Your privacy matters.

We keep cookies to the minimum the service needs:

• Session cookie — one secure, http-only cookie keeps you signed in for up to 30 days. It cannot be read by scripts on the page.
• Local preferences — your browser stores your selected workspace, language and currency so the site remembers them.
• Security — our network provider, Cloudflare, may set cookies to protect the site against bots and attacks.

We do not use advertising cookies or third-party analytics trackers.

On our customers' websites, the 2xurl website analytics script sets no cookies. It keeps a session id in the browser's session storage and, only with the visitor's consent or when the website owner has chosen not to require it, a random visitor id in local storage so returning visitors can be recognised. Without that id, visitors are counted with a hash that changes every day. The script respects Do Not Track and Global Privacy Control by default, never records keystrokes, form input values or clipboard contents, and stops collecting entirely for a visitor who opts out.

We rely on carefully chosen providers that process data on our behalf:

• Cloudflare — network delivery and security; tells us the country a click came from.
• Cloud hosting — runs our servers and databases.
• Google — optional Google sign-in, and Google Safe Browsing checks of link destinations.
• Razorpay, Cashfree and PayPal — payment processing. Card details go directly to them; we never see or store full card numbers.
• Wakit — delivers WhatsApp sign-in codes to your phone number.
• Email delivery provider — sends verification, security and billing emails.

We do not sell your personal data. We share it only:

• with the service providers listed above, to run 2xurl;
• with members of your workspace, who can see its links and analytics;
• with the owner of a website that uses 2xurl website analytics, who can see the analytics and any session recordings collected on their own website;
• when required by law, or to protect users and the public from abuse or fraud;
• as part of a merger or acquisition, in which case this policy continues to apply.

• All traffic is encrypted with HTTPS.
• Passwords are stored only as strong one-way hashes (Argon2id); API keys are stored hashed and shown once.
• Stored secrets are encrypted, and uploaded files such as resumes are kept private.
• Two-factor authentication, rate limiting and audit logs protect accounts and administrative actions.

No system is perfectly secure, but we work continuously to protect your information. Report security issues to [email protected].

• Account data — kept while your account is active and deleted on request, except records we must keep by law (such as invoices).
• Raw click events — deleted after 90 days.
• Hourly click totals — deleted after 180 days.
• Daily click totals — kept for the analytics period of your plan.
• Website analytics and session recordings — collected on our customers' own websites when they install the 2xurl tracker, and processed on their behalf. Paths are stored without query strings, no IP address is stored, and form inputs are masked in the visitor's browser before a recording is uploaded. Each customer sets how long it is kept (by default 90 days for analytics and 30 days for recordings) and can delete it at any time; recordings are not included in our backups.
• Heatmaps — when a customer turns them on: where on a page visitors click, how far they scroll and, optionally, coarse mouse movement on desktop, with the page path, device class, browser, operating system, country and a referrer category (never the referring URL). No keystrokes, form values, passwords, payment details or page content are collected, and session ids are hashed. Raw heatmap rows are kept at most 90 days and daily summaries for the period the customer chooses within their plan; customers can delete them at any time.
• Support messages and job applications — kept only as long as needed, and deleted on request.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data — most of it you can edit yourself in Settings;
• delete your account and personal data;
• object to or restrict certain processing, and withdraw consent;
• complain to your local data protection authority.

To make a request, email [email protected]. We respond within 30 days.

2xurl is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Our providers may process data in countries other than your own. When data moves across borders, we rely on providers that offer appropriate safeguards for personal data.

We may update this policy as 2xurl changes. We will revise the “Last updated” date above and, for significant changes, notify you by email or in the dashboard before they take effect.

Questions about this policy or your data? Reach us at:

• Privacy requests: [email protected]
• General support: contact form or [email protected]