- You will not hear whether the link exists
- The confirmation is identical for a live link, a deleted one, a link on a domain we do not host and a string that is not a URL. That is deliberate: an endpoint that answers "is this short link real?" is a reconnaissance tool, and one that names the owner turns reporting into harassment.
- No response-time commitment
- Reports are read by people, and we are not going to publish a service level we have not committed to. What we can say is the ordering: active harm first, everything else in turn.
- You will usually not get a follow-up
- If you leave an email address we may write to ask a question about your report. We do not send a resolution notice, because telling a reporter what happened to a link tells them something about the account behind it.
- Your details stay with us
- Your email address, if you give one, is never shown to the account that owns the link. Your IP address is not stored — only a salted hash of it, so a flood of reports from one source can be recognised.