Skip to content
tiiny
Sign up

What tiiny keeps, and what it doesn’t.

This page describes the tiiny software. The people running this instance decide how long data is kept and who can sign up; ask them if you have questions about this server.

When someone clicks a short link

tiiny redirects them and adds one to a set of daily tallies for that link:

  • the total for the day (UTC);
  • the referring site’s host, such as news.example.com, or “direct”;
  • the country, as a two-letter code;
  • the device type, browser family and operating-system family.

It never stores the visitor’s IP address, their raw user-agent string or the full referring URL. The IP address is used in memory to rate-limit requests and look up a country, then dropped. Clicking a short link sets no cookies. Known bots and link-preview crawlers are redirected but not counted.

Without an account

  • Guest links: if you shorten a link without an account, one cookie (tiiny_guest, or __Host-tiiny_guest on https) lets this browser list and later claim those links. Only its hash is stored. It lasts 400 days and is cleared when you sign in. On http browsers send it only with requests to /api/v1; on https they send it with every request to this site. Redirects never read or set it.
  • Daily cap: to limit how many links one address can make per day, the creator’s IP address (for IPv6, its /64 network) is stored with a count for that day, and only that. Unverified accounts count against the same cap. These counts are purged after a day.
  • Abuse reports: a report stores the short link, where it pointed, the reason, any details you wrote and your email if you gave one. Only admins see reports.

When you have an account

  • Profile: your email address, name, role, whether your email is verified, and when you joined.
  • Password: only a salted Argon2 hash, if you set one.
  • Connected sign-ins: which provider (Google or GitHub) and that provider’s account ID.
  • Sessions: one cookie, tiiny_session, that identifies a server-side session. It lasts 30 days and is removed when you sign out.
  • Email links: verification and reset tokens are stored hashed and expire after 24 hours and 1 hour.
  • Links: each destination, slug, click total and when it was made or changed, plus a per-day count of links you created.

Your theme choice is saved in your browser’s local storage, not on the server.

How long it’s kept

Daily click tallies are kept until the operator’s retention setting removes them; by default they stay. A link’s all-time total stays as long as the link. Deleting a link deletes its stats. Deleting your account deletes your links and their stats. The slugs of deleted permanent or blocked links are kept so they can’t point somewhere new, until an admin releases one.

Third parties

tiiny loads no third-party scripts, fonts or analytics. If you sign in with Google or GitHub, that provider sees the sign-in. If the operator configured email, messages go through their mail server.