Company
Privacy policy
What Xlyl collects, what it deliberately does not, and what you can do about either. This describes the behaviour of the software itself, so it is true of this instance and of any other copy someone runs.
Who is responsible for this data#
Xlyl is open-source software, and anyone may run a copy of it. That makes the answer depend on which copy you are using. The operator of the instance at xlyl.link is the controller of the data held on it and is the party to contact about it at contact [at] xlyl.link. If you reached this page on someone else's installation, the operator of that installation is responsible for it.
Everything below describes what the software does, which is the same wherever it runs. What differs between instances is who operates it, in which country the server sits, and any additional retention or logging the operator has configured at the infrastructure level.
If you only click a short link#
Most people who encounter this service never create an account. They follow a link someone else made. This section is about them, and it is the shortest section in the policy on purpose.
What is recorded#
When a short link is opened, a row is written against that link: the time, the country and — where the local database can resolve one — the region and city; whether the device is a phone, tablet or computer; the browser and operating system with their versions; the site the click came from and which kind of source that is; any campaign tags on the link; and the browser's language preference.
That row describes the click. It does not describe you: there is no name, no address, no identifier and no way to join it to any other row about the same person beyond the counting described below.
Known bots — link-preview crawlers from chat apps and social networks, mail security scanners — are filtered out before anything is counted, which is also why the numbers a link owner sees are lower and more honest than a raw request count.
How repeat visits are counted without identifying you#
A link's owner reasonably wants to know whether a hundred clicks were a hundred people or one person clicking a hundred times. Answering that normally means keeping something that identifies a visitor. Here it does not.
Each click stores a hash of your IP address, your browser string and a random salt that is regenerated every day. The salt lives only in the server's cache, is never written to the database and is never recorded anywhere when it rotates. Within a single day the same visitor produces the same hash and is counted once. Once the salt has rotated, yesterday's hashes cannot be matched to today's, and no hash can be turned back into an address — not by the operator, not by anyone who obtains a copy of the database.
What is not recorded#
Your IP address is not written to the database. It is used in memory, at the moment of the click, to look up a location from a local database that ships with the software — no request leaves the server to do it — and to compute the daily hash above, and is then discarded. There is no address in any table, so there is none to export, subpoena or leak.
No cookie is set on you, no identifier is assigned, and no script runs in your browser. A short link answers with an HTTP redirect and nothing else; whatever happens on the destination site is between you and that site, and this service has no visibility of it. How URL shorteners work explains the mechanism in full.
Checking a link before you follow it#
You do not have to trust a short link to find out where it goes. Adding a + to the end of any link on this service shows the destination instead of redirecting to you it. Are short links safe? covers the other ways to check one.
If you create links without an account#
Anonymous link creation, where the operator has left it enabled, stores one thing about you: your IP address, in a table used only to enforce the short cooldown between anonymous links. It exists to stop one machine generating links in bulk.
That record is deleted automatically once it is older than the cooldown window — a scheduled job removes expired rows, so the address is typically held for minutes rather than days. It is not attached to the links you made, and it is not used for anything else.
If you have an account#
What you give us#
An email address and a password. The address is used to verify the account, to send a password reset if you ask for one, and to confirm a change of address. The password is never stored: what is kept is a bcrypt hash of it, which cannot be reversed into the original.
If you generate an API key, only a hash of the key is stored. The key itself is shown to you once, at the moment it is created, and cannot be recovered afterwards — which is why the API key page says to copy it then.
What you create#
Your links: the destination URL, the short alias, any description you add, the domain it is on, an optional expiry, and — if you protect a link — a bcrypt hash of the link's password. Plus the click statistics described above, attached to each link.
Any custom domain you connect is stored as the hostname and its optional homepage. Nothing about your DNS provider or registrar is collected; the DNS check resolves the name publicly, the way any visitor's browser would.
Your session#
Signing in sets one cookie containing a signed session token. It is marked HttpOnly, so no script can read it, and SameSite=Lax. It is the only cookie this service sets, there is no analytics or advertising cookie anywhere on the site, and signing out clears it.
Anti-abuse records#
If the operator has configured Google Safe Browsing, targets are checked against it when links are created, and an account that repeatedly submits flagged URLs accumulates timestamps used to apply a cooldown. Those timestamps are attached to the account and hold no other information.
Third parties#
The software calls out to very few places, and most of them are optional and switched off unless the operator configures them.
- Email delivery. Verification, password reset and address-change messages are sent through whatever mail service the operator has configured. Your email address passes through it.
- Google Safe Browsing, if a key is configured. The destination URL of a link being created is checked against it. No personal data is sent.
- reCAPTCHA, if configured. Where it is used, your IP address is sent to Google as part of the verification, subject to Google's own privacy terms.
- Country lookup uses a local database bundled with the software. No request leaves the server, and no third party sees a visitor address.
There is no advertising network, no analytics script, no session recording, no heat mapping and no data broker anywhere in this service — on the site or on the redirect path. That is a design decision as much as a privacy one: why it is free without advertising explains how that works.
How long things are kept#
| What | Kept for |
|---|---|
| Account record | Until you delete the account |
| Links and their statistics | Until you delete the link, it expires, or the account is deleted |
| Click totals | With the link they belong to |
| Per-click rows | A year by default, then deleted by a scheduled job — sooner if the operator has configured a shorter window |
| The daily hashing salt | One day, in memory only. It is replaced, never archived |
| Anonymous creator IP | The cooldown window, then deleted automatically |
| Verification and reset tokens | Until used or expired |
| Session cookie | Until you sign out or it expires |
Deleted links are removed along with the statistics attached to them. Expired links are swept away by a scheduled job rather than lingering.
What you can do#
- See everything you have. Your account page exports every link you own as a CSV; the API returns the same records and their statistics as JSON.
- Correct it. Email address and password are changed from the account page; every link is editable.
- Delete it. Deleting the account removes it, your links and their statistics at once. It is immediate and it cannot be reversed.
- Take it with you. Because links live on a domain you own, you can move to another service, or run this software yourself, without anything you published breaking.
Depending on where you live you may also have rights to object to or restrict processing, or to complain to a supervisory authority. Contact the operator of this instance to exercise any of them.
Security#
Passwords and link passwords are hashed with bcrypt. API keys are stored hashed. Session tokens are signed and delivered in an HttpOnly cookie. The service is served over HTTPS, including on custom domains, where certificates are issued automatically.
No service can promise it will never be breached. What this one can say is that the most sensitive thing it could lose — a log of who visited which link — does not exist to be lost.
Changes to this policy#
If the software changes what it collects, this page changes with it and the date below changes too. Material changes to the hosted service are announced by the operator.
Last updated: 23 September 2026.
Frequently asked questions
- Do you store the IP address of people who click my links?
- No. The address is used in memory to resolve a location and to derive a daily-rotating hash, then discarded. A row is written for each click — with country, device, browser, referrer and any campaign tags — but the address itself never reaches the database, so there is nothing to look an individual up by.
- You record each click. How is that not tracking me?
- Because nothing in the row identifies you. Repeat visits are counted using a hash of your address, your browser string and a random salt that is regenerated every day and never written down. Within a day the same person counts once; across days the hashes cannot be matched, even by whoever holds the database. There is no profile, no cross-link history and no identifier that follows you.
- Do short links set cookies on visitors?
- No. A visitor who follows a short link receives a redirect and nothing else: no cookie, no identifier, no script. The only cookie this service sets is the session cookie for people signed in to the dashboard.
- How do I delete my data?
- Delete your account from the Account page. That removes the account record, every link you created and the click statistics attached to those links. It is immediate and cannot be undone.
- Can I get a copy of my data?
- Yes. The Account page exports every link you own as a CSV, and the API returns the same records plus their statistics in JSON.
- Who is responsible for my data if this software is self-hosted?
- Whoever runs that instance. This software is open source and anyone can operate a copy, so the operator of the instance you are using is the controller of the data on it. This policy describes the software's behaviour, which is the same in every instance; the operator, the hosting location and the retention choices are theirs.