Privacy

Written to be accurate rather than reassuring. Where something is a trade-off, it says so.

Cookies

BarLink uses a signed session cookie to protect forms against forged requests, remember which anonymous links you created, and keep you logged in after sign-in. It is used for these essential functions, not advertising or tracking across websites.

Pages containing forms can set this cookie even if you have never signed in. Your light/dark theme choice is stored in your browser's local storage, not a cookie, and is never sent to the server.

There are no third-party analytics, advertising, or fingerprinting scripts.

What a click records

When someone opens a short link, BarLink stores:

• The time of the click
• Device type, browser, and operating system, parsed from the user-agent string
• The referring page, when the browser sends one
• Approximate country and city
• A SHA-256 hash of the visitor's IP address combined with their user-agent

The raw IP address is not stored. The hash exists so a link owner can see roughly how many distinct people clicked rather than just how many clicks happened.

Being straight about this: a hash of an IP address is pseudonymised data, not anonymous. The range of possible IP addresses is small enough that someone holding the hash and enough computing power could work backwards to the original. We treat it as personal data, and so should you.

Who else sees your data

• Supabase hosts the database and handles sign-in.
• Render hosts the application.
• Sentry receives error reports. These deliberately exclude cookies and IP addresses.
• freeipapi.com receives a visitor's IP address to resolve approximate location. This is a transfer to a third party, and it is the only case where an unhashed IP leaves the server.

Who can see a link's analytics

Only the account that created the link. Links created while signed out have no owner, so nobody can see their analytics — including us in any routine sense.

Retention and deletion

Deleting a link deletes its click records with it, immediately and permanently. Otherwise data is kept for as long as the link exists.

Contact

For questions about your data, or to request deletion of an account and everything attached to it, get in touch through the address on the about page.