Privacy Policy

1. Who we are

SlashedUrl is a link service that redirects visitors by country (geo-targeting) and counts clicks per campaign tag (Campaign Links). References to "we," "our," or "us" in this policy refer to the service and its operator. If you have questions about this policy, contact us at support.slashedurl@gmail.com.

2. Data we collect

Account data (link creators). When you sign in with Google, we receive your name, email address, and profile picture from that provider. We do not store passwords. Authentication is handled entirely by Firebase (Google LLC).

Link data. We store the destination URLs you add, custom aliases, expiry dates, geo-targeting rules, campaign tags (source, medium, campaign), QR codes generated for your links (hosted on Cloudinary), and click counts.

Plan and billing data. We store which plan you are on and a history of plan changes. When paid checkout is available, payments are handled by our payment provider; we do not receive or store your full card details.

Messages you send us. If you use the contact form or join a plan waitlist, we collect your name, email address, and message. If you use live chat inside the app, your messages and any details you share are processed by Crisp.

Visitor data (people who click your links). When someone clicks a SlashedUrl link, we collect and store:

• IP address: used to derive a country code for analytics and geo-targeting, and for deduplication of clicks. The raw IP address is stored in our database.
• Device type: inferred from request headers (e.g., desktop, mobile, tablet).
• Timestamp of the visit.
• The destination URL the visitor was redirected to.
• Campaign tag values (utm_source, utm_medium, utm_campaign) included in the link the visitor clicked.

We do not collect browser fingerprints, precise location, or any other tracking identifiers beyond those listed above.

3. How we use your data

• To operate the service: authenticate you, store your links, and redirect visitors.
• To provide analytics to link creators: country breakdown, device breakdown, and click timelines.
• To apply geo-targeting rules: route visitors to different destinations based on their country.
• To screen destination URLs for malware and phishing before a link is created.
• To send service emails, such as a welcome email and replies to your messages.
• To improve the product: understand usage patterns (aggregated and anonymised where possible).

We do not sell your data. We do not use your data for advertising. We share data only with the service providers listed below, and only as needed to run the Service.

4. Third-party service providers

We use a limited number of trusted infrastructure providers to operate the Service. Your data may be processed by:

• Firebase Authentication (Google LLC): identity and authentication services. Governed by the Firebase Privacy Policy.
• MongoDB Atlas (MongoDB, Inc.): cloud database services.
• Cloudinary (Cloudinary Ltd.): QR code image hosting.
• Google Safe Browsing (Google LLC): destination URLs are checked against Google's list of unsafe sites when a link is created.
• Upstash (Upstash, Inc.): Redis cache used to speed up link redirects.
• Resend (Resend, Inc.): email delivery for service emails and contact form messages.
• Crisp (Crisp IM SAS): live chat inside the app.
• Vercel (Vercel Inc.) and Render (Render Services, Inc.): website and server hosting. These providers process IP addresses and request data as part of serving the Service.
• Payment provider: when paid checkout is available, payment details are processed by our payment provider under its own privacy policy.

We do not send your personal data to analytics platforms, advertising networks, or data brokers. All processing of visitor location data (country derivation from IP address) is performed entirely on our own servers and is not shared with any external service.

5. Data retention

We retain your account data for as long as your account is active. Visitor analytics data (click records) is retained indefinitely to support historical analytics. How far back you can view analytics depends on your plan (7 days on Free, lifetime on Pro); the underlying records are kept either way. If you delete your account, your personal details (name and profile picture) are permanently removed from our systems, and your links are deactivated. Your email address is retained in a redacted form to allow you to restore access by signing in again. Visitor records associated with your links are retained anonymously.

6. Your rights

Depending on your jurisdiction (including GDPR, CCPA, and similar laws), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your personal data (your account can be deleted via the Profile page).
• Object to or restrict certain types of processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support.slashedurl@gmail.com.

7. Cookies

We use Firebase authentication session cookies to keep you signed in. No advertising or tracking cookies are set by SlashedUrl. Third-party providers may set their own cookies under their own privacy policies: Google during the sign-in flow, and Crisp to keep your chat conversation between visits.

8. Security

We use industry-standard security practices, including HTTPS and cloud-provider security controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children

SlashedUrl is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we will update the "last updated" date at the top. Continued use of the service after changes constitutes acceptance of the updated policy.