The short version
- We collect what we need to run GoTinyURL: your account details, the links you create and anonymous click statistics.
- We never sell personal data and do not use it for third-party advertising.
- Analytics on this website load only after you consent.
- You can access, correct, export or delete your data at any time.
This summary is for convenience; the full text below is what applies.
This policy explains how TheBigBot LLC (“we”, “us”), the company behind GoTinyURL, handles personal data when you visit gotinyurl.com (the “site”) or use the GoTinyURL app at app.gotinyurl.com (the “service”).
Who is responsible for your data
TheBigBot LLC is the controller for data about visitors to the site and account holders of the service. For the click data your short links collect about your audience, you are the controller and we process it on your behalf; see our Data Processing Addendum.
What we collect
When you visit the site
- Technical data your browser sends: IP address, browser type, pages requested, referring page. Our hosting provider processes this to serve and protect the site.
- Preferences you set (theme, palette, text size, motion, cookie choice), stored in your own browser. See the cookie policy.
- If you consent to analytics: usage data collected by Google Analytics 4.
- Campaign parameters in the address you arrived from (such as utm_source), stored in your browser and passed to checkout and to the app so we know which campaign brought you.
When you contact us
- Your name, email, topic and message.
When you buy
- Stripe collects your payment details directly. We receive your name, email, billing country or address, the plan you bought and the payment status. We never see or store your full card number.
When you use the service
- Account data: name, email, password (stored hashed), time zone, language.
- Content you create: links, destinations, bio pages, QR codes, files, settings.
- Click statistics for your links: time, country and city (derived from IP address), device type, browser, operating system, language and referrer. Full IP addresses are not shown to you.
How we use data and our legal bases
| Purpose | Data | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Provide the service and your account | Account and content data | Contract |
| Take payment and create or upgrade your account | Purchase data | Contract |
| Answer messages and support requests | Contact data | Legitimate interest / contract |
| Keep the site and service secure, prevent abuse | Technical data, link destinations | Legitimate interest and legal obligation |
| Measure site use (only after consent) | Analytics data | Consent |
| Record which campaign brought a customer | Campaign parameters | Legitimate interest |
Who we share data with
We share personal data only with providers who help us run GoTinyURL, under contracts that require them to protect it:
- Stripe for payments (how Stripe secures payments).
- Cloudflare for hosting this site, security and Turnstile bot protection (Turnstile privacy).
- Our server host for the GoTinyURL app and its database.
- Google for Analytics 4, only if you consent (Google privacy policy).
- Email and messaging providers we use to send you service messages, when configured.
We may disclose data if the law requires it, to protect people from harm, or to investigate abuse of the service. We do not sell personal data or share it for cross-context behavioural advertising.
International transfers
Our providers may process data in the United States and other countries. Where data from the EU, EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the Standard Contractual Clauses.
How long we keep data
- Account and content data: while your account is open, then deleted within 30 days of account deletion, except backups which expire on their normal cycle.
- Click statistics: for the retention period of your plan (30 days on Free, up to 1,825 days on Business).
- Purchase records: as long as tax and accounting law requires.
- Contact messages: up to 24 months.
Your rights
Depending on where you live (including under GDPR, UK GDPR and US state laws such as the California Consumer Privacy Act), you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent at any time. Californians can also ask what categories of data we collect and how we use them; we do not sell or share personal data as those laws define it. We will not treat you differently for using your rights.
Make a request through our data request page or the contact page. We answer within 30 days (45 days where US law allows) and may need to verify your identity. You can also complain to your local data protection authority.
Security
We use HTTPS everywhere, hash passwords, restrict access to production systems and keep secrets out of our code. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Children
GoTinyURL is not for children under 16. We do not knowingly collect their data; if you think we have, contact us and we will delete it.
Changes
We will update this page when our practices change and change the date at the top. Material changes will be announced on the site or by email.
Contact us about this policy
TheBigBot LLC · Worldwide (online). Built for the United States first.. Use the contact page or email: