Privacy

Last updated 21 October 2026.

FlashLink collects as little as it can. This page says what is kept, why, and for how long.

Who is responsible

Until a contact address is published here, use the report form.

When you open a short link

We count the click. For each click we keep the country (given by Cloudflare), the type of device (phone, tablet or computer, read from your browser), and the host name of the site you came from, if any. We do not keep your IP address, your full browser identification or anything that identifies you, and we do not set cookies. Robots and link previews are not counted.

Clicks are stored as individual points for up to 3 months by Cloudflare Analytics Engine, and as daily totals per link in our database.

When you report a link

We keep what you write in the form (the link, the category, your details), the optional e-mail address you give, and a pseudonymous identifier computed from your IP address with a secret key. It lets us ignore duplicate reports and limit abuse of the form, and it cannot be turned back into your address. The e-mail address and the identifier are erased after 90 days. Counters used to limit the number of requests are erased within 24 hours.

If you create an account

You sign in with your e-mail address and a single-use link sent to it: there is no password. We keep your e-mail address, the date of your account and your links. The sign-in link is stored only as a fingerprint, works once and expires after 15 minutes; expired ones are erased within a day.

When you sign in, we set one cookie, named __Host-fl. It keeps you signed in for 30 days, is readable only by the server, is sent only to this site and is not used for tracking. It exists only for people who sign in: people who click a short link get no cookie. We store only a fingerprint of its value. Signing out erases it.

Sign-in e-mails are sent through an e-mail delivery provider acting on our behalf. To limit abuse, we count sign-in attempts per address fingerprint and per pseudonymous connection identifier for one hour.

You can delete your account from the Account tab at any time. This closes all your links for good and erases your e-mail address and your sessions at once. Only short codes are kept, so that they are never reused for another destination.

Links created on the service

We keep the destination address, the short code, the dates and, for signed-in people, the account that created the link. A deleted link keeps its code so it is never reused for another destination.

If a link has a portal page, the title, text, image and button links entered by its owner are public at the portal address. They are deleted with the portal or the link.

The people who run the service can see the links of all accounts (address, destination, dates, owner) to handle abuse reports and keep the service safe. They do not read the private notes of a link, nor the content of the QR codes you save (Wi-Fi access, contact cards, messages...). Saved QR codes and notes are deleted with the account.

Infrastructure

The service runs on Cloudflare, which handles every request and may process IP addresses and technical logs under its own policies, as the infrastructure provider.

Why we use this data

To run the service, to count visits, and to fight phishing, malware and other abuse. These are our legitimate interests. Your account data is used to provide the service you asked for.

Your rights

You can ask for access to, correction or erasure of data about you, and object to its use. Write to the contact above. You can also complain to your data protection authority; in France, the CNIL.