Privacy Policy
Last updated November 4, 2026.
This policy explains what personal data urlxo collects, why, how long we keep it and what you can ask us to do with it. It covers the website and short links on urlxo.link, the REST API, and the sign-in service on auth.urlxo.link.
Who we are
urlxo is operated by the urlxo team, part of xofactory. We are the controller of the data described here. You can reach us about anything in this policy at privacy@urlxo.link.
Data we collect
Account data
If you create an account we store your name, e-mail address and a hashed password (we never store the password itself). We use your e-mail to sign you in, send password reset links and, rarely, tell you about changes that affect your account. We do not send marketing e-mail.
Links you create
For each link we store the destination URL, the short code, its settings (title, password, expiry, click limit) and the time it was created. For links created without an account we also keep a one-way hash of the creating IP address, used only to rate limit anonymous shortening.
Clicks on short links
When someone opens a short link we record the time, the country (as reported by our network provider), the referring domain, and the device type, browser and operating system derived from the user agent. We do not store IP addresses. To count unique visitors we keep a hash of the IP address and user agent that includes the date, so it changes every day and cannot be linked across days. Requests from known bots are redirected but not recorded.
API keys
API keys are stored as hashes. We record when a key was last used so you can spot keys you no longer need.
Sign in with Google (auth.urlxo.link)
urlxo runs a sign-in service that lets you use your Google account to sign in to websites operated by our team. When you choose "Sign in with Google" on one of those sites, you are sent through auth.urlxo.link to Google, and Google asks you to share your basic profile with urlxo.
- What we receive from Google: your Google account ID, name, e-mail address, whether Google has verified that address, your profile picture URL and your language setting. We only request the
openid,emailandprofilescopes. We never receive your Google password and we get no access to Gmail, Drive, contacts or any other Google data. - What we do with it: we pass it, in a signed token that expires within two minutes, to the site you asked to sign in to, so that site can create or open your account there. Nothing else.
- What we keep: nothing about you. The sign-in service does not store your profile, your e-mail address or a login history; it only counts how many sign-ins each site has had. The site you signed in to keeps your account under its own privacy policy.
- Revoking access: you can remove urlxo from your Google account at any time at myaccount.google.com/connections. To delete your account on a site, contact that site.
urlxo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models.
Cookies
On urlxo.link we use a session cookie to keep you signed in and to remember that you unlocked a password-protected link, and a cookie that protects forms against cross-site request forgery. The sign-in service sets one short-lived cookie that ties a sign-in to your browser and is removed when the sign-in finishes. There are no advertising, analytics or tracking cookies.
Why we process data
- To provide the service you asked for: your account, your links, their statistics and sign-in to our sites (performance of a contract).
- To keep the service safe: rate limiting, abuse and fraud prevention, blocking malicious links (legitimate interests).
- To meet legal obligations, for example answering lawful requests from authorities.
Who we share it with
We do not sell personal data. We use a small number of providers who process data on our behalf: our hosting provider in Germany, Cloudflare for network delivery and protection, and Google for sign-in. When you use the sign-in service, your profile is shared with the site you chose to sign in to. We may disclose data if the law requires it or to protect people from harm.
Where data is stored
Our servers are in the European Union. Cloudflare and Google may process data in other countries under their own safeguards, such as the EU Standard Contractual Clauses.
How long we keep it
- Account data and links: until you delete them or your account.
- Click statistics: as long as the link exists. Deleting a link deletes its click history.
- Server logs: for a short period, for security and debugging, then deleted.
- Sign-in profiles: not stored.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its processing, or to receive it in a portable format. Write to privacy@urlxo.link from the e-mail on your account and we will answer within 30 days. If you are in the EU or UK you can also complain to your local data protection authority.
Security
All traffic is served over HTTPS. Passwords and API keys are hashed, sign-in tokens are signed and short-lived, and access to production systems is limited to the people who run the service.
Children
urlxo is not meant for children under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we use your data, we will tell account holders by e-mail before it takes effect.
Contact
Privacy questions and requests: privacy@urlxo.link. Abuse reports: abuse@urlxo.link.