Privacy

What I collect

When someone clicks a trak.sh short link, I record: the destination URL, a hashed IP address (so I can count unique visitors without storing raw IPs), the user agent, the referrer (if your browser sends one), the country derived from the IP, and a timestamp. I do not record full IP addresses, query strings beyond UTM params, or any personal data from the destination page.

When someone opens a Drop, I reserve the file size against the uploader's download allowance. For non-bot opens, I also record a keyed hash of the IP address, country, browser, device, operating system, referrer, timestamp, and file size. These are pseudonymous analytics, not anonymous data.

Where it lives

Account, link, Drop metadata, and analytics data are stored in a Neon Postgres database in the US. Uploaded Drop files are stored in a private Cloudflare R2 bucket and are delivered through short-lived signed URLs. Auth sessions are managed by Better Auth. Payments are handled by Polar.sh. Emails are sent via Resend. Rate limiting uses Upstash Redis. The application runs on Vercel. I do not sell data to anyone, ever.

How uploaded files are handled

Drops accept PNG, JPEG, GIF, WebP, and PDF files. During upload, the server checks the declared size and type, filename extension, and the beginning of the file for the expected signature. This is type validation, not antivirus or malware scanning. Files stay private in R2; anyone who has the Drop link can request a short-lived download URL until the Drop expires, reaches its limit, or is deleted.

What I don't do

• No advertising cookies
• No fingerprinting
• No third-party trackers on click redirects
• No selling click data to anyone
• No reading the contents of your destination URLs
• No using uploaded Drops for advertising or model training

GDPR / deletion

If you have an account, you can delete it at any time from Settings. trak.sh deletes uploaded R2 objects before removing the corresponding records, then deletes your links, analytics, and account data. If file storage is temporarily unavailable, the request reports an error and keeps the records so deletion can be retried safely. Expired Drops and abandoned uploads are removed by the same retry-safe cleanup process.

If you want me to remove click data associated with a specific link you don't own (e.g. a short link someone else shared that points to you), email me at the contact below and I'll handle it manually.

Contact

Questions, concerns, deletion requests: shakirul@trak.sh.