Privacy Policy · v0.3-beta
Privacy Policy — 短.在线
Version: 2026-10-29
Last updated: 2026-10-29
Language: English is controlling. A Simplified Chinese courtesy translation is available; in case of conflict, English prevails.
This Privacy Policy explains how Arasaka Oy (“we,” “us,” “短.在线”) processes personal data when you use the 短.在线 short-link and QR service. It is written for GDPR (and UK GDPR where applicable) and includes PIPL-aware notes for when personal information of individuals in China is processed.
Related: Terms of Service · Acceptable Use Policy
1. Controller and contacts
Controller: Arasaka Oy (limited company / osakeyhtiö), Business ID 2138210-8, registered office (domicile) Helsinki; postal and visiting address Santaradantie 7 F 203, 01370 Vantaa, Finland.
| Topic | Contact |
|---|---|
| Privacy requests | privacy@短.在线 |
| Abuse / safety | abuse@短.在线 |
| General support | support@短.在线 |
| DPO | Not appointed at this time; will be designated if legally required |
Contract vs privacy law:
- Contract governing law / venue for the Terms: Finland.
- Privacy law: As a Finnish controller, GDPR applies to our processing as an EU establishment. UK GDPR applies where UK law covers the processing. Finnish contract venue does not displace additional privacy regimes that apply by law.
- PIPL-aware notes apply when personal information of individuals in China is processed.
2. Scope
This Policy covers:
- Visitors and creators using anonymous shortening or accounts.
- Recipients who open ordinary short-link URLs or QR-tagged URL variants (visit events).
- Business contacts (support).
It does not cover third-party destination websites you are redirected to — those have their own policies.
We do not promise mainland China ICP hosting.
3. Categories of data we process
3.1 Account
- Email, name (if provided), password hashes or SSO identifiers.
- Support correspondence.
- Connected AI assistants and apps (OAuth). When you connect an assistant or app, we store the app's name and client identifier, the permissions (scopes) you approved, when you approved them, and hashed access and refresh tokens. You can disconnect an app at any time in Settings, Connected apps. When you disconnect it or delete your account, the app loses access at once, and we delete its tokens 30 days later (see §5). Security logs about the connection follow §5.
- Pending connection requests. When an app asks to connect to your account, we keep a record of the pending request. We delete that record 7 days after the request expires.
- Two-step sign-in (if you enable it). The secret for your authenticator app, stored in protected form, and one-time recovery codes in hashed form.
- Terms acceptance. When you create an account we record which versions of the Terms and Acceptable Use Policy you accepted, when, in which language, your confirmation that you are 18 or older, and whether you signed up on the website or while connecting an assistant.
3.2 Link metadata (creators)
- Destination URL, short code / alias, an optional title, and the QR target.
- Create-path decision / reason codes (e.g. allowed, verification required, quarantined).
- If you sign up from an invitation link, which invitation it was (to count sign-ups from invitations).
3.3 Visit / click events (analytics + abuse)
Creator analytics and click measurement are not available. We do not show country, device, referrer, or a QR-tagged count against an ordinary short-link count. Redirects do not set a visitor or session identifier, and we do not use product-analytics cookies. The website sets an anonymous continuity cookie for rate limiting (see §7).
Server-side fields used for abuse / rate-limit / reliability:
| Field | Notes |
|---|---|
timestamp | Event time |
link_id / short_code | Which link |
ip_hmac | Keyed HMAC of IP (server secret). Pseudonymous — still personal data if linkable |
geo_country | Country-level |
ua_family or truncated UA | Not full UA by default |
bot_class | Bot / human classification |
referrer_host | Host only |
destination_host | Host of target |
source (or equivalent) | QR-tagged URL vs ordinary short-link / API / unknown |
Create-path decision / reason | On create |
We do not store for abuse purposes:
- Precise geo (lat/long / street)
- The raw IP address on the click row.
- Clipboard contents or destination-page form personal data scraped from targets
3.3a Usage events
Website usage events (not linked to you). When you use the Service, we record a small number of usage events: the home page was viewed (landing_view), an address was submitted for shortening (url_submitted), a link preview page was opened (link_preview_view), a short link was copied (link_copied), or a QR code was downloaded (qr_downloaded). Each event contains only the event name, the time, and these fields:
landing_view: the language version (locale); a device class (mobile, tablet, desktop or other), worked out from the width of the browser window; the origin of the page you came from (scheme, host and port only; no path or query); and anyutm_*campaign tags in the address you opened.url_submitted: the language version; the host name of the address you submitted (for exampleexample.com, with the port if one is given, but without the path or query); the length of that address in characters; and whether you were signed in.link_preview_view: the short code and our internal reference of the link being previewed; whether the preview could be shown; the host name of its destination; and the language version. This event records the link that was previewed, not the person who opened the preview.link_copied: where on the page the link was copied (for example the result panel or the share options).qr_downloaded: the file format of the QR code.
We drop any other fields. We do not record your IP address, or a value derived from it, with these events. We do not link these events to your account or to any identifier stored on your device. We do not use them to build a profile of you.
Account activity events (linked to your account). When you are signed in and ask the Service to do something, including through the API or MCP, our server records that action as an event linked to your account: your account was created (account_created); a short link and its QR code were created (link_created, qr_created); you created a link on a later day than your first one (second_link_created); a short link could not be created (link_create_failed); or you disconnected an app (oauth_connection_revoked). Each event contains only the event name, the time, your account, and the fields that describe the action: the short link concerned and our internal reference for it; whether it has a custom alias; the language version; whether the link was held for review; for sign-up, how you accepted the Terms, how many links made without an account were moved into your account and, if you signed up from an invitation link, which invitation; for an API batch, the batch and item reference sent with the request; for a disconnected app, the app's client ID; and for a later-day link, the number of days since your first link; for a failed creation, an error code, a short fixed error message and whether you were signed in. We do not store your IP address or the destination address of your links in these events. We use them to understand and improve how the features of the Service are used. We do not use them for advertising and we do not sell them.
If you are not signed in, our server records the same link-creation events (link_created, qr_created, link_create_failed) without any account and without any identifier stored on your device; the events for a created link refer to that link. If you later sign up and the link is moved into your account, those events become account activity events for that link.
Your right to object to account activity events. You can object to this at any time: email privacy@短.在线 from your account email (if your mail program does not accept that address, use privacy@xn--s7y.xn--3ds443g), or contact us using the details in section 1. We will then stop linking these events to your account and remove the link from the events already recorded. You do not need to give a reason.
Link status events (a link being disabled, restored or re-enabled, by you or by us: owner-disable, link_disabled, link_restored, link_enabled) are not used for product improvement. Each contains only the event name, the time, the link concerned (its short code and our internal reference), your account, who took the action (you, a member of our staff or our automated systems), and a reason code (for example, that you disabled the link, or that we re-enabled it after a review, an appeal or the restoration of your account). We keep them with the link they concern so that blocks and re-enables stay correct and for safety. An objection removes your account from them but does not remove the link reference.
3.4 Technical and security
- keyed
ip_hmac(HMAC with a server secret), security cookies for session and anonymous continuity, verification tokens, risk signals. - Server logs necessary to operate and secure the Service.
3.5 Public analytics cards
Public analytics cards are not available. We do not publish click counts.
4. Purposes and legal bases (GDPR)
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the service | A person who only clicks another person's link | Art. 6(1)(f) legitimate interests |
| Provide the service | Create an account, or create a short link you asked for | Art. 6(1)(b) contract |
| Abuse prevention and security | Rate limits, verification, bot class | Art. 6(1)(f) legitimate interests; legal obligation where it applies |
| Service mail | Address verification, password reset, a reply you asked for | Art. 6(1)(b) contract |
| DSA and illegal-content notices | The notice, the decision record, and any name or email the sender gave | Art. 6(1)(c) legal obligation and Art. 6(1)(f) legitimate interests |
| Invitation attribution | Which invitation link led to a sign-up | Art. 6(1)(f) legitimate interests (measuring our invitations) |
| Product improvement (not linked to you) | Website usage events in §3.3a (which pages and features are used, from which origin and campaign, and which websites short links point to) | Art. 6(1)(f) legitimate interests in improving the Service; you can object (§8) |
| Product improvement (linked to your account) | Account activity events in §3.3a (which actions an account takes, such as creating links) | Art. 6(1)(f) legitimate interests in understanding and improving how the Service's features are used; you can object at any time (§3.3a, §8) |
We do not sell identifiable clickstreams.
5. Retention
| Data | Retention |
|---|---|
| Raw IP | We do not store the raw IP address on the click row. We have not set a period for deleting raw IP addresses from server logs. |
| Keyed IP hash | We store a keyed hash of the IP address on a click. We clear the keyed IP hashes on clicks, event records and sign-in sessions 90 days after they were recorded, unless a legal hold applies. |
| Visit event fields for abuse (table in §3.3) | The fields in the §3.3 table stay on the click row. We delete the whole click row, and the visit record kept by our redirect service, 13 months after the visit, unless a legal hold applies. We do not aggregate these fields. |
| Account profile | When you delete your account, we replace the email address with an address that does not receive mail, we revoke sign-in sessions, and we clear the authenticator secret and recovery codes. We do not keep the original email. That step does not delete your links. We have not set a later period for deleting those links. |
| Billing records | We do not take payment. We do not keep invoices, card data, or billing records. |
| Creator analytics and click counts | The analytics page and the creator counts are off. A redirect that is not a HEAD request still writes a click row and increments the click counters on the link, including the QR-tagged counter. We delete click rows 13 months after the visit (see above). The counters on the link are kept. We do not show them. |
| Support mail | We do not keep a ticket archive. Mail you send to privacy@短.在线 or support@短.在线 stays in that mailbox. We have not set a deletion period for that mail. |
| OAuth connections and tokens | We delete an OAuth token 30 days after it can no longer be used because both its access and refresh periods have expired. When you disconnect an app in Settings, Connected apps, or delete your account, the app loses access at once, and we delete its tokens, with the permissions and times stored with them, 30 days later, unless a legal hold applies. |
| Pending connection requests | We keep a record of a pending request to connect an app to your account. We delete it 7 days after the request expires. |
| Sign-in sessions, one-time tokens and rate limits | We delete a sign-in session 30 days after it expires or is ended. We delete email verification and password reset tokens 7 days after they are used or expire. We delete records that stop a request from being processed twice 7 days after they are created. We delete rate-limit counters 24 hours after their time window ends. |
| Account emails we send | Our email provider (Postmark) keeps the content and delivery records of account emails we send you for 45 days, then deletes them. When our account with it ends, we ask it to delete our data. |
| Terms acceptance record | Life of account, plus the period needed to prove acceptance in a dispute |
| Abuse and DSA notice | The decision record, and any name or email the sender gave, while the case is open and for 24 months after we close it, then delete, unless a legal hold or a misuse investigation needs longer. If a case is still open 12 months after we received it, we review it and, unless we record a reason to keep it open, treat it as closed on that date. An anonymous eligible notice stores neither. |
| Usage events (§3.3a): website usage events and account activity events | Deleted 13 months after the event, unless a legal hold applies. If you object to account activity events, we remove the link to your account from them at that point. |
| Link status events | We keep the most recent one for each link while the link exists, so the link's status stays correct; older ones are deleted after 13 months. All are deleted when your account is deleted, unless a legal hold applies. The record of an abuse case is kept as described under "Abuse and DSA notice". |
6. Sharing and service providers
We share personal data only as needed with:
| Who | Activity | Role |
|---|---|---|
| Vercel Inc. | Hosts the web application | A provider for that hosting. Our server functions run in the EU (Frankfurt). Each request is first handled at the Vercel edge location nearest to you, which may be outside the EU. Vercel Inc. is a US company; transfers to it rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. |
| Cloudflare, Inc. | Publishes DNS for the brand domains. No Cloudflare China Network and no mainland ICP path | A provider for that DNS. No region is stated. |
| Fly.io, Inc. | Hosts the redirect service and the machine that runs our mail software | A provider for that hosting. No region is stated. |
| Stalwart | Mail software we run ourselves on that Fly machine, for abuse@短.在线, privacy@短.在线, support@短.在线 and security@短.在线 (including security reports) | Not a separate company and not a processor. |
| Postmark (AC PM LLC) | Sends account email, such as address verification and password reset | A provider for that sending. Distinct from Stalwart. |
| 101domain GRS Limited (Ireland) | Domain registration and DNS account administration | The registrar. It handles registration data as a separate controller under its own privacy statement. Distinct from Postmark and from Stalwart. |
| Dropbox (Dropbox International Unlimited Company) | Stores off-site copies of our database backups | A provider for that storage. No region is stated. |
| Zoner Oy | Hosts a server where we keep off-site copies of our backups | A provider for that hosting. No region is stated. |
Arasaka Oy is a company in Finland. That does not mean your personal data is processed only in the EU. We are the controller of the account, link, and mailbox data we hold. We do not currently process personal data on a customer's instructions. No Article 28 contract is signed. A paid plan is not offered, and a paid plan is not required. To ask about a future processing contract, email privacy@短.在线.
Our current service providers are listed on our public Service Providers page. Additional providers are added when those features go live.
We do not use an external threat service. A commercial lookup is not enabled, and we do not use the free Safe Browsing Lookup API.
A data processing agreement (DPA) for business customers will be made available according to the actual controller/processor roles for the relevant processing. Request via privacy@短.在线.
We may disclose data to authorities when legally required, or to defend legal claims / prevent serious harm.
International transfers: where data leaves the EEA/UK, we use appropriate tools (e.g. SCCs, adequacy decisions) as applicable. Typical regions and vendors are listed on the Service Providers page.
7. Cookies and similar technologies
We use:
- Strictly necessary cookies/tokens: session (
duan_session, HttpOnly, kept for 30 days), anonymous continuity for fair rate-limiting and safe retries (duan_anon, HttpOnly, kept for 1 year; set when you use the Service without an account, for example to create a link), staff sign-in verification (duan_mfa_pending, HttpOnly, kept for 5 minutes; set only while a staff sign-in waits for the second factor), and security. - A language cookie (
duan_lang, not HttpOnly, kept for 1 year) that remembers the language version you opened or chose. duan_second_link_coach_dismissed(browser storage, kept until you clear it): remembers that you closed a tip, so we don't show it again.- We do not use analytics cookies.
A cookie notice will ship with the product if non-essential client trackers are used. Server-side visit logging for redirects is described in §3–5 and is not a browser “cookie” but may still involve personal data.
8. Your rights
GDPR / UK GDPR (where applicable)
Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent without affecting prior lawful processing. You may lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), the competent Finnish supervisory authority, or another competent supervisory authority.
PIPL-aware notes (when PI of individuals in China is processed)
Where China’s Personal Information Protection Law applies, we will provide notice of processing rules, process PI under a lawful basis recognized by PIPL (e.g. contract necessity, consent), obtain separate consent where required (e.g. certain sensitive PI or cross-border scenarios), and honor individual rights of access, copy, correction, and deletion as applicable. Cross-border transfers will follow the mechanism required at the relevant threshold (contractual clauses, certification, or security assessment). We do not rely on mainland ICP hosting for the Beta Service; processing of mainland users’ PI on offshore infrastructure will be assessed as volume and features grow.
To exercise rights: privacy@短.在线. We may need to verify identity.
To ask for access or a copy, email privacy@短.在线. You can delete your account in Settings, or ask us by email. We may need to verify that you are the account holder.
9. Children
The Service (including accounts) is intended for users aged 18 or older. We do not knowingly collect account personal data from anyone under 18. Contact us to delete such data if discovered. Anonymous signed-out creates are subject to the AUP and are not an invitation for children to use the Service.
(For GDPR Art. 8 information-society consent ages in Member States such as Finland, the statutory floor may be lower than 18; our product rule for accounts is 18+ as stated in the Terms.)
10. No sale of identifiable clickstreams
We do not sell or rent identifiable clickstreams or raw visit logs. We do not publish a public analytics card.
11. Security (high level)
Encryption in transit (TLS), access controls, keyed HMAC of IP addresses (server secret; not a claim of anonymization), adaptive rate limits, and restricted operational access. No security measure is perfect.
12. Changes
We will update this Policy’s version and date when it changes. Material changes will be notified reasonably (in-product or email to account holders) before taking effect, except where faster change is required for law or security.
13. Contact
- Privacy:
privacy@短.在线 - Abuse:
abuse@短.在线 - Support:
support@短.在线 - Controller: Arasaka Oy (Finnish limited company), Business ID 2138210-8, Santaradantie 7 F 203, 01370 Vantaa, Finland
Note: some mail clients need the ASCII/SMTP form abuse@xn--s7y.xn--3ds443g / privacy@xn--s7y.xn--3ds443g / support@xn--s7y.xn--3ds443g (same mailboxes).
Controller: Arasaka Oy · Law / venue: Finland
Privacy: privacy@短.在线 · Abuse: abuse@短.在线