Privacy

Redirects set no cookies

Opening a toa.ee short link does not set a cookie. We do not run third-party analytics on redirects. App pages (login, dashboard, settings) use a strictly necessary session cookie so you stay signed in.

visitor_hash, not raw IPs

When someone opens a short link we do not store their IP address. In memory we compute visitor_hash = sha256(daily_salt + ip + user_agent), then keep only the first 16 hex characters. daily_salt = sha256(SECRET + current UTC date). The hash rotates every UTC day, so yesterday's clicks cannot be joined to today's. The raw IP is discarded and never written to the database, logs, or analytics exports.

Country is looked up in memory from MaxMind GeoLite2, then stored as a two-letter code. Device and browser come from the User-Agent. Referrer is stored as a domain only. Unique clicks are distinct visitor_hash values for that UTC day.

What we keep

Account: email, hashed password (or Google account id), plan, and Stripe customer id. Plan is updated only by Stripe webhooks.

Click stats: timestamp, country, device, browser, referrer domain, bot flag, and visitor_hash. We never store destination URLs in click rows. Free analytics queries cover 30 days; Pro and Max keep full history while each link exists. Raw click rows older than 400 days are deleted.

Anonymous try-it links store a hashed claim token so we can attach the link if you sign up in the same browser. Abuse reports store a hashed reporter IP (sha256), never the raw address, plus a short reason.

Why this is a GDPR link shortener

No redirect cookies, no advertising identifiers, and no IP addresses on disk. visitor_hash is not a stable visitor profile — it changes every UTC day by design. That is the product, not a footnote.

Your rights

You can export Pro click rows as CSV (no raw IPs, no destination URLs). Account deletion is a soft-delete with a 30-day grace, then links are deactivated. Contact us from Settings if you need a copy of your account data.