Legal

Privacy policy

Last updated: 19 October 2026

This policy explains what information Sutly ("we", "us") collects when you use sutly.onrender.com (the "Service"), why we collect it, and the choices you have. It applies to people who create an account and to people who simply open a short link.

1. Information we collect

If you create an account

• Account details: your name, email address and a password. We store only a scrambled (hashed) version of your password, never the password itself.
• If you sign in with Google: Google shares your name, email address, profile photo and a Google account ID with us. We use these only to create and sign in to your account. We never get your Google password, and we don't access your Gmail, contacts or files.
• Your links: the destination addresses you shorten, the short endings, titles and expiry dates you choose.

When anyone opens a short link

• Click records: the date and time of the click and, if the visitor's browser shares it, the name of the website they came from (for example "facebook.com"). We use these to show the link's owner how many clicks it received.
• We do not store visitors' IP addresses with click records, and we do not show link owners any personal information about who clicked.

When you contact us or report a link

• The name, email address and message you send us, and any details you include in an abuse report.

Technical information

• Like most websites, our hosting provider's servers may keep short-term logs (such as IP address, browser type and the page requested) for security and to keep the Service running. These logs are deleted automatically after a limited period.

2. How we use information

• To run the Service: create short links, redirect visitors, and show you your click statistics.
• To keep your account secure, including resetting forgotten passwords.
• To prevent abuse: detect and disable links used for spam, phishing, malware or other harmful purposes, and to block automated sign-ups.
• To reply to your messages and reports.
• To show advertising that helps keep the Service free (see section 4).

We do not sell your personal information.

3. Cookies

A cookie is a small file a website stores in your browser.

• Essential cookie: when you log in, we set one cookie (named sid) that keeps you signed in and protects our forms against forgery. The Service can't work without it. It expires after 30 days or when you log out.
• No Sutly cookies on redirects: opening a short link does not set any Sutly cookie.
• Advertising cookies: pages that show ads may also use cookies from Google and its partners, as described below.

4. Advertising and Google AdSense

We use Google AdSense to show ads on some pages of the Service. Google ads are never shown between a short link and its destination.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google's Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.
• Learn more about how Google uses information from sites that use its services.

If you visit from the European Economic Area, the United Kingdom or Switzerland, we will ask for your consent before personalised ads or advertising cookies are used, through a consent message provided by Google.

5. Other services we use

• Hosting: our servers and database are run by a cloud hosting provider, which processes data on our behalf.
• Google sign-in: if you choose "Continue with Google", Google confirms who you are under Google's privacy policy. You can remove Sutly's access at any time from your Google Account's security settings.
• Email: password-reset emails are sent through an email delivery provider.
• Bot protection: some forms may use Cloudflare Turnstile to check that you are a person, not a bot. Cloudflare processes limited technical information to do this.

6. How long we keep information

• Account details and links are kept until you delete them or delete your account. Deleting your account permanently removes your account, your links and their click records.
• Password-reset links expire after one hour.
• Messages and abuse reports are kept for as long as needed to handle them and to protect the Service from repeat abuse.

7. Your rights and choices

You can view and edit your links and name, export all your links as a CSV file, change your password and delete your account at any time from your account page. You may also ask us to access, correct or erase your personal data, or ask questions about how it is used, by writing to support@example.com. Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023 or the EU GDPR may give you further rights, and you may complain to your local data-protection authority.

8. Security

We use HTTPS encryption, hashed passwords, protection against forged form submissions, and rate limits against password guessing. No online service can be completely secure, so please use a strong password you don't use elsewhere.

9. Children

The Service is not meant for children under 13. If you are under 18, please use the Service only with the involvement of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

If we make important changes, we will update the date at the top of this page and, where appropriate, tell account holders by email.

11. Contact and grievance officer

For any privacy question or complaint, contact our grievance officer at support@example.com or through our contact page. We aim to respond within 30 days.