Privacy Policy

mikrouli.link (the "Service") is operated by MTX STUDIO LTD, company number 15856187, registered in England and Wales. Our registered office is Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ. The directors are Christos Mentis and Theodoros Mentis. Full operator details are on the imprint.

We are the controller of the personal data described in this policy. For privacy questions or to use your rights, email hello@mikrouli.link. We are not registered for VAT.

This policy is written for the UK GDPR and the EU GDPR. The same practical rules apply under both. The legal bases below refer to Article 6 of each.

If you create an account, we store:

• your name and email address;
• a one-way hash of your password, if you register with email and a password (we never store the password itself);
• your GitHub user id, if you sign in with GitHub, plus the name and email GitHub sends us;
• whether your email is verified, and a verification token with a 24-hour expiry;
• a password-reset token with a 1-hour expiry, when you ask for one;
• your plan (Free, Pro, or Business) and payment status;
• your Stripe customer id and subscription id, when you pay;
• a hash of an API key, and when it was created, on the Business plan;
• whether you want expiry reminder emails (on unless you turn them off);
• when the account was created.

If you register with email and later sign in with GitHub using the same email, we link those sign-in methods only when the email on the existing account is already verified. GitHub sign-in does not take over an unverified password account. New GitHub accounts are marked verified.

For each short link we store:

• the destination URL, including any UTM parameters you add;
• the short code, or the custom alias on plans that allow one;
• the account that owns it, or a flag that it was created without an account;
• a hash of a creator token, for anonymous links, so the browser that created the link can claim it later;
• the click count, last click time, expiry time, archive time, and why it was archived (it expired, you removed it, or we removed it);

The creator token itself sits in an httpOnly cookie in that browser for up to 90 days. We store only the hash.

When someone opens a short link, and the visitor is not a known bot or crawler, we record:

• the time of the click;
• an anonymized IP address: for IPv4 we keep the network and set the last octet to 0; for IPv6 we keep the first three groups;
• the user agent (browser, operating system, and device type);
• the referring page, when the browser sends one.

The link owner can see this in their analytics. We still treat click records as personal data. The anonymized IP, user agent, and referrer together can sometimes single someone out.

Paid plans are billed by Stripe. Stripe collects your card details. We do not receive or store the full card number. We send Stripe your email address, account id, chosen plan, and billing interval (monthly or annual) so the subscription can be attached to your account. We then store the Stripe customer id, subscription id, plan name, and payment status.

We send email through Resend. That covers email verification, password resets, and abuse reports sent to abuse@mikrouli.link. An abuse report contains the URL you report, the reason you choose, and your email address if you choose to leave one. We also email a verified account about links that are about to expire or have just expired: one message when the expiry date is within three days, one on the expiry day, and one after the link has been archived. Each message lists that stage's links for your account. We do not send a separate email per link, we do not email an unverified address, and anonymous links have no address to use. The message has a link to turn these reminders off. We record which stage we already sent for each link so we do not send it twice. We do not use these messages for marketing.

Upstash Redis holds short-lived rate-limit counters. The key can include your IP address, your email address (for registration, sign-in, and password reset), or your account id. Most counters expire within minutes or hours. The anonymous monthly link cap keeps the IP address in the key for up to 31 days. The same Redis service also caches a redirect target (destination URL and expiry) for a few minutes so links open quickly. Production does not serve the Service if this store is missing.

If you opt into the bot check, Cloudflare Turnstile receives the challenge token and your IP address when you register or submit an abuse report. The check is on only when we have configured it.

Sentry receives error reports when a data source name (DSN) is configured. Those reports can include the page address and technical details of the failure. We do not enable performance tracing or session replay.

Vercel Web Analytics records cookieless page views (page path, referrer, browser, device, and country derived from the IP address). Vercel Speed Insights records performance measurements such as Core Web Vitals. Before a page view is sent, we strip query strings and remove password-reset tokens from the path, so a verification link or reset link is not included.

We also record conversion events from the server: signup (a new account was created), link_created, upgrade (a paid Stripe checkout completed), expiry_email_sent (a reminder stage went out), and restore_after_upgrade (how many expired links were restored). The properties are the plan name, the billing interval, the reminder stage, or a count. They do not include your name, email, account id, or the destination URL. The server call does not forward your session cookie or IP address.

The footer loads a Buy Me a Coffee button image from that service's content network. Their servers see the request for the image. The image is not a tracker we control.

We use a small number of cookies that are needed to run the Service:

• a signed session cookie so you stay signed in (about 30 days);
• an httpOnly CSRF cookie (about 8 hours) on actions that change data;
• an httpOnly creator-token cookie so an anonymous link can be claimed.

Your theme choice and the dismissal of the cookie notice are stored in the browser's local storage. They are not sent to us as account data. Vercel Web Analytics and Speed Insights do not set cookies. We do not use advertising cookies.

Under the UK GDPR and the EU GDPR we rely on these bases:

• Contract (Article 6(1)(b)): creating and running your account, shortening links, applying plan limits and expiry, sending verification, password-reset, and expiry-reminder email, and taking payment for a plan you choose.
• Legitimate interests (Article 6(1)(f)): click analytics for the link owner, keeping archived links so a short code is never issued twice, rate limiting, abuse reports, error monitoring, and cookieless product measurement. These interests are running a safe and understandable short-link service. They are not overridden by your rights where the data is limited as described above. You can object, as set out below.
• Legal obligation (Article 6(1)(c)): records Stripe and we must keep for tax and accounting.

We do not use consent as the basis for advertising, and we do not sell personal data. Strictly necessary cookies do not require consent. We do not make solely automated decisions that produce legal effects about you.

We share personal data with these processors, only so they can run their part of the Service:

• Neon — Postgres database for accounts, links, and clicks;
• Upstash — Redis for rate limits and the short-lived redirect cache;
• Vercel — hosting, Web Analytics, and Speed Insights;
• Stripe — subscriptions and card payments;
• Resend — transactional email and delivery of abuse reports;
• Sentry — error reports, when a DSN is configured;
• GitHub — optional sign-in;
• Cloudflare — optional Turnstile bot check.

Several of these providers process data in the United States and in other countries outside the UK and the EEA. Where personal data leaves the UK or the EEA, we rely on an appropriate transfer safeguard, such as the provider's standard contractual clauses and the UK international data transfer addendum.

Account data is kept while the account exists. If we close an account, we delete the account row (name, email, password hash, and billing ids we stored). There is no self-serve delete button; email hello@mikrouli.link and we will do it.

Links and click records are kept, including after a link expires, after you remove it from the dashboard, and after an account is closed. Expiry, a dashboard delete, and an admin removal all archive the link. They do not delete it, and they do not delete its clicks. We keep them so the short code is never given to someone else. Archived links stop redirecting.

Verification tokens last 24 hours. Password-reset tokens last 1 hour. Rate-limit keys expire with their window (minutes, hours, or up to 31 days for the anonymous monthly cap). The redirect cache lasts about 5 minutes, or less if the link expires sooner. Stripe keeps payment records under its own policy. Sentry and Vercel keep events for the retention period configured on those accounts.

Under the UK GDPR and the EU GDPR you can ask to access, correct, erase, or restrict your personal data, and you can ask for a portable copy of the data you provided. You can object to processing based on legitimate interests. You can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to your local supervisory authority.

Email hello@mikrouli.link to use these rights. We may need to confirm it is you. Archived links and their clicks are kept, as described above. If you need a destination URL taken off an archived link, say so in the email and we will clear it where we can do that without reissuing the short code.

The Service is not directed at children. You need to be old enough to enter a contract where you live. If you believe we have account data for a child, email us and we will delete the account.

We use HTTPS, HSTS in production, password hashing, hashed API keys, hashed creator tokens, CSRF checks on changes, and rate limits. No method of transmission or storage is completely secure.

We will post changes on this page and update the effective date. The date at the top of this page is 18 October 2026.

MTX STUDIO LTD, Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ. Email hello@mikrouli.link. To report a link, email abuse@mikrouli.link or use the abuse form.