Privacy Policy

1. Information We Collect

• Shortened Link Data: the original destination URL, the short alias (slug), an optional link title/note, creation timestamp, and optional expiration or click-limit settings. Links created without signing in are associated with an anonymous browser session key and remain active for up to 24 hours.
• Account Information: when you sign up with an email and password or sign in via Google OAuth 2.0, we store your email address, display name (if provided), registration date, and a cryptographic password hash. If you generate a personal API token, we store the token key and its creation and last-used timestamps.
• Privacy-Friendly Click Analytics: when a visitor follows a short link, we record the click timestamp, the User-Agent header (used to classify device type and browser family), the HTTP Referer (and referrer domain), and a one-way salted cryptographic hash (SHA-256) of the visitor's IP address to estimate unique visitors. Raw visitor IP addresses are never stored in click analytics records.
• Cookies & Local Storage: we only use strictly necessary first-party cookies for session management (sessionid), CSRF protection (csrftoken), and interface language preference (brsch_lang), as well as browser localStorage to remember your light/dark theme choice. We do not use third-party advertising or tracking cookies.

2. How We Use Information

We use the collected information solely to:

• Provide fast HTTP redirects for shortened URLs and generate downloadable PNG and SVG QR codes.
• Display aggregated click analytics (total clicks, unique visitors, devices, browsers, and traffic sources).
• Enable registered users to manage their links in the dashboard and automate link creation via the JSON API.
• Maintain service reliability, prevent spam, phishing, and abuse, and enforce our Terms of Use.

3. Public Nature of Short Links & Third Parties

We do not sell, rent, or trade your personal information to advertisers or data brokers.

• Public Link Analytics: please note that any short link and its analytics page (accessible at brsch.com/s/<slug>/ or by appending + to a short link) can be viewed by anyone who knows the short alias. Do not include sensitive personal data or secret credentials in destination URLs or link titles.
• Google OAuth 2.0: if you choose "Continue with Google", authentication is handled via Google OAuth 2.0 solely to verify your email address and basic profile name.

4. Data Retention & Deletion

• Anonymous links created without an account expire automatically within 24 hours.
• Authenticated users can pause, edit, or permanently delete any of their short links (along with all associated click analytics) and revoke their API token at any time from the My Links dashboard.
• To request complete deletion of your user account and all associated data, please contact us via email.

5. Contact Information

If you have any questions about this Privacy Policy, data processing, or account deletion requests, please contact the service creator and administrator: