Privacy policy
rdir.io is a link shortener run by Ampliative (“we”, “us”). This policy explains what we collect when you use rdir.io, app.rdir.io, docs.rdir.io, our API and MCP server, or open a short link on rdir.click or on a custom domain connected to rdir.io, and what we do with it.
For any question or request about your data, write to contact@ampliative.ai.
This is a starting point for the policy and is pending legal review.
Your account
When you sign up and use the app, we keep:
- your first and last name, email address, avatar and interface language;
- your password, stored only as a one-way hash, and, if you turn it on, your two-factor authentication secret and recovery codes;
- your passkeys: the public key, and when, from which IP address, browser and approximate location each one was last used;
- a security log of account activity with the IP address and browser it came from, and when you last signed in;
- your teams, their members and invitations, including the email address an invitation is sent to, custom domains, short links and their destination addresses, conversion statuses and the API tokens you create.
Clicks on short links
When anyone opens a short link, our redirect server records:
- the time, the link and the domain it was opened on;
- the IP address;
- the browser’s user-agent string, from which we work out the browser, operating system, device type and whether the request looks like a bot;
- the referring page, if the browser sends one.
We look up the approximate country and city of the IP address in a geolocation database on our own server (MaxMind GeoLite2), so the address is not sent anywhere for this. The link’s owner and their team see these records in their analytics. We also add a click ID to the destination address, so the owner can match a later conversion to the click.
Conversions and Meta
Link owners can report conversions to us through the app, the API or the MCP server. A team that connects a Facebook pixel gives us its pixel ID and access token, and we then forward its conversion events to Meta’s Conversions API on its behalf.
Before sending, we hash the email address, phone number, name, city, state, postcode and country with SHA-256. The IP address, browser user agent, Meta’s browser and click IDs and the owner’s own customer ID are sent as provided, as Meta requires. The link owner decides what to send and is responsible for having a legal basis to share it.
Emails
We send the emails you need to use the service: password resets, team invitations and service notifications. If you agree at sign-up, we may also send news and offers. We record that agreement with its date, the version of the wording, your IP address and browser, and you can withdraw it at any time in your account settings. Emails are sent through Amazon SES.
Logs and error reports
Our servers keep technical logs of requests, including IP addresses and, in some logs, browsers. When something fails, we send an error report to Sentry, which can include the IP address and browser of the request, and our team gets an alert in Slack.
How we use data
We use the data above to run rdir.io: to keep you signed in, redirect short links, show analytics to link owners, forward conversions when a team asks us to, send the emails described above, protect accounts and the service from abuse, and find and fix problems. We don’t sell personal data.
Who processes data for us
- Amazon Web Services hosts rdir.io and its databases in the United States, stores files and sends email.
- Sentry receives error reports.
- Slack carries our internal alerts.
- Google provides sign-in with Google and, if you allow it, Google Analytics on rdir.io.
- GitHub provides sign-in with GitHub.
- Meta receives conversion events, only for teams that connect a Facebook pixel.
If you use rdir.io from outside the United States, your data is transferred there. Some of these providers may also process it in other countries.
How long we keep data
- Account data stays while your account exists. If you ask us to delete your account, we delete it.
- Click and conversion records are kept so that link owners keep their analytics. We don’t delete them on a fixed schedule; write to us if you want them removed.
- Sentry keeps error reports for a limited period and then deletes them.
Your rights
You can ask us what data we hold about you, and ask us to correct, export or delete it, or to stop using it. Write to contact@ampliative.ai from the email address of your account.
You can change your profile, remove passkeys and withdraw marketing consent yourself in the app. Account deletion is done on request. If you opened someone’s short link and want your click record removed, tell us the link and roughly when you opened it. You can also complain to your local data protection authority.
Children
rdir.io is not meant for children under 16, and we don’t knowingly collect their data.
Changes
We may update this policy. The current version is always on this page, with the date it last changed.
Sign in with Google or GitHub
If you sign in with Google, we receive your basic profile through the openid, email and profile permissions, and keep your Google account ID, email address, profile picture and the access token Google issues for the sign-in. If you sign in with GitHub, we keep your GitHub account ID, username, email address, avatar and the access token GitHub issues.
We use this data only to sign you in and fill in your profile. We don’t sell it, don’t use it for advertising and don’t share it with anyone except the service providers that host rdir.io for us.