What we actually collect.

Who is responsible

The controller for the personal data described here is Stqn Technology SRL (enterprise & VAT no. BE 1035.377.208), Belgium. Write to hello@slsh.me about anything in this policy, including a request to see or delete your data.

We haven't appointed a Data Protection Officer. We're a small operation and don't meet the criteria in Article 37 GDPR that would require one; the address above reaches a human who can act.

This policy sits alongside the Terms of Service, which cover what you may point a short link at.

If you clicked a slsh.me link

You didn't sign up for anything, so this is the section that matters to you. When you open a slsh.me short link we record one row about the visit, and we send you on to the destination.

What that row contains

Approximate location (country, region, city), device type, operating system, browser and browser version, the referring page your browser reported, any utm_* campaign tags in the link, whether the request looked like a bot, and the time. That's the whole row.

Who gets to see it

The person or business whose link you clicked sees this data, aggregated in their dashboard — how many clicks, from which countries, on what devices, from which referring sites. They cannot see your IP address, your name, or anything that identifies you individually, because we never collected it.

If a link owner turned on public statistics for a link, those same aggregates are visible to anyone holding that link's statistics URL.

If you have an account

What you give us

An email address and a password, which is the whole of what's required. Optionally a display name and a profile picture. Your appearance preference (light, dark or follow-the-system) is stored so the app looks the same next time.

Your password is stored only as a bcrypt hash — we can't read it, and neither can anyone who obtains the database. API tokens are stored the same way, as HMAC digests: the raw token is shown to you once at creation and never again, because we no longer have it.

What we record as you use it

For each sign-in we keep a session record with the IP address and browser user-agent of the device, so you can stay signed in and so we can investigate account misuse. Unlike link visitors, an account holder's IP is stored.

We also keep what you create: links and their destinations, campaign names, tags, custom domains, imports, and webhook endpoints. We record when you accepted the current Terms of Service, and the version you accepted.

Product analytics

We use PostHog on its EU infrastructure to understand which features get used. It behaves differently on the two halves of the site, on purpose:

• The marketing site (slsh.me) runs PostHog in cookieless mode. It stores nothing whatsoever in your browser — which is why you've never seen a cookie banner here.
• The app (app.slsh.me) runs it in normal mode once you're signed in, which does set cookies, and identifies you so we can tell a returning user from a new one.

Some events are recorded on our own servers rather than in your browser — an account being created, a link imported, a campaign report emailed. Those carry that same opaque id and the name or slug of the thing you acted on, and nothing else. Even in cookieless mode on the marketing site, your IP address and user-agent do reach PostHog, where they are hashed with a daily-rotating salt to count visitors without identifying them.

Two things you might not expect

If you invite someone, we store the email address you typed so we can send the invitation and recognise them when they accept. That's an address belonging to someone who may never become a user, held on your instruction. Unaccepted invitations expire after 14 days but the record isn't automatically removed; ask us and we'll delete it.

If you import links from a CSV, the uploaded file's contents are kept on the import record so the import can be undone and its report re-read. If your CSV contained anything personal beyond URLs, it's in there.

Cookies and local storage

The complete list. There is nothing else.

The marketing site sets no cookies at all. Where we note the entry page you arrived from so we can credit a signup to it, that is held in the page's memory for as long as the tab is open and written to neither a cookie nor local storage.

Why we're allowed to do this

Where we rely on legitimate interests you have the right to object — see section 9.

Who else sees it

Every third party we use, what they see, and where they are. We don't use anyone else.

Each acts as a processor on our instructions under a data-processing agreement, except where they are a controller in their own right for their own infrastructure.

Endpoints our customers choose

An account holder can register a webhook, and we'll then POST a summary of each click on their links to a URL they nominate: country, region, city, device, browser, operating system, the referring host, the campaign tags and the time. No IP address and no user-agent are included. Where a link owner has done this, the operator of that endpoint receives the data as an independent controller and we have no control over what they do with it.

We may also disclose data to law enforcement or a regulator where we are legally required to, or to investigate abuse of the service — see the Terms of Service.

Transfers outside the EU

Our servers, our database, our product analytics and our webfonts are all in the EU. Two providers are not, both in the United States:

• ipinfo.io — receives a visitor's IP address to return an approximate location, and nothing else.
• Resend — receives your email address and the content of a message you asked us to send you.

Both rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Nothing else you give us leaves the EU.

This list was longer. Self-hosting our typefaces removed two transfers outright — see the note in section 6.

How long we keep it

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to another provider in a portable format. Where we rely on legitimate interests you can object to that processing, and where we rely on consent you can withdraw it at any time.

Write to hello@slsh.me. We'll respond within one month. There's no charge, and we won't ask you to justify the request.

One honest limitation: for someone who merely clicked a link, we hold nothing that identifies you, so we have no way to find "your" data in order to show or delete it. That is a consequence of not collecting it in the first place, and it's the trade we'd make again.

Complaining about us

If you think we've handled your data unlawfully you can lodge a complaint with the Belgian supervisory authority, or with the authority where you live:

Autorité de protection des données / Gegevensbeschermingsautoriteit
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be · +32 (0)2 274 48 00
dataprotectionauthority.be

We'd appreciate the chance to fix it first, but that's your call, not ours.

Security

Everything is served over HTTPS. Passwords are bcrypt-hashed and API tokens are stored as HMAC digests, so neither can be recovered from the database. Session cookies are signed and HTTP-only, so they can't be read or forged by scripts. Access to the production database is limited to the people who operate the service.

If a breach happens that puts your rights at risk, we'll notify the Belgian authority within 72 hours and tell you directly where the regulation requires it. If you've found a vulnerability, please write to hello@slsh.me before disclosing it publicly.

Children

slsh.me isn't aimed at children and we don't knowingly create accounts for anyone under 16. If you believe a child has an account here, tell us and we'll remove it.

Changes to this policy

The current version is always on this page with its last-updated date. If we change something material — a new provider, a new category of data, a longer retention period — we'll update the date and, for changes that affect account holders, say so in the app.