Safer Link Sharing Without Overclaiming Privacy
· DexURL Guides · 5 min read
Use the shortest expiry that fits, a password gate for private previews, and one-time access when a destination should open once. None of that makes a link anonymous — DexURL still stores the account, destination and limited redirect metrics needed to run the product.
Controlled links reduce accidental long-lived exposure. Prefer short expiries for client handoffs, password gates for private previews, and one-time access when a destination should only be opened once.
What these controls actually do
Expiry, click limits, one-time access, and password gates all reduce the window in which a link is useful to someone who was not meant to have it. That is a real and worthwhile reduction in accidental exposure — the forwarded email, the screenshot in a group chat, the link pasted into a ticket that outlives the project.
What they do not do is make a link private in the cryptographic sense. A short link is a bearer token: whoever holds it, during the window it works, can open it. Adding a password raises the bar, and sending that password down the same channel as the link lowers it straight back.
If the destination itself must be protected, protect it there. Link controls gate the path to a resource; they cannot gate the resource.
Be precise in your own copy
This matters most when you are the one making promises. DexURL stores account identity, the links and bookmarks you create, limited redirect metrics, and abuse or support records. It does not sell personal data to advertising brokers and does not insert ads before your destination. That is a defensible privacy position, and it is not the same as anonymity.
Telling a client a link is "untraceable" or "fully anonymous" is a claim no link shortener can keep, and it is the kind of claim that becomes a problem exactly when something goes wrong. Say what is true: access is time-limited, gated, and revocable.
Safety notices are not negotiable
Required safety warnings and Trust & Safety blocks stay on for every plan. Paying does not remove them, on purpose — a warning an owner can clear is not a warning to the visitor. If a link looks suspicious, report it from the Trust & Safety page, and stop using destinations you do not control.
The full list of what is stored is in What DexURL logs, and the reporting process is in Reporting abuse.