Privacy policy.

This Privacy Policy explains how Tryst Link collects, uses, stores, and shares personal data when you use the website, create an account, manage short links, open a Tryst Link short URL, or contact us.

The data controller is Trystlink, located at Office 104, Lekorpouzier 12a, Limassol, 3075, Cyprus. Privacy questions and data-rights requests can be sent to hello@trystlink.io.

Short version

• The QR generator runs in your browser. The content you enter is not uploaded to Tryst Link simply to create a QR code.
• The URL shortener requires an account and stores the account and link information needed to operate your short URLs.
• Redirects create privacy-minimized click-event records containing a timestamp, country code when available, coarse device class, and referring hostname when available.
• Our application does not store the visitor's raw IP address or full user-agent string in the click-event table.
• We do not use advertising pixels, cross-site advertising identifiers, device fingerprinting, or behavioral profiling on the redirect path.
• We do not sell personal data.

The QR generator

The QR generator is implemented in client-side JavaScript. QR content is converted into PNG and SVG output inside your browser. The text, URL, vCard data, Wi-Fi credentials, or other content you enter is not sent to our application server for QR generation.

Normal page requests still pass through the infrastructure that serves the website, as they do when loading any page. The statement above applies specifically to the content you enter into the QR generator.

The URL shortener

Creating and managing short links requires an account. The application stores information needed to authenticate you, associate links with your account, operate redirects, and maintain the service.

Account data

• Your email address.
• A bcrypt hash of your password. We do not store the plaintext password.
• Your account identifier and account creation timestamp.
• Authentication/session information used to keep you signed in, including a signed first-party session token.

Your email address is used for account identification, service operation, security, and communications that are necessary to administer the service. We do not currently use account email addresses for advertising or third-party marketing.

Link data

For short links, the application stores:

• The destination URL.
• The generated or custom short code.
• The account identifier that owns the link.
• An optional title.
• The link creation time.
• An optional expiry time.
• Whether the link is active or disabled.

Destination URLs can themselves contain personal or confidential information. Do not place secrets, passwords, private access tokens, or other information in a destination URL unless you are comfortable with that URL being stored as part of your link record.

Click-event data

When a Tryst Link short URL is opened, the redirect handler may store one click-event record associated with that short link. The current application records:

• Timestamp. The time the redirect request was recorded.
• Country code. When available, the application reads a country code supplied by the hosting or edge infrastructure. That infrastructure may derive the country from the request's IP address. The application does not write the raw IP address into the click-event table.
• Coarse device class. The application briefly reads the user-agent header to classify the request as mobile, tablet, desktop, bot, unknown, or a similar coarse category. The full user-agent string is not written to the click-event table.
• Referring hostname. If a referrer header is present and valid, the application stores only its hostname. For example, it may retain example.com rather than a full referring page URL.

These are privacy-minimized event records, not anonymous data in every possible context. They remain linked to the relevant short link and include a timestamp, so we treat them as data that may be personal data under applicable data-protection law.

Recognizable bots and crawlers may be classified asbot. The current application does not guarantee that every automated request, messaging preview, security scanner, or crawler is excluded from click-event records.

What we do not use for redirect analytics

The Tryst Link application does not intentionally store the following fields in its click-event table:

• Raw visitor IP addresses.
• Full user-agent strings.
• Full referring URLs.
• Advertising IDs.
• Cross-site identifiers.
• Device fingerprints.
• Session-replay recordings, heatmaps, or scroll tracking.

Hosting, networking, security, or infrastructure providers may process ordinary request metadata such as IP addresses as part of delivering and protecting the service. Their infrastructure-level processing is separate from the fields our application chooses to store in the click-event table.

Abuse prevention and rate limiting

To protect registration, authentication, and link-management endpoints from automated abuse, Tryst Link maintains rate-limit counters for defined time windows.

For these controls, the application derives pseudonymous identifiers from information such as a request IP address, account email address, or authenticated user identifier using a keyed cryptographic hash. The raw source value is not stored in the rate-limit record itself.

Rate-limit records are used for security, abuse prevention, and service availability. Hosting and networking providers may still process ordinary request metadata as described elsewhere in this policy.

Why we process personal data

Under the GDPR, processing needs a lawful basis. Depending on the activity, we rely on the following bases:

• Performance of a contract. We process account and link information where it is necessary to create your account, authenticate you, save links, manage your dashboard, and provide the service you request.
• Legitimate interests. We process limited request, rate-limit, and click-event information where reasonably necessary to operate the redirect service, understand basic service use, diagnose problems, prevent abuse, protect infrastructure, and maintain security. We aim to minimize the data used for those purposes.
• Legal obligations. We may process or disclose information when required to comply with applicable law, valid legal process, accounting obligations, regulatory requirements, or enforceable orders.

Where processing is based on legitimate interests, you may have the right to object as described below.

Cookies and authentication

Signed-in users receive a first-party authentication cookie used by Auth.js to maintain the session. It is required for authenticated parts of the service such as the dashboard.

We do not intentionally use advertising or cross-site analytics cookies. See the Cookie Policy for the current cookie details.

Service providers and recipients

We use service providers to operate the website and database. They process data only in connection with providing their services to us, subject to their applicable contractual and legal obligations.

• Neon. Our PostgreSQL database provider. Account, link, and click-event records are stored in the database project configured for the service.
• Vercel. Vercel hosts and delivers the website, application routes, API requests, and short-link redirects. Vercel may process ordinary request and network information, including IP addresses and request metadata, as necessary to provide hosting, security, routing, and operational services.

We may also disclose limited information to professional advisers, regulators, courts, law-enforcement bodies, or other recipients where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal claims.

International processing

Trystlink is based in Cyprus. Vercel, Neon, and their subprocessors may process data outside Cyprus or outside the European Economic Area depending on the configured service region, infrastructure routing, and subprocessors involved.

Where an international transfer of personal data requires a GDPR transfer mechanism, we rely on applicable contractual or other legally recognized safeguards provided for the relevant processing.

Data retention

We do not claim a 90-day automatic click-event deletion schedule because the current application does not implement one.

• Account data. Retained while the account remains in the service, unless deletion is required or requested and no overriding legal reason requires retention.
• Link data. Retained until the link or owning account is deleted, or until we remove it for legal, security, abuse, or operational reasons. Expiring or disabling a link does not necessarily delete its database record.
• Click-event data. Currently retained with the associated link unless the click data, link, or account is deleted sooner. Deleting a link from the application database also deletes click-event rows associated with that link.
• Authentication sessions. Retained until the session expires or is removed, including when you sign out.
• Infrastructure logs. Vercel and other infrastructure providers may retain operational and security logs according to the configuration and retention rules applicable to their services.

We intend to keep retention periods no longer than reasonably necessary for the purposes described in this policy and will update this page if we introduce an automated aggregation or deletion schedule.

Deleting links and accounts

You can delete individual links from the available account controls. The current application does not provide a self-service account-deletion button.

To request deletion of your account or other personal data, email hello@trystlink.io from the email address associated with your account, or provide enough information for us to verify that the request relates to you.

We may need to retain limited information where required by law or where necessary for security, fraud prevention, dispute resolution, or the establishment, exercise, or defense of legal claims.

Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Access personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erase personal data in circumstances where the right to erasure applies.
• Restrict processing in qualifying circumstances.
• Object to processing based on legitimate interests.
• Receive or transfer data in a portable format where the right to data portability applies.

To exercise a privacy right, contact hello@trystlink.io. We may ask for reasonable information to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection or, where applicable, another competent supervisory authority.

Cyprus supervisory authority: Office of the Commissioner for Personal Data Protection.

Automated decision-making

We do not use the personal data described in this policy to make solely automated decisions that produce legal effects or similarly significant effects about individuals.

Security

We use technical and organizational measures intended to protect account and service data. Passwords are stored as bcrypt hashes, authentication sessions use signed tokens, and authenticated API operations are scoped to the signed-in account.

No online service can guarantee absolute security. If you believe you have found a security vulnerability, contact hello@trystlink.io.

Children

The service is not designed for children, and we do not knowingly solicit children to create short-link accounts. If you believe a child has provided personal data through the service in a way that requires action, contact us so we can review the situation.

Changes to this policy

We may update this policy when the product, infrastructure, data practices, or legal requirements change. The current version and its last-updated date will remain available on this page.

Where a change materially affects account holders or their rights, we will use a reasonable method to bring that change to their attention where required by applicable law.

Contact

Data controller: Trystlink
Address: Office 104, Lekorpouzier 12a, Limassol, 3075, Cyprus
Email: hello@trystlink.io

For the terms governing use of the service, see our Terms of Use.