When
The timestamp of the request, bucketed by hour, day or month depending on the range you are looking at.
Analytics
Measure the link, not the person
You need to know that Tuesday's post outperformed Thursday's, which country your traffic came from and whether the QR code on the poster was ever scanned. None of that requires knowing who anybody is — so we do not find out.
What is recorded
Six things per click
Every one of them is a property of the request, not of a person.
Where from
Country, region and city, when the edge in front of the app supplies them. If those headers are absent the fields stay empty rather than being guessed.
What device
Device class (desktop, mobile, tablet), operating system and browser family, parsed from the user-agent string. No fingerprinting, no canvas, no font enumeration.
How they arrived
The referring URL and its domain, the Accept-Language preference, and whether the click came from a QR scan rather than a tap.
Which campaign
The five UTM parameters. The link’s own tags win; anything it leaves unset is filled in from the incoming request, so a partner who appends utm_source to the short URL is still reported separately.
Whether it was a person
Known crawler and preview-bot user agents are flagged. Bot traffic is excluded from your numbers by default and can be shown when you want to see it.
What is not
The list that usually goes unpublished
Most analytics pages describe what a product collects. This is the other half, and it is the part worth reading.
No IP address is stored
The click table has no column for one. The IP is used in memory to derive a visitor hash and to apply rate limits, then it is gone. Nothing you or we can query later contains it.
No permanent visitor identifier
Unique visitors are counted with an HMAC over the current date, the link, the IP and the user agent, truncated to 32 characters. Because the date is part of the input, the identifier is different tomorrow — the same person on two days cannot be joined into one profile.
No cross-site tracking
The redirect happens server-side and hands the visitor straight to your destination. There is no pixel, no third-party script and no shared identifier that could follow someone from one customer’s link to another’s.
No analytics cookie
The redirect path sets no cookie for measurement. The only cookie a visitor can receive is the short-lived one that remembers they entered a password-protected link’s password.
No data sales, no ad networks
Click data is yours. It is not sold, not pooled into a data product, and not shared with advertising or data-broker networks. There is nothing to opt out of because there is no such pipeline.
No tracking you cannot switch off
Analytics can be disabled per link. With tracking off the redirect still works and nothing at all is written for that link.
Mechanics
How a unique visitor is counted
The interesting engineering is in counting the same person twice without being able to identify them once.
It is one-way
An HMAC cannot be reversed to the IP that produced it, and the salt never leaves the server. Even with the full click table, the addresses are not recoverable.
It expires daily
The date is part of the input, so tomorrow the same visitor produces a completely different hash. Yesterday's rows cannot be linked to today's.
It is scoped
The link id is part of the input too, so the hash for one link does not match the hash for another. A visitor cannot be followed between two customers' links.
The cost of that design is honest and worth stating: unique-visitor counts are per day and per link. There is no thirty-day unique figure, because producing one would require exactly the persistent identifier we refuse to keep.
Reports
What you actually look at
Every view is available for a single link, a Bio Page, a domain, a folder or the whole account.
Time series
Clicks and unique visitors over 24 hours, 7, 30 or 90 days, 12 months, or a custom range. Bucketed hourly, daily or monthly to match.
Breakdowns
Country, city, device, operating system, browser, referrer, language, UTM source and UTM campaign — each with click and unique counts and a share of the window.
Top links
Your busiest links for the selected window, with the short URL, destination and both counts, so you can jump straight to the one that moved.
Live feed
The most recent clicks as they arrive, showing country, city, device and browser. It is a feed of events, not of people — there is no identifier to click through to.
Filters
Scope any view to a single link, Bio Page, domain or folder, and filter by country, device or traffic source.
CSV export
Export the raw rows for the current window and take them into a spreadsheet or a warehouse. Your data leaves whenever you want it to.
Performance and retention
Fast charts, bounded history
Two constraints that shape the feature: a redirect must never wait for analytics, and history costs storage.
The visitor never waits
The click write happens after the redirect response has already been sent. If the database is slow, or the write fails outright, the visitor still arrives at your destination at full speed — the failure is logged on our side, never theirs.
Daily totals are pre-aggregated per link, so a 90-day chart is a small indexed read rather than a scan across every click ever recorded.
How long history is kept
- Free
- 30 days
- Pro
- 365 days
- Business
- 1095 days
Export to CSV at any time, on any plan that includes export, so the retention window is a limit on what we store rather than on what you can keep.
Next
Read the details, then try it
The privacy policy spells out the same commitments in legal form, and the demo shows the reports on sample data.