Privacy Policy

1. Information We Collect

Short answer: The target URL you submit, temporary redirect metadata needed to make the link work, and basic operational signals handled by hosting, analytics, advertising, or security providers.

Long answer: When you create a creepy link, we store:

• A temporary mapping between a short code and your target URL (the destination URL you submit)
• This mapping expires automatically after 24 hours
• Rate-limit counters that help prevent abuse of the generator, keyed by IP address and by day
• When a submitted destination is refused by the destination policy, a rejection record holding the timestamp, the rejection reason, and the destination hostname. The full URL is not stored.
• IP address, browser information, device type, and basic request metadata used by hosting, security, and rate-limit systems
• Basic page, device, browser, cookie, web beacon/pixel, and interaction signals from Google Analytics, Microsoft Clarity, Umami, and PVUV

We do NOT:

• Provide creator-facing click tracking or visitor analytics dashboards
• Collect passwords, login details, payment details, account tokens, or private credentials
• Provide a visitor credential collection flow or phishing page builder
• Host malware, software payloads, or forced-download content
• Create phishing pages that imitate banks, email providers, or other login portals
• Give link creators a recipient tracking or analytics product
• Sell generated-link data or share recipient-level tracking with link creators

Boundary: Credentials, short code mappings, and operational logs are different categories. CreepyLink does not collect passwords or visitor credentials, but short code mappings and basic operational logs (including IP address and browser information) may still exist so redirects, abuse prevention, hosting, advertising, analytics, and security checks can work.

2. How We Use Information

We use the temporary short code mapping only to send a generated CreepyLink to the destination URL you provided. We use rate-limit counters to reduce spam and abuse. We do not use generated-link data to give creators analytics dashboards, build retargeting lists, sell click data, or identify individual recipients.

3. Difference From Analytics Shorteners

Some URL shorteners are built around click tracking, campaign attribution, referrer reports, geographic dashboards, or permanent branded links. CreepyLink is different: it is a short-lived prank and security-awareness redirect tool. The suspicious appearance is the feature, not visitor surveillance.

4. Data Storage

Short link mappings, rate-limit counters, and rejection records are stored in Upstash Redis, a managed cloud key-value store. All of it expires automatically: mappings within 24 hours, daily rate-limit and rejection counters within 24 hours of the day they were created. The rejection log keeps the most recent 200 entries and is trimmed as new ones arrive. We cannot recover expired links.

Destination hostnames submitted with a refused request are kept only as part of that short-lived rejection record. They are not used to build a profile of the person who submitted them.

5. Redirect Domains Used by Generated Links

A generated link is displayed on one of a small set of redirect hostnames. These hostnames are registered and operated by the same operator as creepylink.online, and they all show the same destination-review page before anything else happens:

• account.kickaluckyblock.online
• account.sailorpiece.info
• account.noobtowerdefense.org

Their names are deliberately ordinary so the host itself looks unremarkable — the odd-looking part is the path, not the domain. They are not third parties, they are not separate services, and they do not add their own tracking. Seeing one of them in a link does not mean the link was created by someone else. As always, the review page shows the real destination before you continue.

6. Official Domain and Third-Party Services

This policy describes the CreepyLink tool served at creepylink.online. Do not assume similarly named domains are operated by the same service or share the same data practices.

CreepyLink uses the following third-party services:

• Vercel for hosting, static asset delivery, and the redirect endpoint
• Upstash for the temporary key-value storage described in section 4
• Google Analytics for aggregate traffic and page usage measurement
• Microsoft Clarity for aggregate session, interaction, and usability diagnostics
• Umami for aggregate page and traffic measurement, with query strings and URL hashes excluded
• PVUV for aggregate traffic measurement and traffic-quality checks. It is not loaded on this privacy page, redirect previews, or requests carrying redirect credentials.
• Google AdSense & Advertising Partners for displaying relevant contextual advertisements across eligible content pages. Google uses cookies (such as the DoubleClick cookie) to serve ads based on a user's prior visits to this website or other websites on the internet.
• MakeThisBetter for the optional feedback widget. What you type into the feedback form is sent to that service so we can read it; the widget may also set its own cookie to remember that you already gave feedback.
• Google Fonts for typeface delivery

These third-party vendors may process IP address, browser information, cookie identifiers, web beacons or similar pixels, page views, interaction events, ad verification signals, or operational logs. That is different from providing link creators with recipient-level tracking dashboards.

7. Cookies

CreepyLink itself sets no cookies for its core function — generating a link and reviewing a destination works without one. Cookies come from the optional third-party services instead:

To opt out of personalized advertising, visit Google Ads Settings or aboutads.info.

This Privacy Policy page is intentionally served without Google Analytics, Microsoft Clarity, or PVUV tags so visitors can review these disclosures before optional analytics loads elsewhere on the site.

8. Your Rights

Generated link mappings are temporary and expire automatically, so there is usually nothing to delete. If you need to report a malicious link, send the full generated URL and context to the abuse channel so the report can be reviewed. For a privacy question that needs a human answer, use the privacy contact below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@creepylink.online. For abuse reports, use abuse@creepylink.online