Korta
FR ES EN
Sign in

Privacy

Korta is designed to respect your privacy by default: no advertising cookies, no data resale, no stored IP addresses. This page describes precisely what we collect, why, and for how long.

Data controller

The data controller is the site publisher, identified in the legal notice. For any question about your data: camilo@corozco.fr.

What we collect

We only collect the strict minimum, at the moment you use a feature:

  • Account: your email address (and an optional display name). Legal basis: performance of the contract. Kept until you delete your account.
  • Links: the destination URL and the link options (expiry, hashed password, tags). Basis: performance of the contract. Kept until the link or the account is deleted.
  • Clicks: derived, anonymous data — country, device type, browser, referring site, timestamp — plus a technical identifier hashed with a daily salt. Basis: legitimate interest (audience measurement). Kept 13 months at most.
  • Reports: the email you may provide when reporting a link, used only to get back to you. Basis: legitimate interest (fighting abuse).
  • API: a fingerprint (hash) of your access tokens — never the plain token. Basis: performance of the contract. Kept until the token is revoked.
  • Link-in-bio images (profile photo, background image): resized and re-encoded on our servers — metadata (EXIF, including GPS coordinates) is stripped and the original file is never kept nor served. Hosted on IONOS Object Storage (Berlin, EU). Basis: performance of the contract. Kept until you remove them or delete your account.

What we never collect

  • Your IP address is never stored: the country is derived from it in memory, then the IP is discarded immediately — including from our technical logs.
  • No advertising, analytics or third-party cookies.
  • No cross-site or cross-device tracking, no persistent identifiers.
  • No data sold, rented or shared for commercial purposes.

How we count visitors without cookies

To tell unique visitors apart within a day, we compute a fingerprint: hash(daily salt + technical click data). The salt is destroyed every day (lifetime of about 26 hours): beyond the current day these fingerprints can no longer be linked to anyone and the data becomes anonymous.

Country lookup is powered offline by IP Geolocation by DB-IP — no third-party request is made.

Cookies

Only three technical first-party cookies are used (session, theme, form security); none of them tracks you. Names, purposes and lifetimes are detailed on the cookie management page.

Retention periods

Click events are kept for at most 13 months (basis: audience measurement), then deleted; only anonymous aggregates remain. Expired anonymous links are purged automatically. Account data disappears with the account.

Hosting and recipients

Data is hosted in the European Union and is not transmitted to any third party. Single exception: the destination URL of a link (never your personal data) is submitted to the Google Web Risk service to check that it is not dangerous.

Error reports

When a server error occurs, a technical report is sent, so that it can be fixed, to an error tracker (GlitchTip) that the publisher runs on this same server: these reports never leave it. They contain no IP address, cookie or form content, and each report is deleted after 90 days.

Your rights

Under the GDPR you have the rights of access, rectification, erasure and portability. From your settings, you can export or delete all your data at any time, without asking us.

You may also lodge a complaint with the French supervisory authority, the CNIL.

Updates

This policy may evolve with the service; the published version prevails. Last updated: October 2026.