	ISO 8601 timestamp	Time-series analytics
`target_url`	Destination URL the short link resolved to	Per-target click counting
`link_code`	Unique 6-char code	Link-level analytics for owner
`is_bot`	Bot detection flag (1=yes, 0=no)	Accurate traffic filtering

B. Account Data (registered users)

Source: registration endpoint in routes/auth.js (INSERT INTO users).

Field	Description	Storage
`username`	Username	Plain text
`email`	Email (optional, for password recovery)	Plain text
`password`	Password	bcrypt salted hash, never stored as plaintext
`api_key`	API key	Plain text (shown once on creation)
`plan`	Plan tier (free/pro)	Plain text

C. Link Data (user-created)

Field	Description
`url / rules`	Destination URL list
`fb_pixel / tiktok_pixel`	Third-party tracking pixel IDs
`password`	Link password (bcrypt hashed)
`geo_countries`	Geo-targeting whitelist
`ai_risk_level / ai_risk_reason`	AI risk assessment result

D. AI Detection Records

Source: aiDetector.js writes to ai_detection_alerts table. Daily Cron(0 3 * * *) scans.

Field	Description
`detected_at`	Detection timestamp
`risk_level`	Risk level: low/medium/high
`source_provider`	Source: Safe Browsing / content_scan / ad_compliance

E. Health Check Records

Source: checkTargetHealthAsync() writes to target_health table. Cron every 30 min.

Field	Description
`status_code`	HTTP status code of the target URL
`response_time_ms`	Response time in ms
`is_healthy`	Health flag (200-399 = healthy)
`error_msg`	Error message if request failed

3

How We Use Data

Route visitors to the correct destination URL
Provide click analytics dashboards to link owners
AI safety detection: Google Safe Browsing v4 threatMatches:find, content pattern scanning, ad compliance checks; daily full rescan (Cron 0 3 * * *)
Send alerts to link owners when risks are detected
Health-check active link targets every 30 minutes
Prevent abuse: rate limiting, bot detection
Auto-purge access logs and health records after 12 months

We do not sell any visitor or user data to third parties.

4

Cookies & Third-Party Tracking

Visitors: We do not set first-party cookies. However, link owners may attach these third-party tracking pixels to their links:

Meta / Facebook Pixel
TikTok Pixel
Google Ads Pixel

These are configured by the link owner. We fire the events on redirect. The third parties may set their own cookies and collect data per their own policies, over which we have no control.

5

Sub-processors & International Transfer

The service runs entirely on Cloudflare, Inc. infrastructure:

Workers — request handling & routing
D1 (SQLite) — database storage
KV — redirect cache & rate-limit counters
Durable Objects — rotation counters
Workers Assets — static file hosting

Data is processed at Cloudflare global edge locations, which may involve transfer outside your country. Cloudflare's Privacy Policy and data processing terms apply.

6

Data Retention

Data Type	Retention	Mechanism
Visitor access logs	12 months	Cron DELETE WHERE accessed_at < datetime(now, -12 months)
Health check records	12 months	Same Cron job
Account data	Account lifetime, deleted on closure	Manual or via support
Link data	Until deleted by user or account closure	Users can delete links anytime
AI detection alerts	Linked to link lifetime	Cascaded delete with link

Note: Residual data may persist in backups for up to 30 days after deletion.

7

Security Measures

Passwords stored as bcrypt salted hashes
API keys generated as cryptographically random strings (nanoid)
All API requests require JWT authentication
Link password protection (bcrypt-verified)
Bot detection and rate limiting to prevent abuse
All communication encrypted via Cloudflare edge network

8

Your Rights (GDPR / California)

If you are in the EEA, UK, or California, you have the right to:

Access, correct, or delete your personal data
Data portability
Restrict or object to certain processing
Lodge a complaint with a supervisory authority

To exercise these rights, email contact@aishort.link. We will respond within 30 days.

9

Children

The service is not directed at children under 16. If we discover inadvertent collection, we will delete the data immediately.

10

Policy Changes

We may update this policy. Material changes (e.g., new data collection types) will be notified via service announcement or in-app notice. Continued use after changes constitutes acceptance.