Privacy Policy

1. Scope

This policy applies to the Shortlink Studio web app, Chrome extension, and twks.cc short-link service. Anyone who knows a short-link address can open it and be redirected to its saved destination URL.

2. Information we process

• The URL entered by the user or selected from the current tab or link when the extension is invoked
• A custom alias entered by the user and the link creation time
• An anonymous Supabase user identifier, access token, and refresh token for each browser or installation
• An email address when the user chooses to save links to an account
• When Chrome is connected, the ownership relationship between the extension's anonymous user and the web account, plus the hash of a one-time token that expires within five minutes
• A password set by an owner or entered by a visitor when password protection is used
• Total clicks, last-click time, and daily clicks for the last seven days; repeated requests to the same link within ten seconds count once
• Infrastructure logs such as IP address, request time, and status code for security and incident response

We do not ask for your name, phone number, or payment details. Email is processed only when you choose account storage and cross-device access.

3. Purposes

We process this information only to create and redirect short links, count clicks, protect links with passwords, display recent links, limit abuse, respond to incidents, and provide support. Anonymous user IDs distinguish link owners. We do not use the data for advertising profiles or sell it.

4. Storage and retention

Browser and Chrome local storage

The web app stores an anonymous or email-linked authentication session in the current browser. The extension stores up to 12 recent links and its authentication session in the current Chrome profile. If you sign out or clear browser or extension data, an anonymous account that was not linked to email may no longer be recoverable.

Service database

Destination URLs, aliases, owner IDs, an optionally linked email address, and aggregate click data are stored in Supabase while needed to provide the service. The original Chrome pairing token is never stored; only its SHA-256 hash is kept, and it becomes unusable after five minutes. Disconnecting removes the extension-to-account relationship while links already moved to the account remain there. Owner passwords are transmitted over HTTPS and stored only as salted bcrypt hashes. Plaintext passwords and visitor verification passwords are not stored or returned by the API. Daily click events are retained for seven days. Deleting a short link also deletes its click history. Security and operations logs follow Supabase and Vercel retention policies.

5. Service providers

We use Supabase for the database, anonymous and email authentication, and API execution, and Vercel for product-site hosting and twks.cc redirect routing. Data is transmitted over HTTPS.

6. Your choices and requests

Owners can pause, edit, or delete their links and view their own click statistics in the web app and supported extension screens. Linking an email preserves links under the same user ID, and explicitly connecting a supported Chrome extension moves its existing links into the account. Other users' links and statistics are not accessible. For requests not available in your account, email the relevant short link to 0xianjoung@gmail.com.

7. Chrome Web Store limited use

Information received from Chrome APIs is handled in accordance with the Chrome Web Store User Data Policy and Limited Use requirements. It is used only to provide the extension's single purpose and is not transferred for advertising, credit assessment, or sale.