Privacy

What we collect

When you create an account we store an email address and a password hash (PBKDF2-SHA256). When you create short links we store the slug, destination URL, branding, targeting rules, and any expiry or moderation metadata you configure. When a visitor follows one of your short links we record a click event — timestamp, country (from the Cloudflare edge), device class, referrer domain, and UTM parameters — plus a fraud-detection flag for that event.

When you join the waitlist on www.orphl.ink we store the email address you enter, which form you used (for example the homepage), and when you signed up. The workspace audit log also records the IP address of the account member behind an API-key, membership or workspace change.

We deliberately do not store short-link visitors' IP addresses in long-term storage. The fraud detector hashes IPs into a short-lived rolling-window counter (1 hour TTL) so we can flag obvious abuse without keeping a log of who clicked what.

How we use it

• Resolve short links and route visitors to the destination you configured.
• Show you analytics for your own links: click totals, an hourly timeseries and A/B variant results.
• Run automated content moderation on destination URLs so the platform isn't used for malware or phishing.
• Send transactional email (currently password-reset links).
• Email waitlist sign-ups when registration opens.
• Detect and slow obvious click fraud against your links.

We do not sell data. We do not run advertising. Waitlist addresses are used only to tell you registration is open — there is no newsletter.

Where it lives

All data is stored on Cloudflare: D1 for relational data (users, workspaces, links, audit log, waitlist sign-ups), KV for short-lived counters and rate limits, R2 for workspace logo and favicon assets, and Analytics Engine for click events. The platform runs on Cloudflare Workers, which process requests at the Cloudflare location nearest the visitor, so data is not confined to the United Kingdom.

How long we keep it

• Account data — until you delete the account, then purged within 30 days.
• Short links — until you delete them or your account is closed.
• Click events — aggregated rollups kept for the lifetime of the link; raw event stream pruned after 90 days.
• Audit log — Retention is set per workspace, from 1 day to 10 years (90 days by default), and a daily job prunes older entries.
• Fraud counters — 1 hour rolling window, then automatically expired.
• Waitlist sign-ups — until you ask us to remove yours; there is no automatic expiry yet.

Your rights under UK GDPR

You can request access to, correction of, export of, or deletion of your personal data. Email hello@orphl.ink and we'll respond within 30 days. You can also lodge a complaint with the ICO (ico.org.uk (opens in new tab)).

Subprocessors

• Cloudflare — compute, storage, edge routing, DNS, TLS termination, and transactional email (Cloudflare Email Service). Cloudflare also processes technical request data, such as IP addresses, to deliver and protect the service.

We do not embed third-party analytics, ad networks, or session-replay tools.

Cookies

This marketing site (www.orphl.ink) sets no cookies. It keeps one entry in your browser's localStorage, nuxt-color-mode, which records the colour theme and is never sent to us. The product domains (orphl.ink short links, app.orphl.ink dashboard) set a small number of functional cookies (no advertising or tracking cookies). See our cookies page for the full list and the GDPR consent flow that workspace owners can enable.

Contact

Data controller: Orphnet Ltd, United Kingdom.
Privacy questions and rights requests: hello@orphl.ink.

Changes to this policy

When this policy changes materially, we'll post the update here with a new "last updated" date. If you have an account we'll email you. Continued use of OrphLink after a change means you accept the new policy.