1. Who we are
Bikto provides short links, QR codes and link analytics through the website bikto.app and the short domain bik.to (together, the “Service”). In this policy, “Bikto”, “we” and “us” refer to the operator of the Service.
This policy covers two groups of people: customers, who create an account and manage links, and visitors, who open a Bikto short link or scan a Bikto QR code. You can reach us about privacy at any time at support@bikto.app.
2. Our role for visitor data
Customers decide which links and QR codes to create and where they lead. When a visitor opens one of those links, we record visit information so we can redirect the visitor and show the link owner its analytics. For that visit information we act on behalf of the customer who owns the link (as a “processor” or “service provider”). For account information, billing and the security of the Service, we decide how the information is used (as a “controller”). If you visited a link and have a question about how its owner uses analytics, please contact the link owner; we will also help where we can.
3. Information we collect
Account information
- Your name, email address and password. Passwords are stored only as a one-way hash.
- If you sign in with Google, the name, email address and profile image Google shares with us.
- Your plan, usage counts (for example, links created this month) and account settings.
Content you create
- Destination URLs, short codes, notes, tags, expiration dates, device and country routing rules and link passwords (stored as a one-way hash).
- Social preview titles, descriptions and images, QR code names, colors and logos, files you upload and backups you create.
- API keys (stored as a one-way hash) and click webhook endpoints (signing secrets are stored encrypted).
Billing information
Payments are handled by our payment provider. We receive the order status, amount, currency, subscription period and a customer reference. We do not receive or store full card numbers.
Sign-in and security information
When you sign in, we store your IP address and browser user agent with your session so we can protect your account. To limit abuse, we also keep short-lived request counters keyed by a hash of the requesting IP address.
Visit information
When someone opens a short link or scans a trackable QR code, we record:
- the link or QR code used, the destination and the time;
- approximate location (country, region, city and approximate coordinates) and time zone, derived by our hosting provider from the network connection;
- browser language, operating system, browser, device type and device model;
- the referring website, if the browser sends one; and
- the hosting data center that served the request.
We do not store visitors’ IP addresses with visit records. To count unique visitors, the IP address is converted into a one-way keyed hash that is different for each customer workspace, so the same visitor cannot be matched across different customers’ links. We do not place cookies on visitors’ browsers when they open a short link.
Messages you send us
If you contact support, we keep your message and our reply so we can help you.
4. How we use information
- To provide the Service: create and redirect links, generate QR codes, apply routing rules, show analytics and run exports, backups, API requests and webhooks you configure.
- To keep the Service safe: verify email addresses, prevent abuse, check link destinations against safety lists and investigate reports of phishing, malware or other misuse.
- To manage plans and billing, including monthly usage limits.
- To send service messages, such as email verification, password resets, billing notices and important changes to the Service.
- To comply with law and enforce our Terms of Service.
We do not sell personal information, we do not use it for advertising, and we do not show ads on redirects.
5. AI features
Some plans let you ask for AI suggestions, such as a short code or a social preview title. Only when you request a suggestion do we send the destination URL, and the language you choose, to our AI provider to generate it. We do not send your analytics or account details.
8. International transfers
The Service runs on Cloudflare’s global network, so information may be processed in countries other than yours. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.
9. How long we keep information
- Account information and links are kept while your account is open. Cancelling a subscription does not delete your links; they keep working as described in our Terms of Service.
- Visit information is kept for up to 90 days.
- Deleted short codes are permanently reserved so they can never point somewhere new. We keep only the short code itself for this purpose.
- Backups and uploaded files are kept until you delete them or your account is deleted.
- Billing records are kept for as long as tax and accounting laws require.
- Request counters used to prevent abuse cover windows of one hour or less and are deleted automatically after they expire.
10. Your choices and rights
You can update your name and password on the Account page and export your links as JSON and your analytics as CSV at any time. To access, correct or delete other information, or to delete your account, email support@bikto.app from the address on your account. Before deleting an account, we will explain what happens to its links so you can decide how to proceed.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict certain processing, and to complain to your data protection authority. We do not sell or share personal information for cross-context behavioral advertising. We respond to requests within 30 days and will not treat you differently for exercising your rights.
11. Security
We protect information with encryption in transit, hashed passwords, link passwords and API keys, encrypted webhook secrets, and access controls that keep each workspace’s data separate. No system is completely secure; if we learn of a breach that affects your information, we will notify you as the law requires.
12. Children
The Service is not directed to children, and you must be at least 16 to create an account. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy. We will change the date at the top of this page and, for material changes, notify account holders by email or in the Service before the changes take effect.
14. Contact us
For privacy questions or requests, email support@bikto.app.