Privacy

This page describes what Zurl records and what it does not. It is written to be specific rather than comprehensive-sounding — everything below reflects how the service actually behaves.

If you click a Zurl link

You do not need an account, and Zurl sets no cookie on you. When a short link is opened, the following is written to the database:

• which link was opened, and when
• a two-letter country code, plus a region or city label when the network provides one
• the host of the referring page, for example example.com
• three labels derived from your browser’s user-agent: device type (desktop, mobile, tablet or bot), browser family, and operating system

The following is explicitly not stored:

• Your IP address. It is used momentarily to determine the country and for rate limiting, then discarded. It is never written to the database.
• Your full user-agent string. It is reduced to the three labels above and discarded.
• The full referring URL. Only the host is kept, because a full URL can contain search terms and private paths.
• Any identifier for you. No cookie, no fingerprint, no visitor id. There is no way to connect two clicks to the same person.

The practical consequence is that the owner of a link can see aggregate patterns and cannot see who visited. Neither can Zurl.

If you create a link without an account

The destination URL, the generated short code, and the time of creation are stored. A salted hash of your IP address is stored for abuse attribution and rate limiting — the address itself is not stored, and the hash cannot be reversed to recover it.

If you create an account

Zurl stores:

• your email address, used to sign in and nothing else
• a scrypt hash of your password, never the password itself
• the links you create, and their analytics
• session records, which contain a hash of your session token rather than the token

Your session cookie is HttpOnly, SameSite=Lax and — in production — Secure. It exists solely to keep you signed in. There is no advertising or analytics cookie anywhere on the site.

Tools that send nothing

The URL checker and UTM builder run entirely in your browser. Nothing you type into them reaches Zurl at all.

The QR code generator sends content to the server to render the image, but does not store it. The URL expander makes a request to the link you supply in order to follow its redirects, and does not store the result.

How long data is kept

• Links: until you delete them. Anonymous links have no owner and therefore cannot be deleted by their creator.
• Individual click events: 12 months, then removed.
• Total click counts: kept for the life of the link, as a running counter with no per-event detail.
• Sessions: 30 days, or until you sign out.
• Abuse reports: kept while the report is open and for a period afterwards, so repeat abuse can be recognised.

Third parties

Zurl runs on hosting and database infrastructure operated by third-party providers, which necessarily process requests on our behalf. Beyond that there is no analytics vendor, no advertising network, no tag manager, no embedded social widgets and no third-party fonts. The site loads no external scripts.

Product usage is recorded in our own server logs as structured events, which deliberately exclude IP addresses, email addresses and tokens.

What Zurl does not claim

Zurl does not scan destination pages for malware or phishing, and makes no representation that a link is safe. Abuse is handled reactively through reports and moderation.

This page does not claim any certification, audit or formal compliance status. It describes the implemented behaviour, which you can compare against the service directly.

Your data

You can delete any link you own from your dashboard, which removes its click events along with it. To delete your account and everything associated with it, or to ask what is stored about you, use the contact page.