Privacy Policy

Who we are

hrva.cc is a non-commercial hobby project of HrvaLabs, operated by Karlo Hrvačić, who is the data controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR). The service is provided free of charge and as is — see the Terms of Use. For anything related to your personal data, contact privacy@hrvalabs.net.

What we collect and why

Account data

When you register, we process your email address, an optional display name, and your password, which is stored only as a salted one-way hash. If you sign in with Google or GitHub, we receive your name and email address from that account instead of a password. Two-step verification is available whether you sign in with a password, Google or GitHub. If you turn it on, we store the shared secret of your authenticator app, if you use one, and one-way hashes of your recovery codes, so we can verify your codes. If you add a passkey or security key, we store its public key and a few details: the name you give it, when it was added and last used, which connection types it supports (such as USB or NFC), whether it's synced between your devices, and its model identifier when the device shares one. We also keep the technical data needed to check it when you sign in, such as its credential ID, a sign-in counter and the data your device sent when you added it. We also store a random identifier that links your passkeys to your account. Your fingerprint, face or PIN never leaves your device, and hrva.cc never receives it. When you add a passkey, we email you a security notice. We also record when your account was created and when you last logged in.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — this data is required to provide your account.

Link statistics (visitors who open short links)

When someone opens a short link, hrva.cc adds to that link's counts for the day. For each link and day it keeps only totals: clicks, unique visitors, clicks from bots and link previews, and how many clicks came from each referring site's domain (for example t.co), each country, each device type (mobile, tablet or desktop), each browser and operating system family, and whether the click came from a QR code made by hrva.cc. The country comes from Cloudflare, which carries our traffic; we don't look up locations ourselves. Full addresses of referring pages, full browser identifiers and IP addresses are never stored, and nothing is recorded about an individual click. Short links set no cookies and run no scripts.

To count unique visitors, the visitor's IP address and browser identifier are combined with the link and a random key that changes every day, and turned into a one-way hash. The hashes and the day's key are kept only in Redis, never in our database, and expire a few hours after the day ends. Without the key the hashes can't be traced back to anyone, and because the key changes every day and the link is part of the hash, the same visitor can't be followed across days or across links. Link owners see only the daily totals.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — providing link owners with basic, privacy-preserving usage statistics and protecting the service from abuse.

Bio pages

If you create a bio page, we store what you enter for it: your handle, display name, bio, avatar choice (initials or an emoji), colour and theme, and which of your short links appear as buttons, with their titles, icons, order and whether each is shown, your search-engine setting, and when the page was created and last changed. Everything on the page is public at hrva.cc/@yourhandle, so add only what you want anyone to see. Your email address is never shown on the page. Search engines are asked not to list the page unless you turn on "Allow search engines to index this page".

When someone opens a bio page, their browser tells hrva.cc once that the page was viewed. We count each visitor at most once a day with the same one-way hash as link statistics: the IP address and browser identifier are combined with the page and a key that changes every day, kept only in Redis and deleted a few hours after the day ends. We store only daily totals per page: views, and views by bots. The page sets no cookies and loads no third-party scripts, fonts or trackers. Clicks on its buttons are ordinary short link clicks, counted as described above.

When you change your handle or delete your page, we keep the old handle for 30 days, so nobody can take it to pretend to be you, and then delete it. Like links, a bio page's text (handle, name, bio and button titles) is checked automatically for brand names and phishing words; a hit sends the page to an admin, and the notes, any visitor reports, and an admin's reason for hiding the page or taking back its handle are kept with the page and deleted with it. Admin actions on a page, such as hiding it or taking back its handle, are also recorded in the admin audit log (see Security and audit logs). A handle an admin takes back is also kept on the reserved list, with the admin's reason but without a link to you, until an admin releases it.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the page you publish; legitimate interest (Art. 6(1)(f) GDPR) for the view counts, for keeping old handles, and for checking and reviewing pages to protect visitors and the service from abuse.

Storage in your browser

We keep a few small items in your browser, only so the site works the way you asked, and none of them leaves your browser except the sign-in token, which is sent to hrva.cc with your requests:

• your sign-in token, in localStorage, so you stay signed in after you log in
• your light or dark theme choice, in localStorage, if you pick one
• the last five campaign (UTM) tags you used, in localStorage, so the link form can suggest them again
• the page to return to after you sign in with Google or GitHub, in sessionStorage, removed once you are back
• after Try again on a bio page that couldn't load, that page's handle, in sessionStorage, so keyboard focus can return to it; removed straight away

These are strictly necessary to provide the service you requested, which is why no consent banner is required for them (Art. 5(3) of the ePrivacy Directive, implemented in Croatia by the Electronic Communications Act). We set no tracking cookies and use no analytics or advertising scripts. Fonts are self-hosted — your browser does not contact third-party font services.

Emails we send

We send transactional emails only: address verification, password reset, security notices (for example when a passkey is added to your account), and notifications about your expiring links. We keep a log of emails sent to operate and troubleshoot delivery. We do not send marketing email.

Security and audit logs

We keep internal audit logs of security-relevant events (such as logins and administrative actions) to protect the service and its users. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

AI connectors

If you connect an AI app to your account through the hrva.cc MCP server, we store the app's registration and your authorization of it (token records) in the hrva.cc database until you disconnect the app in Settings → Connected apps or it goes unused for 30 days. We don't store the URLs and messages the app sends us beyond the links it creates.

To limit abuse, new AI app registrations are rate-limited per network. For this we keep a hash of your IP address (for IPv6, of its network prefix) in our cache for at most an hour. The plain IP address is not stored.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — this is required to provide the connection you requested.

Keeping links safe

To protect visitors from phishing, malware and scams, we check where links lead when they are created or changed, and again later.

• Blocklists — destinations are checked against public blocklists of harmful domains and links. We download these lists and store them on hrva.cc's own server, so this check sends nothing to anyone.
• Domain age — to learn when a destination's domain was registered, we send the domain name to the domain registries (RDAP). Only the domain name is sent.
• Spamhaus — when this check is enabled, the domain name may be looked up in Spamhaus's domain blocklist through DNS. Only the domain name is sent.
• Google Safe Browsing — receives the destination URL, as described under Who else receives data.
• Redirects — the hrva.cc server may request a destination to follow its redirects and check where they lead. The destination's server sees a request from hrva.cc, never from the visitor, and no visitor data is sent.

Links that lead to known or very likely harmful sites are refused or disabled automatically. Automated checks can also flag a link for review, or mark an account as a possible scammer. The admin reviews flagged links and decides what happens to them, and the checks never block an account on their own.

A weekly summary of site-wide totals, and an alert when many new links to the same new domain appear in a short time, go only to the admin and never identify a visitor. For links made without an account, the check behind that alert keeps a one-way hash of the creator's network, together with the link, for one to two hours, to spot phishing waves.

The admin can also moderate through the hrva.cc MCP connector in an AI app. The connector only receives masked user data, such as a partly hidden email address, and never IP addresses or visit details.

If you report a link or bio page, we store the link or handle, the category and the details you write, and nothing about you beyond a rate-limit counter for your network, which expires after an hour. Reports are also posted to the admin's Discord channel, as described under Who else receives data.

The hrva.cc in numbers page shows only site-wide totals. Opening it stores nothing about you beyond a rate-limit counter for your network, which expires after an hour.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — protecting visitors and the service from abuse.

Who else receives data

• Google Sign-In — only if you choose to log in with Google; Google acts as your identity provider under its own privacy policy.
• Google Safe Browsing — destination URLs you shorten, and the addresses they redirect to, are checked against Google's threat database to protect visitors from malicious sites. Only the URL is sent, never information about you or your visitors.
• Domain registries and Spamhaus — receive only the domain name of a destination, as described under Keeping links safe.
• Cloudflare — delivers the web application and short links (hosting/CDN). Your IP address reaches Cloudflare as part of normal traffic delivery, and Cloudflare tells us which country it belongs to, which we keep only as a daily count.
• Discord — so the admin sees moderation events quickly, hrva.cc posts alerts to a private Discord channel that only the admin reads: when a link is flagged for review, reported by a visitor or blocked automatically, when a bio page is sent for review by the automatic text checks or reported by a visitor, when someone signs up, when a blocklist fails to load or loads again, and when many new links to the same new domain appear in a short time (a possible phishing wave). An alert can include the short link, the domain it points to (never the full address), the owner's account number (not their email address or name), the reasons for the flag or block, and for a visitor report its category and the full details, with anything that looks like an email or IP address removed. A bio page alert names the page's handle (or its page number if it has none) and the owner's account number, and adds the reasons the text checks found or, for a visitor report, its category and the full details, cleaned the same way. The page's display name and bio text are never sent. A sign-up alert shows only the account number and whether the account uses email, Google or GitHub. A phishing-wave alert names the domain and its age, if known, and counts the new links and the different accounts or networks that made them, without saying which ones. Every Monday the channel also gets the weekly summary: site-wide totals for the past week, such as clicks, visitors, new links and users, reviews and automatic blocks, how many reviews are still open, and the top 5 links by clicks, each with its short link, the domain it points to and its click count. Nothing in a message is cut short: when more alerts come in at once than fit in one message, the rest aren't posted and the message ends with how many were left out (“and N more”). Discord Inc., based in the United States, processes these messages under its own terms, and they stay in the channel until the admin deletes them.
• Email delivery — transactional emails are sent via [email provider].
• Backend hosting — the API and database are hosted by [hosting provider] in [location].

We do not sell personal data and we do not share it with anyone beyond the processors listed above.

Separately, if you connect an AI app to your account, that app receives the results of the tools it uses (short links, link lists and visit stats). It is not our processor; it handles that data under its own terms.

How long we keep data

• Unique-visitor hashes and the daily key — kept only in Redis and deleted a few hours after the day ends.
• Rate-limit counters — hold a hashed IP address and expire within an hour.
• Account data — kept until you delete your account; unused accounts are deactivated automatically after a period of inactivity.
• Passkeys — until you remove them or delete your account.
• Password reset tokens — deleted as soon as they expire.
• Your links and their statistics — kept while your account exists; deleting a link also deletes its daily counts.
• Bio pages — kept until you delete the page or your account; their daily view counts, review notes, visitor reports and an admin's reasons go with them. The audit log's record of admin actions on the page is kept as listed for audit logs below. An old handle is kept for 30 days after a change or deletion. A handle an admin takes back is also kept on the reserved list, with the admin's reason but without a link to you, until an admin releases it.
• Connected-app token records — deleted when you disconnect the app in Settings → Connected apps, or automatically once the app's refresh token has gone unused for 30 days.
• Email and audit logs — kept for [retention period].

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, ask us to restrict or object to processing, and receive your data in a portable format (Arts. 15–21 GDPR). Write to privacy@hrvalabs.net and we will respond within one month. You can also download a copy of your data yourself in Settings → Your data; the export includes your passkeys' names, types, sync state and dates, never key material. It also includes your bio page and its buttons. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or your local supervisory authority.

Changes to this policy

If we change how we process personal data, we will update this page and the date at the top. Substantial changes affecting registered users will also be announced by email or in the app.

Contact

Questions about privacy at hrva.cc: privacy@hrvalabs.net.