Privacy Policy

Last updated: 6 September 2026

99L ("we") runs the URL shortening service at 99l.in. This policy describes exactly what we store, why, and for how long. It is written to be read, not to be skipped.

1. What we collect

There are no user accounts on 99L, so we hold no names, passwords or profiles for people who shorten links.

Data	When	Where it lives
The destination URL you submit	Every time you shorten a link	Our database, permanently
The short code (random or your chosen name)	Every time you shorten a link	Our database, permanently
Creation timestamp	Every time you shorten a link	Our database
A click counter per link	Each time a short link is followed	Our database, a running total only
Your IP address, hashed	When you create a link or use the API	Rate-limiting files, deleted after ~24 hours
Your recent links	When you shorten a link	Your browser only (localStorage), never sent to us
Name, email, company, volume, message, IP	Only if you submit the bulk-access form	Our database
Standard web server logs	Every request	Our host, rotated periodically

We do not log who clicked what. Following a short link increments a single number on that link. We do not record per-click IP addresses, timestamps, locations, devices or referrers, and we cannot tell you who opened a link.

2. Why we collect it

• Destination URL and short code, without these the service cannot redirect anyone. This is the whole product.
• Click counter, so the person who made a link can see how much traffic it carried.
• Hashed IP address, to enforce rate limits and stop one person flooding the service. We store a truncated SHA-256 hash, not the address itself, and the files are swept after about a day.
• Bulk-access form, to reply to your enquiry. We do not add you to a marketing list.

Where GDPR applies, our lawful basis is legitimate interest in operating and protecting the service, and, for the enquiry form, taking steps at your request before entering a contract.

3. Third parties

• Google Analytics, we use it to count page views. It sets cookies and processes data under Google's own privacy policy. It runs on our own pages; it does not run when a short link redirects.
• Cloudflare, sits in front of the site for security and performance and processes request metadata.
• Google Fonts and CDN assets, fonts and the QR-code library load from Google Fonts and cdnjs, which will see your IP address as part of serving those files.
• Our hosting provider, stores the database and server logs.

We do not sell your data, and we do not share it with advertisers or data brokers.

4. How long we keep it

• Links and their click counts: indefinitely. Short links are advertised as permanent, deleting them would break every place they have been shared.
• Rate-limit records: automatically deleted after roughly 24 hours.
• Bulk-access enquiries: kept while we are in contact and for a reasonable period afterwards; removed on request.
• Server logs: retained and rotated by our host.

5. Your rights

Depending on where you live you may have the right to access, correct, delete, or restrict processing of your personal data, and to object to it. Email [email protected] and we will respond within 30 days.

Deleting a short link. Ask us and we will remove it. Please send the short link and, where possible, some evidence you created it or own the destination, otherwise anyone could delete anyone else's link.

Clearing your local history. The "Your recent links" list lives only in your browser. Click clear history on the home page, or clear your browser's site data, and it is gone. We never had a copy.

6. Security

The site is served over HTTPS. API keys are stored only as SHA-256 hashes, so even we cannot read them back. Database credentials are kept outside the web-accessible parts of the application. No system is perfectly secure, and we do not claim otherwise.

7. Contact

Privacy questions: [email protected]
Abuse and phishing reports: [email protected]
Everything else: [email protected]

If we change this policy we will update the date at the top of this page.