PRIVACY

Privacy, in plain language.

This page describes the information processed by This Is Too Long when you create, follow or report a short link.

Information the service stores

• The destination URL and destination hostname for each short link.
• The short code, creation time, expiry setting, status and related administrative information.
• A keyed cryptographic hash derived from the IP address used to create a link or submit an abuse report. The application does not store the raw IP address in its database.
• If click counting is enabled, an aggregate click count and the time of the most recent click. The application does not create a per-click visitor history.
• For privacy-light unique visitor statistics, a keyed cryptographic hash derived from the visitor IP address is stored with first/last-seen times and aggregate main-site/short-link visit counters. Raw IP addresses, browser fingerprints, User-Agent strings and per-page browsing histories are not stored for this feature.
• Abuse-report reason, optional details, status and administrative notes.
• Security rate-limit records and administrative audit records needed to operate and protect the service.

Approximate analytics

To understand whether the service is reaching real users without building invasive profiles, the service may process a request IP address transiently to derive an approximate country, region/city and network/ASN. The raw IP address is not stored in the application analytics database. The application stores only the existing anonymous keyed visitor hash together with approximate location, acquisition source hostname/category, broad browser/operating-system/device family and aggregate visit/link counts.

Full referring URLs, precise GPS locations, advertising identifiers and browser fingerprints are not stored for this analytics feature. Granular analytics profiles are retained for up to 90 days. Standard web-server/security logs may separately retain technical request information for a limited period.

To distinguish ordinary browsers from simple automated scanners, the public shortening page uses a small same-origin browser-confirmation beacon after the page has remained visibly loaded for a few seconds. The beacon does not set a cookie or create a browser fingerprint; it only marks the existing anonymous visitor record as browser-confirmed. Successful Turnstile-protected link creation is treated as stronger evidence of a human visitor.

Promotional links may include a short src campaign marker such as saashub, alternativeto or reddit. Only the recognised source label is retained for attribution; the marker is removed from the browser address after the landing page loads.

IP geolocation by DB-IP Lite (CC BY 4.0). IP geolocation is approximate and should not be treated as a precise physical location.

Why this information is used

It is used to provide redirects and previews, apply expiry settings, count clicks when requested, prevent automated abuse, investigate reports, block abusive destinations and maintain the security of the service.

Cookies and anti-bot protection

The public shortening service does not require a user account. Cloudflare Turnstile is used to distinguish legitimate requests from automated abuse and may process browser or device information under Cloudflare's own privacy terms. Administrative sessions use a secure, HttpOnly session cookie.

Retention

Expired rate-limit records are routinely cleaned up. Link, abuse-report and audit records may be retained for operational, security and abuse-prevention purposes. A shortened link should therefore not be used for information that you do not want the service operator to process.

Third-party destinations

When you follow a short link, you leave this service and become subject to the destination site's own privacy practices. This Is Too Long does not control those sites.

Questions about this privacy information

General privacy enquiries can be sent to contact@thisistoolong.com.

Last updated: 24 August 2026