Privacy

This page describes what Zurl records and what it does not. It is written to be specific rather than comprehensive-sounding — everything below reflects how the service actually behaves.

If you click a Zurl link

You do not need an account, and Zurl sets no cookie on you. When a short link is opened, the following is written to the database:

• which link was opened, and when
• a two-letter country code, plus a region or city label when the network provides one
• the host of the referring page, for example example.com
• three labels derived from your browser’s user-agent: device type (desktop, mobile, tablet or bot), browser family, and operating system

The following is explicitly not stored:

• Your IP address. It is used momentarily to determine the country and for rate limiting, then discarded. It is never written to the database.
• Your full user-agent string. It is reduced to the three labels above and discarded.
• The full referring URL. Only the host is kept, because a full URL can contain search terms and private paths.
• Any identifier for you. No cookie, no fingerprint, no visitor id. There is no way to connect two clicks to the same person.

The practical consequence is that the owner of a link can see aggregate patterns and cannot see who visited. Neither can Zurl.

If you create a link without an account

The destination URL, the generated short code, and the time of creation are stored. A salted hash of your IP address is stored for abuse attribution and rate limiting — the address itself is not stored, and the hash cannot be reversed to recover it.

If you create an account

Zurl stores:

• your email address, used to sign in and nothing else
• a scrypt hash of your password, never the password itself
• the links you create, and their analytics
• session records, which contain a hash of your session token rather than the token

Your session cookie is HttpOnly, SameSite=Lax and — in production — Secure. It exists solely to keep you signed in. There is no advertising or analytics cookie anywhere on the site.

Tools that run in your browser

These tools process everything locally. Nothing you enter is sent to Zurl or anyone else:

• URL Encoder
• URL Decoder
• UTM Builder
• UTM Cleaner
• UTM Parser
• URL Parameter Remover
• URL Parser
• URL to QR Code

When any tool is opened or used, the browser sends an anonymous event to /api/events containing only the event name (for example copy_clicked) and the tool name. It contains no URL, no text you entered and no identifier.

Tools that use Zurl’s server

These tools have to contact a website or a security service, which a browser cannot do safely on its own. The URL you enter is sent to Zurl’s server:

• URL Shortener
• URL Expander
• URL Checker
• Redirect Checker
• URL Status Checker
• URL Safety Checker
• URL Metadata Extractor
• URL Screenshot

What happens to that URL:

• It is not written to logs. Logs record which tool ran and the outcome (for example “reachable” or “timeout”), never the URL.
• Results are cached briefly in the database, keyed by a SHA-256 hash of the URL: 5 minutes for status and redirect checks, 30 minutes for metadata and safety lookups, 1 hour for screenshots. Expired entries are deleted automatically. The cache is not linked to you.
• Zurl’s server makes the request for checks, redirects, expansion and metadata, with a ZurlBot user agent. The website you check sees Zurl’s server, not you.
• Safety checks send the URL to the configured providers — Google Safe Browsing and/or VirusTotal — under their own privacy terms. Do not check URLs containing private tokens.
• Screenshots send the URL to an external rendering service (Microlink), which loads the page in its own isolated browser.

For rate limiting, a salted hash of your IP address is used as a counter key for a short window (one minute to one hour). If a shared rate-limit store is configured, those counters live there and expire on their own. The raw IP address is never stored.

How long data is kept

• Links: until you delete them. Anonymous links have no owner and therefore cannot be deleted by their creator.
• Individual click events: 12 months, then removed.
• Total click counts: kept for the life of the link, as a running counter with no per-event detail.
• Sessions: 30 days, or until you sign out.
• Abuse reports: kept while the report is open and for a period afterwards, so repeat abuse can be recognised.
• URL tool results: between 5 minutes and 1 hour (see above).
• Abuse events: a record that something was blocked and why (for example “rate limited”), with no URL, IP address or other identifier.

Third parties

Zurl runs on hosting and database infrastructure operated by third-party providers, which necessarily process requests on our behalf. The safety checker and screenshot tool use the external services named above, only when you use those tools. Beyond that there is no analytics vendor, no advertising network, no tag manager, no embedded social widgets and no third-party fonts. The site loads no external scripts. The metadata tool displays a page’s share image directly from that site after you request it.

Product usage is recorded in our own server logs as structured events, which deliberately exclude IP addresses, email addresses and tokens.

What Zurl does not claim

Zurl never states that a link is safe. The URL safety checker reports what the configured threat-intelligence providers say, attributed to each provider; a clean result means only that no known threat was found. When a provider is configured, the shortener refuses destinations it classifies as malicious. Abuse of Zurl links is otherwise handled through reports and moderation.

This page does not claim any certification, audit or formal compliance status. It describes the implemented behaviour, which you can compare against the service directly.

Your data

You can delete any link you own from your dashboard, which removes its click events along with it. To delete your account and everything associated with it, or to ask what is stored about you, use the contact page.