Privacy

twt.fyi is a URL shortener. This page explains exactly what it records.

When you create a link

We store the destination URL, the short slug, creation time, optional expiry, the result of our safety scan, and a salted one-way hash of your IP address used only to rate-limit and correlate abuse. The raw IP is never stored.

When you click a link

We record an aggregate analytics event containing: the slug, the outcome (redirected, warned, blocked), your country, the hostname of the referring page (never the full URL), a coarse device class (mobile/desktop/tablet/bot), browser family, and the Cloudflare data centre that served you. No cookies are set, no IP address or user identifier is stored, and events are not linked to each other.

When you report a link

We store the reason you chose, any free-text detail you enter, the time, and a salted one-way hash of your IP address so that each person can report a given link only once. Do not include personal information in the detail field.

Safety scanning

When Safe Browsing is enabled, destination URLs are sent to Google Safe Browsing to check for malware and phishing. Only the URL is sent, never anything about you.

Retention

Links live until they expire or are removed. Per-click analytics events are retained for about 90 days; daily totals per link are kept as aggregates.

Cloudflare Web Analytics

Pages also load Cloudflare's privacy-first Web Analytics beacon, which measures page views and performance without cookies, fingerprinting, or cross-site tracking. See Cloudflare's documentation for what it collects.

Infrastructure

The service runs entirely on Cloudflare (Workers, D1, KV, Analytics Engine). Cloudflare's own network logs are governed by Cloudflare's privacy policy.