--- title: 'Privacy ยท skrat.im' description: 'What skrat.im stores about links, clicks and accounts, what it does not store, and why it uses no tracking cookies.' url: https://skrat.im/en/privacy/ lang: en --- # Privacy What skrat.im stores about links, clicks and accounts, what it does not store, and why it uses no tracking cookies. This page describes what data skrat.im (and krat.im, run by the same system) processes and why. It is written for people, not lawyers. The Slovak version is the binding one. ## Operator The service is operated by the independent project skrat.im, based in the Slovak Republic. Contact for data protection matters: [info@skrat.im](mailto:info@skrat.im). ## Links When a link is created we store the destination address, the alias, the domain, the creation time and optionally a name, an expiry date, a click limit and a password (as a hash only, never the password itself). Without an account we also store a hash of the secret token used to manage the link; the token itself stays in your browser (localStorage) and is never sent anywhere else. We also store a **hash of the creator's IP address** (derived with a server secret, not reversible). It is used only to disable all links from the same source in case of abuse (phishing, spam). The IP address itself is not stored. Destination addresses may be checked against Google Safe Browsing when a link is created; in that case Google receives the destination address, not data about you. ## Clicks On every redirect we record: the time, the country (from the Cloudflare header, country level only), the referring site's domain, the device type, the browser and operating system family, and whether the visitor was a bot. To estimate unique visitors we store a **hash that changes daily**, derived from the IP address and browser. It changes every day and cannot be reversed to an IP address or joined across days. We **do not store** the IP address, precise location, the full browser user-agent string, or anything that identifies a specific person. We **use no cookies** to track people who click; the redirect sets no cookie. Link statistics are public by default on the preview page (the link with a + at the end); the owner can hide them. ## Account An account is optional. On sign-in we store the email address, the language and the time of the last sign-in. Sign-in tokens (magic links) are stored as hashes only, are single-use and valid for 15 minutes. API keys are stored as hashes only. A signed-in browser receives a session cookie (`sk_session`, HttpOnly, 30 days) and a `lang` cookie that remembers the language of the last page you viewed (set while browsing the portal, account or not). These are the only cookies we set and both serve only to make the site work. You can delete the account in the settings; all links, keys and clicks are deleted with it. ## Abuse reports For a report we store the reported link, the reason, the description and optionally the reporter's email so we can reply. Reports are kept for at most one year. ## Processors - **Cloudflare** provides network protection and delivery and processes visitors' IP addresses under its own [privacy policy](https://www.cloudflare.com/privacypolicy/). We take only the country code from Cloudflare. - **Google Safe Browsing** (when enabled) receives destination addresses for checking. - Portal traffic (not redirects) may be measured with our own cookie-free Plausible instance; when enabled, it collects no personal data. Data is stored on a server in the European Union. We do not sell it or share it with third parties beyond what is listed above. ## Retention Links and their statistics exist until you delete the link or until the account is deleted. An expired link stays stored (the alias remains reserved for you) until you delete it. Links that violate the terms may be disabled and deleted after 90 days. ## Your rights You have the right to access, correct, delete and port your data, and the right to object. You manage links and the account yourself in the app; for anything else write to [info@skrat.im](mailto:info@skrat.im). You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or your local authority. ## Changes This page may be updated; the date of the last change is shown in the header. Significant changes are announced on the home page.