Your data, explained.

Information we process

TinyUrls is a product of Zehn Technology, Sector 132, Noida, Uttar Pradesh, India. Contact our team using the privacy-request details below.

When you create an account, we store your name, email address, a password hash, and account information. We store submitted destination URLs, short aliases, and settings such as passwords, expiry dates, and campaign labels when those features are used.

When someone opens a short link, we may record the IP address, browser user agent, referring page, approximate location, device, operating system, and time of the visit. IP addresses and similar online identifiers can be personal data. Link owners see analytics derived from this activity.

We also process support messages, security logs, API token metadata, and payment-provider references and subscription status. Do not place confidential credentials or sensitive personal information in a destination URL.

How the information is used

We use this information to create and redirect links, authenticate accounts, provide analytics and reporting, enforce access to paid features, prevent abuse, troubleshoot problems, and respond to support requests.

Short URLs are shareable identifiers. Anyone with an unprotected short link can open its destination. Password protection adds an access check but is not a replacement for secure access controls on the destination website.

Service providers and external destinations

Dodo Payments processes paid subscriptions. Checkout is hosted by the payment provider; TinyUrls does not receive your full card number. The provider receives information needed for checkout, billing, taxes, fraud prevention, and receipts, including your account name and email address.

Hosting and infrastructure providers process data needed to operate the service. Link checks may send a destination URL to Google Safe Browsing when that integration is enabled. Fonts, scripts, analytics, and advertising services may receive information such as your IP address and browser details when your browser connects to them.

Destination websites are operated independently and have their own privacy practices. Review the relevant provider policies, including Google's privacy policy and Dodo Payments' privacy policy.

Cookies, analytics, and advertising

Session and security cookies support sign-in, remembered sessions, and request protection. Disabling them can prevent account features from working.

We measure public-page activity using first-party daily aggregate counts and broad referral categories. Daily visitor estimates use a hashed session identifier kept in a short-lived server cache for up to two days; the aggregate table does not store IP addresses, full referring URLs, query strings, phone numbers or message text. Known crawlers, signed-in administrators, short-link redirects, and requests carrying Do Not Track or Global Privacy Control signals are excluded from this report. Existing homepage first-visit and link-security records may separately contain IP addresses. Visitor estimates are not a verified count of people.

Free and signed-out pages may load Google AdSense. Advertising providers may use cookies or similar technologies according to their policies and your applicable settings. Paid accounts do not load the advertising script while signed in. Site analytics may run separately when configured; an ad-free plan does not disable necessary account cookies or all analytics.

You can manage browser cookies and review Google ad settings. Browser choices may need to be set on each device.

Retention and your choices

Account and link information is kept to provide the service. Analytics windows determine which historical click data your plan can display; they are not a promise that all underlying records are deleted after that window. Security, billing, and operational records may need different retention periods.

Login and email confirmation are required to create links and use account tools. You can update an incorrect email after confirming your password, then verify the new address. Unverified accounts receive one month to verify; changing an unverified address does not restart this period. We send a reminder in the final week where delivery succeeds. Overdue accounts are removed from sign-in using recoverable deletion, not immediate destruction of all records; public links, QR codes and associated operational records are retained. Admin and billing-linked accounts require manual review to avoid disrupting administration or leaving recurring charges unmanaged. Contact support about recovery or a full deletion request.

For abuse investigation, link visits, outbound actions and link creation record server-observed IP addresses, UTC timestamps, account and link identifiers where available, destination snapshots and browser signatures. IP-based country and city are approximate and may be unavailable or reflect a VPN or network provider. We do not record passwords, verification codes or payment secrets in these records. Security records are restricted to administrators and are separate from aggregate audience statistics.

You can remove owned links from your dashboard and revoke API keys. To request access, correction, deletion, or information about the data associated with your account, email us. We may need to verify account ownership and explain any records that must be retained.

Questions or requests

Email zehntechnology@gmail.com with your request and the account or short link involved. Please do not send passwords or full payment-card details.

We update this page when our practices change. The date above identifies the latest revision. Also see our terms and billing and refund information.