Privacy policy

Updated October 4, 2026

1shorturl is operated by 1ManMission.

We process account and link data to operate 1shorturl.

Data we process

• Account email, password hash, preferences, and the most recent signed-in activity timestamp, visible to administrators for account support and service management.
• Destination URLs, short codes, titles, expiration settings, and click counts.
• Click timestamps, country, browser, operating system, device category, bot classification, referring website hostname, and whether a visit used a QR-marked link, a regular link, or has no recorded entry source.
• Session tokens and password-reset tokens are stored as hashes. Rate limiting uses hashed request identifiers.

Optional ChatGPT sign-in

When you choose ChatGPT sign-in, Sites supplies your authenticated email and a stable identity specific to this site. We store a hash of that identity linked to your 1shorturl account. We do not receive your ChatGPT password or conversations and do not use your ChatGPT plan for AI requests. New accounts still require email verification. Existing accounts are linked only after you sign in and confirm your password. You can remove ChatGPT sign-in from the ChatGPT sign-in page after confirming your password; account deletion also removes the mapping. Email/password login remains available.

Public link sharing

Links are unlisted by default. If you make a link public, its destination, title and aggregate activity recorded while public may appear in the community feed and Premium domain reports. Private-period clicks and imported historical clicks are excluded. Making a link private removes it from future shared reports; previously downloaded reports cannot be recalled. Anyone with an exact short URL can still follow it.

Scheduled destinations

When you schedule a link change, we store its future destination, activation time, creation time and status. Schedules are visible through your authenticated workspace and administrator support access; future destinations are not published before activation. Applied destinations follow the link’s existing visibility settings. Schedules are deleted when their link or owning account is deleted.

Destination change history

We keep previous and new destination addresses and change timestamps so you can review and undo edits. History is available through the authenticated account workspace, including administrator support access; it is not included in public link or collection pages. Destination history is deleted when its link or owning account is deleted. Restoring an address runs the same safety checks as editing a link.

Shared collections

Collections begin as private drafts. When you publish, the collection title, description and selected public links are visible to anyone with its URL. Visitors see eligible links’ titles, descriptions and destinations. Your account email and unlisted links are excluded. Unpublishing or deleting stops future access to the collection page but cannot recall content someone already copied; individual short links retain their own behavior.

QR codes, campaigns and public stories

New QR images include a marker in the short URL so visits can be grouped by entry source. This does not establish a visitor's identity or count scans that never open a link. Public story links have separate aggregate reporting. Campaign labels become part of the destination URL and are sent to that website when opened; its privacy practices apply there.

Support

The support form prepares an email draft in your browser. It is not submitted until you send it through your email provider. Information you send, including your email address, message and attachments, is used to handle your request. Avoid sending passwords, API keys or reset links.

Your choices

You can delete links and update account details from your dashboard. For account deletion or privacy questions, contact privacy@1shorturl.com.

Your public IP display

The footer shows the public IP address our hosting service sees for your current request. A VPN, proxy or cloud browser may supply that address. The display uses no third-party lookup and adds no database storage of IP addresses. Its response is not cached. Infrastructure logging and existing security rate limits remain as described here.

Cookies and storage

We use an essential session cookie to keep you signed in. Your selected display language is saved in your browser. The installed app caches its icons and an offline message; it does not cache account pages or link redirects.

Payments

When you subscribe, Stripe processes your payment details. We store Stripe customer and subscription identifiers and subscription status to manage Premium access. Your account email is shared with Stripe for billing. We do not store your full card number. See Stripe’s privacy policy.

Service providers

Hosting and email providers process information needed to operate the service. Requests may be recorded in infrastructure logs for reliability and abuse prevention.

Bot protection

We use Cloudflare Turnstile when you create links to help detect automated abuse. Cloudflare processes browser and network signals for this check. Learn more in Cloudflare's privacy policy.

Destination safety checks

When external screening is enabled, we send destination URLs, including their path and query parameters but excluding URL fragments, to Google Web Risk to check for known phishing, malware and unwanted software. This applies to new and edited links and periodic rechecks of existing links, including unlisted links and customer-owned subdomains. We store check results and usage totals to enforce safety decisions and control costs. We do not send your account email or password with these checks. Avoid shortening URLs containing confidential tokens or personal information. A result with no known threat is not a guarantee of safety. See the Google privacy policy.

Security

We use reasonable safeguards; no method is 100% secure.