Built on zero long-term raw IP tracking principles
Unlike legacy URL shorteners, our redirect architecture never writes raw visitor IP addresses to long-term storage. To estimate unique daily visitors, an HMAC-SHA256 hash is computed using a secret key rotated every 24 hours. Once the day concludes, historical IP recreation is cryptographically impossible.
We record high-level anonymized device categories (desktop, mobile, tablet), referring domain hostnames, and timestamps to display link performance metrics to link owners.
Registered user passwords are encrypted using bcrypt hashing (cost 12). Sessions utilize HttpOnly, SameSite, and Strict-Mode session cookies to prevent cross-site token theft.