Privacy Policy
At YAS.SH, privacy is a foundational engineering principle. This policy explains what data we collect, why we collect it, how we protect it, and when Google advertising technologies may run if you consent.
Zero Raw IP Storage
IP addresses are immediately hashed using HMAC-SHA256 with a daily rotating salt. Raw IP addresses are never written to disk or database logs.
End-to-End Encryption
All web traffic and API calls are secured with modern TLS 1.3 ciphers, strict HSTS preloading, and CSP headers.
Full Data Sovereignty
Self-service CSV data export and permanent one-click account erasure with complete automated database purge.
1. Information We Collect and Purpose of Processing
We adhere strictly to data minimization principles, collecting only the essential telemetry required to operate our developer platform:
- Account Authentication Data: Email address, optional display name, and password hashed using bcrypt (cost factor 12).
- Link & Redirection Telemetry: Destination URL, custom alias, custom branded domain, and optional expiration dates.
- Anonymized Click Analytics: Approximate country (via local GeoIP lookups), browser user-agent family, and operating system without fingerprinting.
- Transactional Email Telemetry: Recipient addresses, delivery status events (delivered, bounced, complained), and retry attempts governed by retention policies.
2. What We Never Do — and When Ads May Appear
We do not sell account data to data brokers. If you accept advertising cookies, Google AdSense may set cookies for ad serving and measurement under Google's privacy policy. Ads load only after that consent. reCAPTCHA runs on sign-in and contact forms. How Google uses data: https://policies.google.com/technologies/partner-sites
3. Your Rights Under GDPR & CCPA
You have the unconditional right to access, rectify, export, or permanently erase your data at any time by contacting our Data Protection Officer at: privacy@yas.sh.