Privacy Policy

Last updated: 25 June 2026

This Privacy Policy explains how Shortifi (“Shortifi”, “we”, “us”) collects, uses, stores, and protects personal data when you use our website and application (the “Service”). Shortifi is a UTM-aware link-shortening and social-publishing tool operated from Hamburg, Germany. We act as the data controller for the account data described below.

If you have any questions about this policy or your data, contact us at privacy@shortifi.me.

1. Data we collect

Account & profile data

Your email address, and an optional display name.
Your password, stored only as a salted hash (Argon2id) — we never store it in plain text.
Workspace and team information you create, and audit records of security-relevant actions (for example sign-in, password change, API key creation, member changes).

Content you create

Campaigns, UTM vocabularies, short links and their target URLs.
Social posts you draft or schedule, and any media you upload for them.

Connected social accounts

When you connect a third-party network (such as Facebook Pages, Instagram, Bluesky, Mastodon, or LinkedIn), we store the access tokens needed to publish on your behalf. These tokens are encrypted at rest. We also store basic public profile details returned by the network, such as the account handle and follower count. We only use this access to perform the actions you ask us to perform (for example, publishing a post you created). We do not read your private messages or post without your instruction.

Click analytics

When someone clicks one of your short links, we record the event in a privacy-minimized way. We do not store raw IP addresses: IP addresses are hashed with a salt that rotates daily and are not retained in raw form. From a click we keep coarse location (such as country, region, or city), the browser/OS family, referrer, and a timestamp, so we can show you aggregate link performance.

Cookies & product analytics

We use a strictly necessary session cookie (httpOnly, Secure) to keep you signed in. We may also use privacy-respecting product analytics to understand how the Service is used and to improve it. You can control non-essential cookies through your browser settings.

2. How we use your data

To provide and operate the Service, including creating links and publishing the posts you schedule.
To show you analytics about your own links and posts.
To secure your account, prevent abuse, and keep audit records.
To process payments and send service-related communications.
To comply with our legal obligations.

3. Legal basis (GDPR)

Where the EU General Data Protection Regulation applies, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service); your consent (for non-essential cookies, which you may withdraw at any time); and compliance with legal obligations (for example, retaining billing records).

We do not sell your personal data. We share data only with service providers who help us run Shortifi, and only as needed:

Hosting: our servers are hosted in Germany (Hetzner).
Payments: Stripe processes subscription payments. We do not store your full card details.
Email delivery: a transactional email provider sends account and service emails.
Product analytics & error monitoring: tools that help us understand usage and diagnose problems.
Social networks you connect: when you publish, the relevant network (for example Meta for Facebook and Instagram) receives the content and the request you asked us to send. Their handling of that data is governed by their own policies.

We may also disclose data if required by law, or to protect the rights, safety, and security of Shortifi and its users.

5. International transfers

Your data is primarily processed within the European Union. Some providers (for example social networks and payment processors) may process data outside the EU; where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. How long we keep data

We keep account and content data for as long as your account is active. When you delete your account or disconnect a service, we delete the associated personal data and stored access tokens, except where we must retain certain records (such as invoices) to meet legal obligations. Click events are retained in aggregate for analytics. See our Data Deletion page for how to remove your data.

7. Security

We use industry-standard measures to protect your data, including encrypted connections (TLS), hashed passwords (Argon2id), encryption of stored social tokens, IP-hashing for click events, and access controls. No system can be guaranteed perfectly secure, but we work to protect your information and to respond promptly to any incident.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a data-protection supervisory authority. To exercise any of these rights, email privacy@shortifi.me.

9. Children

Shortifi is not intended for, and is not directed at, children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you of significant changes.

11. Contact

For any privacy question or request, contact privacy@shortifi.me.