Privacy Policy

1. Who is responsible

[LEGAL NAME], based in Jamaica at [POSTAL ADDRESS] ("shrnq", "we"), is the data controller for account, billing-status and website data, and for the click records we keep for security and abuse prevention. For the click analytics we show to link owners about their links, the link owner is the controller and shrnq is the processor (section 9).

Privacy requests: [PRIVACY EMAIL]. Registration with the Jamaican Information Commissioner: [OIC REGISTRATION NO. OR PENDING].

2. Data we collect

Account holders

• Name, email address and password (stored hashed; we cannot see it), an email-verified flag, and an optional profile image reference.
• Session records: session token, expiry, and the IP address and user agent at sign-in and refresh.
• Workspace data: workspace name, plan, subscription status, Polar customer and subscription IDs, and the current period end. We do not store card numbers.
• Your content: links (alias, destination, title, status, expiry, timestamps), folders, tags, custom-domain hostnames and verification tokens, QR settings.
• Your acceptance of the Terms and Privacy Policy: which version, and when. We do not store your IP address with it.
• Messages you send us.

Visitors who open a short link

No account is needed and no cookies are set. When a link is opened we store one click record, only if the link is active and the owner is within their plan's click cap:

• time of the click (UTC);
• country code, worked out in memory by matching your IP address against a public country-range file on our server (no geolocation service is called);
• device type, browser family and operating-system family from your user agent, and a bot flag;
• the referrer: scheme, host and path only, with query string and fragment dropped, or "direct";
• a pseudonymous visitor key: an HMAC-SHA-256 of the UTC date, your IP address and your user agent, made with a secret key kept on our server. It changes every day, so it cannot follow you across days. We use it to count approximate unique visitors per day.

We do not store your IP address in the click record. We do process it briefly to produce the data above, and like any web server our hosting infrastructure may keep it in access logs for a limited time. Because the visitor key is derived from your IP address and user agent, it is personal data (pseudonymised) under GDPR, UK GDPR and the Jamaica Data Protection Act.

People who submit an abuse report

The reported URL, the reason, your notes, the time, and the status. Your email address is stored only if you choose to give one. We may use your IP address briefly to limit repeated submissions. If you email us we keep your email address and message.

Website visitors

Standard server logs, and the cookie described in the Cookie Policy. We use no advertising or analytics trackers.

3. Why we use data, and the legal basis

We do not sell personal data, track you across sites, build advertising profiles, or make decisions with legal effect solely by automated means. Automated bot flags and abuse blocks are reviewed by a person on request. We send no marketing email; if that changes we will ask for consent first.

4. Who receives data

See the Subprocessors page for the full list. In short: Polar (billing; Merchant of Record and independent controller for payment data), Resend (transactional email), our hosting and backup providers, GitHub (source code only, no personal data), and link-scanning services that see destination URLs only. We may disclose data when the law requires it or to protect rights and safety.

5. International transfers

We operate from Jamaica and use providers in other countries, including the United States. Where personal data from Jamaica, the EU or the UK is transferred abroad we rely on adequacy decisions or the EU–US Data Privacy Framework where a vendor is certified, standard contractual clauses or the UK IDTA with vendors, or contractual protections that meet the Jamaican standard of adequate protection.

6. Retention

• Account and link data: while your account exists. When you delete your account it is erased immediately. If we end an account, we delete its data within 30 days. Short link addresses you created are kept as retired entries (with no destination, title or password) so nobody else can register them.
• Click records: 13 months, then deleted.
• Sessions: until they expire or you sign out, then deleted.
• Abuse reports and copyright notices: 3 years.
• Consent records: the record of the terms and privacy versions you accepted, and when, is kept after you delete your account, linked only to an anonymised account ID, so we can show what you agreed to.
• Billing records: as Polar and tax and accounting law require.
• Backups: kept for a rolling 7 days, then overwritten. Data you deleted can remain in a backup until it rolls off in that window; we do not restore it into the live service.

7. Your rights

Depending on where you live (Jamaica DPA 2020, GDPR, UK GDPR, CCPA/CPRA and others) you can ask to access, correct, delete, restrict, object to or port your data, withdraw consent, and complain to a regulator. Email [PRIVACY EMAIL]. We reply within 30 days, or sooner if the law sets a shorter period, and may need to verify your identity.

• Account holders: you can delete your account, and export your data, from your account settings, or ask us by email.
• Visitors: click records contain no IP address and the key rotates daily, so we usually cannot tell which record is yours and cannot reliably find or delete it (GDPR Art. 11). You can still object to the processing by emailing us.
• Regulators: Jamaica, Office of the Information Commissioner (oic.gov.jm); EU, your national data protection authority; UK, the ICO; California, the CPPA and Attorney General.

8. Security

HTTPS everywhere; passwords hashed; session cookie HttpOnly, Secure and SameSite=Lax; the visitor key is an HMAC with a secret key; the database is not publicly exposed; access is limited to the operator. No system is perfectly secure. If a breach affects your data we will notify the Information Commissioner within the statutory period and affected people as the law requires.

9. Link owners' visitors: controller and processor

Link owners decide to use shrnq analytics on links they share, and are the controller of that visitor data under GDPR. shrnq acts as processor for that purpose and will sign a Data Processing Addendum on request ([PRIVACY EMAIL]). shrnq remains an independent controller for abuse and security processing and for billing status.

10. Children

shrnq is for people 16 and over and is not directed at children. If you think a child has an account, email us and we will delete it. We do not knowingly collect data from children.

11. California notice

In the last 12 months we collected these categories: identifiers (name, email, IP address at sign-in, device identifiers), internet activity (click records) and commercial information (plan and subscription status). We do not sell or share personal information for cross-context behavioural advertising and do not knowingly sell data of anyone under 16. California residents may ask to know, delete and correct their data; we will not discriminate against you for doing so.

12. Changes

We post changes here. For material changes we email account holders at least 30 days before they apply, and ask you to accept the new version when you next sign in.

13. Contact

[LEGAL NAME] · [POSTAL ADDRESS] · [PRIVACY EMAIL]

Print this page