Short links.
Clear data practices.

What the service collects

When you browse this site, call the API, or follow a short link, the service records request information for operation, troubleshooting, and abuse investigation. Depending on the request, that includes:

• The connecting IP address and request time.
• The HTTP method, path, and public query parameters.
• Submitted request-body content and selected noncredential headers, including information such as user-agent and referrer when sent.
• Request outcome and short-link activity.

Public request parameters, destination URLs, and accepted request bodies are stored verbatim. Sensitive content placed in a public parameter or submitted URL is not redacted. Logging captures up to 16 KiB each of the raw query string and request body, and up to 4 KiB per selected header; truncation is indicated in the record. Response bodies are not part of request logging. Administrative login and native administrative API contents are excluded from public-content logging, and credential headers are not collected.

What YOURLS stores

YOURLS stores the destination URL, short-link keyword, title, creation time, and link metadata. IP logging and click logging are enabled. These records support redirects and link statistics. The service operator can inspect stored destinations and activity records.

A destination URL may itself reveal personal information or grant access through a query parameter. The original submitted URL is retained without redaction. Anyone who obtains a working short link can follow its redirect.

Destination-page archives

After a link is submitted, a background worker attempts to fetch and privately archive the destination’s HTML or text response. Captured content is stored verbatim and is accessible to the operator, not through a public archive viewer. The archive is a snapshot of a server response, not a complete rendered copy of a website.

The worker fetches only public HTTPS targets with valid certificates on port 443. It rejects private-network addresses, URLs containing a username or password, and disallowed redirects. It follows at most five redirects and has a default capture limit of 2 MiB per page. It does not execute JavaScript or fetch images, stylesheets, scripts, or other subresources. These are per-page fetching limits; link creation has no rate limit.

HTTP destinations can be shortened, but their archive status is skipped_https_required. Other targets may be skipped or fail archival. A successful short-link response does not guarantee a successful archive. Fetching a destination contacts its server, which may record the worker’s request and IP address. Following a short link contacts the destination from your browser, under that site’s data practices.

GET, POST, and visibility

GET requests place the destination in the API request URL. That URL may appear in browser history, proxy logs, or other systems involved in sending the request. POST places the destination in the request body, which reduces this particular exposure.

Both methods create stored links, and both are covered by this request-logging and archival notice. Send credentials in the authorization header when authentication is required, never in the URL.

Retention and access

Request logs and destination-page archives have a configured retention target of 30 days. Request-log cleanup runs on subsequent web requests; archive cleanup runs daily while the worker is running. Older request logs can remain during inactivity until a later request triggers cleanup. YOURLS stores link records, creation IP addresses, and its native click records separately; these remain until the operator removes them. The retention period is not an automatic expiration date for short links, their stored destination URLs, or native click statistics, and does not cover separate backups.

Access to logs, private archives, and administrative records is intended for the service operator and authorized administrators. This service does not offer confidential storage or a guarantee of anonymity.

Removal, privacy, or abuse requests

Contact the operator through the channel where this service was provided. Include the short URL and a brief description of the issue. Do not send passwords, tokens, or additional sensitive material.

Do not use this service for phishing, malware, credential collection, or unlawful material. Links may be removed to address abuse or an operator request.

More about this service

Agent Links is independently operated and uses YOURLS software. The API documentation describes supported requests and limits. YOURLS project maintainers do not operate this deployment or receive your requests merely because this service uses YOURLS.