Privacy

Short links and shortened QR codes

When you create a short link, we store its code, complete destination URL, creation time, and any expiry, disable, or purge timestamps. URLs can contain personal information in their path, query, or fragment. Avoid shortening private access links, passwords, or sensitive information.

Short-link destinations are public to anyone with the link. Short codes are not secrets or access controls.

QR codes generated locally

Plain-text QR codes and website QR codes with “Use a urlito.com short link” turned off are generated in your browser. Their content is not sent to our creation API. When shortening is enabled, the destination is sent to and stored by the link service.

UTM links, WhatsApp links, and URL cleaning

These tools process your input in your browser. We do not send their form contents to a processing API or store the generated results. WhatsApp links include the phone number and any prefilled message, so anyone with the link can read them.

If you choose “Shorten link” or “Create QR code”, the resulting URL is passed to that page in its query string. It may appear in browser history and hosting request logs. Shortening then sends the destination to our link service. Opening a generated link sends you to its destination provider.

Verification and abuse prevention

Cloudflare Turnstile processes verification information when you use a protected form. We send the verification token and client IP address to Cloudflare to check it. See Cloudflare’s Privacy Policy for its practices.

Our quota tables store an HMAC-derived identifier rather than the raw IP address, together with a time window and count. Cloudflare hosting and network infrastructure also process request information, such as IP addresses, to serve and protect the site. Hashed identifiers are pseudonymous, not a guarantee of anonymity.

Browser preferences

We store your light or dark theme choice in local storage. You can remove it by clearing this site’s browser data. The tools do not automatically save your entered links or QR content to a history.

Reports

A submitted abuse report includes the short-link code, selected reason, your explanation, and a submission timestamp. Please include only the information needed to understand the concern. Report submission uses verification and an IP-derived quota identifier.

Storage and retention

Turso stores link mappings and reports; Cloudflare hosts the site and verification service. Default links do not have an automatic expiry. If an expiry is configured, the destination becomes unavailable at expiry and the cleanup job removes its destination data while retaining the code to prevent reuse.

Expired quota windows are removed by the scheduled cleanup job. Reports currently have no automated deletion schedule. Infrastructure logs and backups are subject to the providers’ retention practices.

Questions and requests

The Report page accepts concerns about specific short links, including privacy concerns. Do not include identity documents or other sensitive material in a report. An operator contact address has not yet been published.