Skip to content
Uitly.io

Privacy Policy

This policy explains what information Uitly collects, why we collect it, and what we do with it. We have tried to write it in plain language rather than legalese.

Last updated

Summary

  • We collect the minimum needed to run the service.
  • We never sell your data or share it with advertisers.
  • We do not store raw IP addresses of people who click your links.
  • You can delete your account, and everything in it, at any time.

Who we are

Uitly (uitly.io) provides free tools for shortening URLs, generating QR codes and building link-in-bio pages. For questions about this policy, contact us at hello@uitly.io or through our contact page.

Information you give us

Account information

When you create an account we store your email address, a display name, and a securely hashed password. Passwords are handled by our authentication provider and are never visible to us in plain text.

Content you create

We store the short links, QR codes and bio pages you create, along with any images you upload for a bio page. Content on a published bio page is public by design; everything else is private to your account.

Messages you send us

If you contact us, we keep your message and contact details for as long as needed to respond and to keep a record of the conversation.

Information collected automatically

Short link clicks

When someone follows one of your short links we record the time of the click, a coarse device category (desktop, mobile or tablet), the browser family, the operating system family, the referring domain, and a country code where our hosting provider supplies one.

We do not store the visitor's IP address, and we do not use cookies, fingerprinting or any cross-site identifier to follow visitors between links. Requests that look like bots or link previews are redirected without being recorded at all.

Bio page views

Views of a published bio page are recorded with the same coarse fields and the same limitations.

Server logs

Our hosting provider keeps standard operational logs for a short period to detect abuse and diagnose faults. These are handled by the provider under its own retention policy.

How we use information

  • To operate the service, redirecting links, rendering pages, storing your content.
  • To show you analytics for the links and pages you own.
  • To send account emails such as verification and password resets.
  • To detect, prevent and investigate abuse, spam and security incidents.
  • To respond when you contact us.

We do not use your content or your visitors' data to train models, and we do not sell it to anyone.

Legal bases (UK/EU users)

  • Contract: processing needed to provide the service you signed up for.
  • Legitimate interests: keeping the service secure and free of abuse, and understanding aggregate usage.
  • Consent: where we ask for it, such as optional communications. You can withdraw consent at any time.

Who we share it with

We share data only with the providers needed to run Uitly:

  • Supabase, database, authentication and file storage.
  • Our hosting provider, serving the website and redirects.

These providers process data on our instructions. We may also disclose information if we are legally required to, or where it is necessary to protect the rights and safety of our users.

How long we keep it

  • Account data: until you delete your account.
  • Links, QR codes and bio pages: until you delete them or delete your account.
  • Click and view records: retained while the associated link or page exists, and removed with it.
  • Support messages: up to two years.

Short links created without an account are not attached to any person and remain active so that anything already shared keeps working.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to certain processing, and to complain to a supervisory authority. You can update your profile and delete your account directly from your dashboard settings. For anything else, email us and we will respond within thirty days.

Security

Traffic is encrypted in transit. Access to your data is enforced at the database level with row-level security, so one account cannot read another's records even if application code were to misbehave. No system is perfectly secure, but we take this seriously and fix problems quickly.

Children

Uitly is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us data, contact us and we will delete it.

International transfers

Our providers may process data in countries other than your own. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

Cookies

We use a small number of strictly necessary cookies and no advertising cookies. See the Cookie Policy for the full list.

Changes to this policy

If we make a material change we will update the date at the top of this page and, where the change is significant, notify account holders by email.