Trust

Security and privacy

ykm.de is ad-free, never stores raw IP addresses and uses no external analytics or advertising services in the frontend.

What we do not do

• No ads, no advertising pixels, no retargeting.
• No raw IP addresses in the database – only an HMAC hash for unique counts.
• No external CDNs, fonts or scripts in the frontend.
• No selling or profiling of usage data.

What data we collect

When shortening, we store the destination URL, short code, timestamp and – if available – referrer host, country code and a coarse device class. The IP is stored only as a salted hash and deleted after the retention period: 365 days.

Security measures

• TLS for all connections, HSTS, strict content security policy.
• Passwordless sign-in via one-time code; sessions with HttpOnly/SameSite cookies.
• CSRF protection, rate limits and server-side authorization checks for every action.
• SSRF protection when shortening and importing URLs.
• Campaigns are published as immutable revisions; rollback without data loss.

Your rights

You can export your data as JSON at any time and delete your account including all links. Both are available in Account. Information, correction and deletion under the GDPR are directly possible.

Data processing agreement (DPA)

For customers processing personal data in links or campaigns, we provide a data processing agreement under Art. 28 GDPR. Request at abuse@ykm.de. The list of subprocessors (hosting, email delivery, payments) is provided with the agreement.

Report a vulnerability

Please report vulnerabilities confidentially to abuse@ykm.de. The contact details are also in the security.txt.