Privacy
What happens to information when you open a short link on c1k.me or use an account here.
When you open a short link
The server looks up the link and sends your browser on to its destination. For links whose organization has analytics switched on, it adds one to a set of daily counters:
- the number of redirects for that link and day, split into known bots and unclassified requests;
- the referring site's host name only (never the page, query or anything after it), or "unknown/direct";
- a coarse browser family and device type (desktop, mobile, tablet, bot or unknown);
- a two-letter country code when the hosting provides a local GeoIP database, otherwise "unknown".
No list of individual visits is kept. Your IP address and your full browser identification string are not stored by the application.
Approximate unique counts
Daily unique estimates come from a 64-register HyperLogLog sketch fed with a keyed SHA-256 hash of the source address and browser family. The key changes every UTC day, so the same visitor cannot be linked across days. The estimate has a relative standard error of about 13 percent in its normal range, counts devices behind a shared address as one, and does not count people.
How long counters are kept
Per-link daily counters are kept for seven UTC days, organization totals for 30 days and organization-level referrer, country, browser and device distributions for seven days. A running total per link is kept until the organization purges its analytics or deletes the link. Organizations can switch collection off, shorten retention or purge counters at any time.
Password-protected links
After a correct link password the browser receives a cookie that is valid for 15 minutes and for that link only. Short links set no other visitor cookies.
Accounts
For team members the service stores an email-shaped login name, a salted password hash, organization memberships and roles, hashed session tokens and, when enabled, an encrypted two-factor secret. Changes made in an organization are recorded in a short activity history without passwords, secrets or full destinations. The operator can export or remove an account on request, provided each organization keeps an owner.
The operator keeps encrypted backups of this data outside the hosting, so the service can be restored after a failure. A backup holds the same account data as the service itself and never plain passwords.
Hosting provider logs
The web hosting provider runs its own access and error logs outside this application. Their content and retention are set by the provider, so the operator cannot change or delete them.
Contact
The operator contact has not been published yet.