Privacy Policy

Last updated: 2 July 2026

yer.ma ("we", "us") is a URL shortener. This policy explains what we collect, why, and what you can do about it. We try to collect as little as possible.

What we collect

• Account data: your email address and a hashed (never plain-text) password, when you sign up.
• Links you create: the destination URL, optional title, and settings (expiry, password, alias).
• The IP address you create a link from: for both guest and account links, stored solely to prevent and investigate abuse (spam, malware, phishing). It's visible only to our moderators, and it is never recorded when someone clicks a link.
• Click data (account links): a timestamp, approximate country, the referring site's host, a coarse device type (mobile / desktop / tablet), and the browser's primary language. No raw IP address, no tracking cookies.
• Click data (guest links): an anonymous, aggregate tally of the same fields — timestamp, approximate country, referring site's host, coarse device type, browser language. It isn't tied to any person, contains no IP address, and uses no cookies.
• An essential session cookie: set only when you log in, so the dashboard knows it's you.

Why, and our lawful basis

We process account and link data to provide the service you asked for (performance of a contract). Click analytics, abuse screening, and keeping the link creator's IP address are carried out under our legitimate interests in running a useful, safe service: logging who creates a link, not who clicks it. Our click analytics are cookieless and not tied to your identity.

How long we keep it

• Click analytics: roughly 13 months, then aged out. Guest-link tallies are anonymous aggregates (no personal data).
• A link's creator IP: kept for as long as the link exists. Guest links expire 30 days after their last visit; account links until you delete them.
• Account and link data: until you delete the link or your account.
• Guest links: expire 30 days after their last visit.

Who we share it with

We don't sell your data. We use a small number of processors to run the service: Cloudflare (hosting, CDN and edge data stores), Postmark (transactional email), and Google Safe Browsing (screening destination URLs for malware and phishing).

Your rights

Under UK GDPR you can access, correct, export or delete your data. You can export everything we hold from Settings → Yer data, and delete your account (and all its links) from the same page.

Cookies

We use a single essential cookie for your login session. Because our analytics are cookieless, we don't show a cookie banner.

Changes

We'll update this page if our practices change, and adjust the date above.