Solutions
Short links that collect no personal data at the redirect
The compliance burden of a short link comes almost entirely from what the shortener logs when someone clicks it. Linkonda logs a number. There is no visitor record to secure, retain, disclose, or delete.
Where the obligation actually comes from
A redirect looks trivial, but a typical shortener treats each click as an analytics event: IP address, coarse geolocation derived from it, user agent, referrer, and a timestamp, usually retained indefinitely. Under GDPR that is personal data, and for links you distribute you are usually the controller.
The consequences follow mechanically. You need a lawful basis for the collection. You need a retention period and a way to enforce it. You need to answer access and erasure requests about data you never asked to have. And you inherit the breach exposure of a dataset sitting on someone else's infrastructure.
None of that is exotic — it is simply what happens once personal data enters the picture. The reliable way to avoid it is not to collect the data.
What is stored on each click
| Data point | Linkonda | Typical tracking shortener |
|---|---|---|
| IP address | ✗ Not stored | ✓ Stored, often indefinitely |
| Geolocation | ✗ Not derived | ✓ Derived from IP |
| Device / user agent | ✗ Not stored | ✓ Stored |
| Referrer | ✗ Not stored | ✓ Stored |
| Cookies set on redirect | ✗ None | ✓ Common |
| Per-click event row | ✗ None — counter only | ✓ One row per click |
| Total redirect count | ✓ Yes | ✓ Yes |
Data minimisation as an architecture, not a policy
Article 5(1)(c) asks that personal data be adequate, relevant, and limited to what is necessary. Most tools approach this as a policy question — collect it, then promise to handle it well. Linkonda approaches it as a schema question: there is no column for a visitor's IP address, so there is no policy to enforce and no setting to misconfigure.
The same reasoning applies to QR codes. Linkonda generates them in your browser from the short URL, so the image is never uploaded and the destination is not disclosed to Linkonda until the link is actually followed.
What this does not cover
To be clear about the boundaries: Linkonda's redirect collects no personal data, but the page you redirect to is entirely your own responsibility. If your destination runs analytics, sets cookies, or embeds third-party pixels, its obligations are unchanged by how the visitor arrived.
Account data — your email address and billing details — is processed normally so the service can function, and is described in the privacy policy. This page describes how the product works and is not legal advice; assess your own obligations with your own counsel.
Related
For the precise list of what is and is not recorded, see short links without visitor tracking. For serving links from a hostname you control, see custom domain short links.
Frequently asked questions
- Is an IP address really personal data under GDPR?
- Yes. European case law has consistently treated IP addresses as personal data where the holder has means reasonably likely to be used to identify the person. A shortener that logs the IP of every click is processing personal data on your behalf.
- What does Linkonda actually store when someone clicks a link?
- A counter is incremented. No IP address, no geolocation, no user agent or device type, no referrer, no cookie, and no per-visitor identifier is written. There is no click event row — only a total.
- Do I need a cookie banner for Linkonda short links?
- Linkonda sets no cookies and runs no tracking script on the redirect itself, so the redirect does not create a consent requirement for you. Your destination page has its own obligations, which are unaffected. This is not legal advice.
- Am I the data controller for links I share?
- Typically yes, for links you distribute. That is exactly why the collection model matters: with a tracking shortener you inherit a lawful basis, a retention policy, and data subject request handling for click data you may never look at.
- Can I still see how a link performed?
- Yes — as a total redirect count per link, available in the dashboard and through the API. What you cannot see is who followed it, because that is never recorded.