Privacy Policy

1. Information we collect

Account information. When you sign in with Google, we receive your email address and Google's unique identifier for your account. We don't receive your Google password.

Link data. The destination URL, short code, optional custom slug, and expiration date for each link you create.

Click analytics. Each time a short link is followed, we record when it happened, the referring page (if any), the visitor's IP address, browser and device information (including the user agent), and any UTM parameters included in the request. When you view a link's analytics, we derive an approximate country, device type, browser, and operating system from that IP address and user agent, on the fly; we don't store those derived values separately.

Billing information. If you upgrade to a paid plan, your payment is handled by Stripe Managed Payments, which acts as merchant of record for that transaction; we never receive or store your card details. We do store the subscription's status, its provider-assigned customer and subscription identifiers, and its renewal date, so we know which plan you're on.

API keys. Pro accounts can create API keys for programmatic access. We store a name you give the key, a short prefix of it, and a one-way hash of the key itself, never the raw key, which is shown to you once, at creation.

2. How we use it

We use this information to operate the Service: creating your account, resolving and tracking your short links, showing you analytics for links you own, and keeping the Service secure (for example, rate-limiting abusive requests).

3. Cookies and tracking

The Service sets one functional, HttpOnly session cookie when you sign in, used only to keep you signed in; it expires automatically after 72 hours. We don't use third-party advertising or tracking cookies, and we don't run any analytics scripts on our own pages.

We don't track your activity across third-party websites or services for advertising or profiling, and we don't allow third parties to use bl8.us for cross-site advertising or profiling. Because the Service doesn't engage in this type of tracking, browser "Do Not Track" signals don't change how it operates.

4. Sharing

We share information only as needed to operate, secure, and support the Service.

Authentication providers. We use Google Sign-In to authenticate accounts and receive the account information described above.

Payments. Paid subscriptions are handled through Stripe Managed Payments, which acts as merchant of record. Stripe handles payment and transaction information according to its own terms and privacy practices; we receive only the subscription and customer information needed to manage your plan.

Hosting and infrastructure. The Service runs on infrastructure provided by our hosting provider, which stores and processes data on our behalf as needed to operate the Service.

Internal operations. Our billing synchronization process may send limited account and subscription information to our private internal Slack workspace when a billing discrepancy is corrected.

Legal and safety. We may disclose information when reasonably necessary to comply with law, enforce our Terms, investigate fraud or abuse, or protect the rights, safety, and security of the Service, our users, or others.

We don't sell your personal information or share it for cross-context behavioral advertising.

5. Retention

We keep your account information while your account remains active.

Link data and click analytics are kept while the related links remain in your account, unless you delete them sooner.

We keep the billing and subscription information we receive from Stripe only as long as needed to operate your subscription, maintain appropriate business records, and meet applicable legal obligations. Stripe may retain transaction information separately under its own legal and operational requirements.

When you delete your account, we delete the account data we control, subject to limited information we may need to retain for legal, security, fraud-prevention, or recordkeeping purposes.

6. Security

We take reasonable measures to protect your data, but no method of storage or transmission is completely secure, and we can't guarantee absolute security.

7. Your choices

You can delete individual links at any time from your account. You can permanently delete your account from your Profile page; this deletes your account, links, and associated Service data, subject to limited information we may retain where required or permitted by law. Deleting your account also cancels any active subscription.

Your email address and Google account identifier come from Google Sign-In. To change them, update your Google account or sign in with a different supported account. For other personal information we maintain about you, contact us at info@bl8.us.

8. Children's privacy

The Service isn't directed at children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has provided us personal information, contact us and we'll take appropriate steps to delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll provide reasonable notice, such as by updating this page or displaying a notice in the Service. The "Last updated" date above shows when this policy was most recently revised.

10. Contact

Questions or privacy requests? Contact info@bl8.us.