Privacy Policy

• No account is needed to shorten a link
• Click statistics are counted per link (country, device, browser, referring site), not per person
• No advertising cookies; we use Google Analytics to count page visits, and your preferences stay on your device
• We never sell your data or share it with data brokers
• You can delete your links at any time, and ask us to delete your account

We store the destination URL, the short code, the options you choose (custom alias, expiry, click limit, password, management mode), the creation time, and a secret code that lets you manage a guest link. A page title may be fetched from the destination (see below).

To prevent abuse we also record the IP address and approximate location (country and city) a link was created from, and we apply rate limits per IP address.

We store your email address, username, optional display name, and a securely hashed password (bcrypt). If you sign in with Google or GitHub, we receive your name, email and profile picture from that provider; we never see your password there.

For security we keep your sign-in sessions (device, browser, IP address and time last used), the IP address and browser you registered with, and a short history of failed sign-in attempts used to block password guessing.

For each click we record the time, the approximate location (country and city, provided by Cloudflare from the IP address), the device type, browser and operating system (from the user agent), and the referring site. These are combined into the statistics shown to the link’s owner.

The IP address of the click is used to filter bots and duplicate clicks and is kept in internal logs for security and abuse investigations. It is not shown to link owners.

If a link was created with the “no tracking” option, no statistics are shown for it.

bito.li does not use advertising or cross-site tracking cookies. We store a few things in your browser’s local storage: your theme, your sign-in session, and the list of links you shortened as a guest on that device. Clearing your browser data removes them.

A short-lived cookie is used only while signing in with Google or GitHub, to protect that process.

We use Google Analytics to understand how the site is used (pages visited, approximate location, device type). It sets first-party cookies such as _ga. We do not use it for advertising, and it is not loaded on the redirect of a short link. You can block it with a browser extension or Google’s opt-out add-on.

• Cloudflare: network, security and approximate visitor location
• Google Safe Browsing: destination URLs are checked for phishing and malware
• ZeptoMail (Zoho): delivery of verification and password emails
• Google Analytics: aggregated statistics about visits to the website
• Google and GitHub: only if you choose to sign in with them

To show link titles in your dashboard, our server requests the destination page once, identifying itself as “bitolibot”. The destination site can see that request, just like when a chat app builds a link preview.

We use the information above only to run bito.li: redirecting links, showing statistics, keeping accounts secure, preventing spam and abuse, and sending emails you need (verification, password resets and important service notices). We may disclose information when required by law or to protect users from serious harm.

Links are kept until you delete them, they expire, or they are removed for breaking our terms. A deleted link stops working immediately; its record may be kept for a limited time to investigate abuse and to make sure the same code is not reused for a different destination.

You can ask us to delete your account and links, or for a copy of your data, by emailing [email protected] from your account’s address.

We use encrypted connections (HTTPS), hashed account passwords, and limits against password guessing. No service is perfectly secure, so please do not put confidential information inside the URLs you shorten: anyone with the short link can open its destination.

bito.li is not intended for children under 13, and we do not knowingly collect their personal data.

If we change how we handle data we will update this page and its date, and highlight important changes on the site.

Questions or requests about your privacy: [email protected].