Last updated Jul 31, 2026
Privacy
What 1link.sh stores, why, and for how long.
The short version
We store what running short links and pages needs, and nothing else. No advertising, no third-party tracker, no data sold to anyone, and no cookie set on a visitor who opens one of your links.
What you give us
An email address, and a password if you use one — passwords are stored only as an argon2id hash, so nobody here can read yours. Your display name, language and time zone if you set them, and whatever you put on your page: its text, its buttons, and an avatar.
An uploaded image is re-encoded before it is stored, which drops any location data or camera details that came with it.
What we record when a link is opened
The time, which destination was chosen, and how long the redirect took. The kind of device — phone, tablet, desktop — worked out from the browser's user-agent string and the client hints it volunteers. The two-letter country the request came from, as reported by the network in front of us. The browser's preferred language. The host of the referring site, without the path.
No cookie, no identifier and no fingerprint is created. Two visits by the same person cannot be joined up afterwards, which is also why click counts count openings rather than people.
Cookies
Four cookies, all first-party and all functional: one holding your sign-in session, one protecting forms against cross-site submission, one remembering your language, and one remembering your time zone so times read correctly. There are no advertising or analytics cookies, and no third-party script runs on any page.
IP addresses
Your address is used to rate-limit sign-in attempts and other writes, and it is stored with an abuse report so a false report can be traced. It is not stored next to clicks.
Views of a public page are counted once per visitor per ten minutes without a cookie, by hashing the address together with a secret and the page. That hash lives in memory, cannot be turned back into an address, and is gone when the service restarts.
How long we keep it
Individual click and view records are deleted after ninety days. The daily totals built from them are kept, because they carry the history the charts show and no longer describe anyone. Account data is kept until you delete the account. Verification and password-reset tokens expire within hours.
Who else sees it
Google, if and only if you choose to sign in with Google: that exchange tells us your email address and whether it is verified, and tells Google that you signed in here. The network in front of the domain sees requests as they pass through, as any network must. If email sending is configured, the mail provider handles verification and reset messages.
That is the whole list. No advertiser, no analytics vendor, no data broker.
Your choices
You can see and change what is on your account from the settings screen, and delete a link, a page, or the whole account whenever you want. Deleting the account removes your links, pages, uploads, traffic history and sign-in details, and the links stop working at once.
Write to [email protected] if you want a copy of your data or cannot get into your account.
Children
Accounts are for people aged sixteen or over. If you believe someone younger has created one, write to [email protected] and it will be removed.
Changes and contact
If this policy changes, the date at the top changes with it, and anything material is announced on the service first. Questions go to [email protected].