Privacy Policy

Overview

Ekly is operated by Baaspani Pty Ltd, based in Australia. This policy explains what information we collect, how we use it, and your rights under the Australian Privacy Act 1988 and Canada's PIPEDA.

We collect the minimum data needed to operate the service. We do not sell your data. We do not share your data with advertisers.

Information we collect

When you create an account:

Name and email address
Password stored as a bcrypt hash - we cannot see your password
Timezone preference

When you create or use short links:

Destination URLs you shorten
Click data including country, city, device type, browser, and referrer
IP addresses are hashed before storage and cannot be reversed
UTM parameters if present in the click URL

When you use the service generally:

API usage logs including endpoint, timestamp, and response code
Session data for keeping you logged in

How we use your information

To operate and improve the Ekly service
To provide you with link analytics
To send transactional emails such as email verification and password resets
To send a weekly analytics digest if you have active links
To detect and prevent abuse of the service
To comply with legal obligations

We do not use your data for advertising. We do not build advertising profiles. We do not sell your data to third parties.

Data retention

Click data is retained for 2 years then automatically deleted
Click data is compressed after 30 days
Account data is retained until you delete your account
Session tokens expire after 30 days of inactivity
IP hashes cannot be reversed and are used only for unique visitor counting

Cookies

Ekly does not use tracking cookies. We do not use advertising cookies. We do not require a cookie consent banner because we do not place cookies on redirect pages.

We use a session cookie only on authenticated dashboard pages to keep you logged in. This cookie is strictly necessary and does not track you across other websites.

Third party services

We use third party services to operate Ekly. These services may process your data as part of delivering the service:

Edge network and DDoS protection provider
Server hosting provider based in Australia
Transactional email delivery provider
Error monitoring service - no personal data is included in error reports

Each provider operates under Australian, Canadian, or equivalent data protection standards. We do not share your personal data with these providers beyond what is necessary to operate the service.

Your rights

Under Australian and Canadian privacy law you have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your account and associated data
Download a copy of your data from your account settings
Withdraw consent for optional data processing

You can exercise these rights from your account settings page or by contacting us at the email below.

Data security

All data transmitted over HTTPS with TLS 1.2 minimum
Passwords hashed with bcrypt at 12 rounds
API keys hashed and never stored in plain text
IP addresses hashed with HMAC-SHA256 before storage
Database access restricted to application servers only
Regular security reviews and penetration testing

Changes to this policy

We will notify you by email if we make material changes to this policy. Minor updates will be reflected with a new last updated date at the top. Continued use of Ekly after changes constitutes acceptance.