Privacy Policy

Effective Date: August 2026

At Shrinko, we believe that web utility shouldn't come at the cost of tracking citizens across the web. This Privacy Policy outlines our strict data minimization practices and details exactly how we safeguard your information.

1. User Account Information

When you log in using Google OAuth, we request access only to essential profile data (like your email address). This data is strictly used to maintain your secure login state and dynamically query the URLs linked to your account. We never share, rent, or sell your account information to third-party data brokers.

2. Industry-Standard Visitor Anonymization

To deliver clean, insightful analytics to link creators while protecting the privacy of end-world visitors, we engineered a secure data pipeline:

• Cryptographic IP Hashing: We explicitly do not log or store raw IP addresses in our database. Every incoming visitor IP is instantly combined with a secure cryptographic salt and compiled using a SHA-256 hashing algorithm. This allows us to record unique click interactions without retaining recognizable network addresses.
• Local User-Agent Parsing: Raw user-agent metadata is parsed on-the-fly to isolate basic operating system types (e.g., Windows, macOS, Linux, iOS, Android). The raw user-agent string is discarded immediately after parsing to prevent device fingerprinting.
• Referrer and Origin Analysis: We isolate HTTP referrers to classify traffic streams (e.g., Google, LinkedIn, Direct Traffic) so creators understand where their audience is coming from.
• Geographical Mapping: Country data is mapped utilizing secure, localized edge network headers provided by our routing proxies.

3. Complete Data Purging

Your data remains yours. When you delete a link from your authenticated Dashboard or via a Monitor Key, the link record and all associated click metrics are permanently and instantly purged from our live database.

4. Cookies Policy

Shrinko uses minimal, strictly functional cookies to operate. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

• Session Cookie: A temporary session identifier set after sign-in to maintain your authenticated state across page visits. It expires automatically after one hour of inactivity.
• Essential Cookies: We set no other persistent cookies. The platform does not deploy fingerprinting, behavioral tracking, or cross-site tracing scripts.

Because we minimize cookies to this single functional token, no cookie consent banner is necessary. You can delete the session cookie at any time through your browser settings, which will simply log you out.

5. Username & Password Privacy

If you create an account using a username and password instead of Google OAuth, we apply the following protections:

• Password Hashing: All passwords are hashed using SHA-256 with a per-user salt before storage. Plain-text passwords are never written to disk, logs, or transmitted beyond the initial register or sign-in request.
• Username Policy: Usernames must be 5–15 alphanumeric characters. They are stored in the database solely to identify your account and associated links. We do not use usernames for marketing, profiling, or any purpose beyond account identification.
• No Password Recovery: Because we never store plain-text passwords or maintain an email-based recovery flow for custom accounts, it is your responsibility to remember your credentials. If you forget your password, the account cannot be recovered and a new account must be created.
• Rate Limiting: Sign-in and sign-up endpoints are rate-limited to prevent brute-force attacks against user credentials.