Company
Terms of service
The rules for using Xlyl, in the plainest language we can manage: what you may shorten, what gets a link removed, what is promised about keeping it running, and what is not.
Who these terms are between#
These terms cover your use of the service at xlyl.link, operated by the person or organisation running it. Xlyl is open-source software and anyone may run a copy, so if you are reading this on another installation, your agreement is with whoever operates that one.
Using the service means accepting these terms. If you do not accept them, do not use it — and consider running your own copy, where the terms are whatever you decide.
What you may and may not shorten#
The rule#
Shorten anything lawful where you are, and lawful where your readers are, and do not use a short link to make a destination look like something it is not.
What will get a link removed#
These are removed on sight, without notice, and the account behind them is closed:
- Malware, ransomware, and anything that installs software a visitor did not ask for.
- Phishing and credential harvesting, including pages that impersonate a bank, a mail provider, a government service or anyone else.
- Child sexual abuse material, without exception.
- Content that incites violence against people, or that is unlawful in the jurisdiction the service operates from.
- Bulk links created for unsolicited messaging — the usual pattern behind a domain ending up on a blocklist.
- Links whose surrounding presentation deliberately misleads about the destination.
Anyone can report a link, and reports are acted on. A single abusive link can get a whole domain flagged by browsers and mail filters, which harms every honest user of it — so this is enforced for selfish reasons as much as ethical ones.
Destinations are not endorsed#
A short link is a redirect to a page this service does not control, has not reviewed and is not responsible for. Where a Google Safe Browsing key is configured, destinations are checked against known malware and phishing lists when links are created, but that check is not a guarantee and is not a substitute for judgement.
Accounts#
You are responsible for what happens under your account, including anything done with an API key you generated. Keep the password and the key to yourself; the key carries full access to your links, and regenerating it revokes the old one immediately.
One person or organisation, one account. Accounts exist to hold links, not to be resold as a service to others.
Anti-abuse limits apply: a daily cap on how many links an account may create, and a short cooldown between links created without an account. These are documented on the free-tier page and are not negotiable per account.
Your links and your data#
Your links belong to you. So do the statistics attached to them. You can export everything from your account page or through the API, and you can delete any of it at any time. Deleting your account removes your links and their statistics immediately.
What is recorded and what deliberately is not is set out in the privacy policy — in short: no visitor IP addresses, no cookies on visitors, and a row per click that describes the click rather than the person.
If a link matters to you beyond the lifetime of any service, put it on a domain you own. Then nothing that happens here — to these terms, to this operator, to this software — can break what you published.
What is promised, and what is not#
Availability#
The service is free, and it is provided as it is. There is no uptime guarantee, no service-level agreement, no support contract and no promise that any feature will still exist next year. It is run with care, and it is not run with a pager rota.
For anything where an outage would be expensive, the honest advice is either to run your own instance, where the uptime is yours to manage, or to use a commercial service with a contract behind it — the comparison pages are candid about which situations call for that.
Liability#
To the fullest extent the law allows, the operator is not liable for losses arising from use of the service or from being unable to use it — including lost revenue, lost data or business interruption — and total liability is limited to what you paid for the service, which is nothing. Some jurisdictions do not allow such limits, in which case they apply only as far as they legally can.
Suspension#
Accounts and links that breach the rules above may be removed without notice. If you think something was removed in error, contact the operator at contact [at] xlyl.link; mistakes get reversed.
The software itself#
Xlyl is open source. The source is available, and you are free to run, inspect and modify it under its licence. These terms cover this hosted instance, not the software — your use of the code is governed by that licence rather than by this page.
Changes#
These terms may be revised. Material changes will be reflected here with a new date, and continuing to use the service after a change means accepting the revised version.
Last updated: 22 September 2026.