What this stores
Short links, in plain language.
The link you shorten is not private
The destination is stored in plain text and can be read by whoever runs this site. It has to be: when someone opens a short link, this server is the thing that answers "go here", and it cannot answer with a URL it cannot read. It also checks that the destination is a cachesleuth.com address, which is what stops the shortener from being used to hide someone else's phishing page behind this domain. If a link is sensitive enough that this matters, do not shorten it. Send it with Warp, which is built for exactly that and is end-to-end encrypted.
Notes are encrypted
A note is encrypted in your browser before it is sent, using a key that is put in the link after the # symbol. Browsers never send that part to a server, so this server stores a blob it has no key for and cannot read the note. Anyone you give the whole link to can read it, and if the part after the # is lost, the note is gone for good.
What is in the database
- The destination URL, in plain text.
- The short code, when it was made, when it expires, and a count of how many times it has been opened.
- The encrypted note, if there is one.
- A hash of your manage link's key, so the key itself is not stored.
- A hash of your IP address, keyed with a secret, used only to rate limit how many links one person can make in an hour.
What is not stored
- Your raw IP address.
- Who opened a link, when, or where from. Visits move a counter and nothing else.
- Referrers, user agents, cookies, accounts, analytics, or trackers.
- Anything shared with a third party. There is none.
How long it lasts
Until it expires or you delete it. If you chose an expiry, a daily job deletes the row after that time and the link stops working. If you chose Never, it stays until you delete it with your manage link. Deleting is immediate and permanent.
The honest small print
This runs on Cloudflare, so Cloudflare handles the requests and applies its own standard network logging and abuse protection, the same as the rest of cachesleuth.com. Redirects are sent with no referrer, so the site you land on is not told which short link you came from.