How we keep short links accountable.
A short link hides its destination, so a shortener has a responsibility to make abuse hard and easy to report. This is what we do, and where the limits are.
Protections that are in place today.
Every link has an owner
Links can only be created from a signed-in account, so there is always someone responsible for a link. The open version of the service was shut down because of spam.
No passwords to leak
Sign-in uses a one-time link sent to your email. It expires after 15 minutes and works once. We don't store passwords because there aren't any.
Safer sessions
The session cookie is HttpOnly, Secure and SameSite=Lax, and expires after 30 days. It is used only to keep you signed in.
Destination rules
Only http and https destinations can be shortened. Our own domains can't be shortened, and domains on our abuse blocklist are refused.
Redirects only
We redirect visitors. We don't host, copy or render the content of the destination.
A way to report
Every report goes into a queue that a person reads. Use the report form, or email [email protected].
What happens next.
The report is stored
It is saved with the link it refers to and the reason you chose, and emailed to us.
A person looks at it
We check the destination and the report. There is no automatic takedown, so a false report can't switch off someone's link.
We act
Confirmed links are disabled. Under our Terms we may suspend or remove accounts that break the acceptable use rules.
Look before you click.
If you receive a short link and aren't sure about it, you don't have to open it. The URL expander shows where it leads, the redirect checker shows every hop on the way, and the URL safety checker looks for common warning signs in the address and the chain.
Never enter a password or payment details on a page you reached through a link you didn't expect, whichever shortener it came through.
What we can't promise.
We are a small, independent service. We check a destination against our blocklist when a link is created or edited, but we don't continuously scan the pages links lead to, and an owner can change a link's destination later. That is why reports matter: they are how we find what slips through.
If you find a security problem in the service itself, please write to [email protected] before sharing it publicly.
Seen something that shouldn't be here?
Tell us. It takes a minute and you don't need an account.
Common questions
How do I report a short link? +
Use the report form at /abuse with the short link and what is wrong with it, or email [email protected]. You don't need an account.
Do you scan the pages that links point to? +
Not continuously. Destinations are checked against our blocklist when a link is created or edited, and reports trigger a manual review.
Can the destination of a link change after it was created? +
Yes. Owners can edit the destination of their links. It is one of the reasons a link that was fine yesterday may deserve a report today.
Do you store my password? +
No. There are no passwords: you sign in with a one-time link sent to your email.
Who reads abuse reports? +
A person. We are a small independent service, and reports are read by the people who run it.