Last updated: 13 October 2026

Privacy Policy

This policy explains what personal data URelf collects when you use our website, dashboard, API and short links, why we collect it, how long we keep it, and the rights you have. We’ve tried to keep it short and specific. The short version: we collect what we need to run your account and show you how your links perform, we never store the IP addresses of people who click links, and we don’t sell data or use advertising trackers.

1. Who we are

The data controller is [Company legal name], [Registered address], Hungary (“URelf”, “we”). For any privacy question or to exercise your rights, email [email protected]. [If a Data Protection Officer is appointed: name and contact.]

2. Data about account holders

Account information

• Name and email address, and whether your email is verified.
• Password, stored only as a salted, one-way hash. We can’t see your password.
• Sign-in with Google or GitHub: if you use it, we receive your account identifier at that provider, your name, email address and profile picture URL. We don’t receive your password there or access anything else in that account.
• Plan and usage: your plan, the number of links you have, and how many you created each day (to enforce limits).
• API keys: we store a hash of each key plus its name, a short prefix so you can recognise it, and when it was created and last used.

Sessions and security

When you log in we create a session. We store the session’s IP address and browser user agent with it so we can detect suspicious sign-ins, show you your active sessions and protect your account. Sessions expire after 30 days of inactivity and are deleted when you log out of them, reset your password or delete your account. We also process IP addresses briefly to rate-limit sign-in, sign-up, password reset and abuse-report requests; those counters expire automatically within an hour.

Your links

For each link we store the destination URL, the short name, an optional title and expiry date, its safety-check status and timestamps. Please don’t put personal data in destination URLs or titles unless you need to.

Emails

We send transactional emails only: email verification, password reset and important notices about your account or links. We don’t send marketing emails without your consent.

3. Data about people who click links

When someone opens a URelf short link, we redirect them and record a click so the link’s owner can see aggregated statistics. For each click we store:

• the date and time;
• the country, as determined by our CDN (Cloudflare) from the connection, without us storing the IP address;
• the referring website’s host name only (for example, “news.example.com”, never the full page address);
• the device type, browser and operating system family, derived from the user agent (the user agent itself is not stored);
• whether the request looked like it came from a bot;
• a visitor hash: a keyed hash of the IP address and user agent, combined with the current date. It lets us count unique visitors per day. Because the key changes every day, the hash can’t be reversed to an IP address and can’t be used to recognise the same visitor on different days.

We never store visitors’ IP addresses, set cookies on redirects, or build profiles of visitors. Link owners only ever see aggregated statistics (totals, top countries, referrers, devices and browsers), never individual clicks.

4. Abuse reports

If you report a link, we store the link, your reason and details, and your email address if you choose to give it (so we can follow up). We process your IP address briefly for rate limiting and bot protection, as described above.

5. Why we use your data (legal bases)

6. How long we keep data

• Account data: for as long as your account exists. When you delete your account, your profile, sessions, API keys, links and their analytics are permanently deleted.
• Click-level data (each click’s time, country, referrer host, device, browser, OS and visitor hash): kept for a period that depends on the link owner’s plan: Free 30 days, Pro 365 days, Business 730 days. Older rows are deleted automatically.
• Daily aggregates (clicks and unique visitors per link per day): kept for as long as the link exists. They contain no personal data about visitors.
• Deleted links: stop working immediately. We keep a minimal record (short name, destination and dates) so the short name can’t be reused to point somewhere else and so we can investigate abuse. It’s removed when your account is deleted.
• Sessions: up to 30 days after last use.
• Abuse reports: up to [24 months] after the report is resolved, unless needed longer for legal claims.
• Server and CDN logs: our providers keep technical logs, which may include IP addresses, for a short period (typically up to 30 days) for security and troubleshooting.

7. Who we share data with

We don’t sell personal data. We use these service providers (processors), bound by data processing agreements, to run the Service:

Some of these providers are based in, or may access data from, the United States. Where personal data leaves the EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. We may also disclose data if required by law, or to protect people from harm, for example when reporting illegal content to the authorities.

8. Cookies and local storage

We use essential cookies only: a session cookie that keeps you logged in and a short-lived cookie that caches your session to make pages faster. They are set only when you log in and are required for the Service to work, so no consent banner is needed. We remember your light or dark theme choice in your browser’s local storage. Cloudflare may set strictly necessary security cookies. Short-link redirects set no cookies. We don’t use advertising or cross-site tracking cookies.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted (you can delete your account yourself in Settings at any time);
• restrict or object to processing based on legitimate interests;
• receive your data in a portable format (you can download it yourself under Settings → Your data);
• withdraw consent at any time, where we rely on consent.

Email [email protected] to exercise these rights. We’ll reply within one month. Because we don’t store visitors’ IP addresses and the visitor hash rotates daily, we usually can’t identify the clicks of a particular visitor. You also have the right to complain to a supervisory authority, in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or the authority where you live or work.

10. Security

We use encryption in transit (HTTPS), hashed passwords and API keys, access controls, rate limiting and regular updates to protect your data. If a breach affects your personal data in a way that puts you at risk, we will notify you and the authorities as required by law.

11. Children

URelf is not intended for children under 16, and we don’t knowingly collect their personal data.

12. Changes

If we change this policy materially, we’ll notify account holders by email or in the dashboard before the change takes effect. See also our Terms of Service.