Privacy Policy
DexURL ("we", "us", or "our") is a privacy-aware link utility operated from Malaysia. DexURL is the controller of the personal data described here. This policy explains what we collect to run accounts, redirects, billing, and abuse response.
1. Information We Collect
Account Data: We collect the account details needed for login (including Google or email sign-in through our auth provider, Clerk), support, and billing. DexURL stores the sign-in identity id and email in our application database.
Link and product data: Destinations, slugs, rules, vault items, link pages, QR settings, custom domains, and similar content you create are stored to operate the product.
Browser extension: If you install the DexURL extension and connect it to your account, it sends DexURL only what an action you take needs: the address and title of the page you save, the address you shorten, and the page address when you open the extension (to show whether it's already in your Vault). If you choose "Clean up my bookmarks" and allow bookmark access, the extension reads your browser's bookmarks once and hands them to your Vault import preview; it never changes your browser's bookmarks. QR codes are made on your device. The extension does not read your browsing history, other tabs, or page content, and it contains no analytics or advertising code. It stores a revocable connection key in your browser; you can disconnect it from the extension or from Settings → Security. Our use of data received from the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
Link health checks: To tell you whether saved Vault links still work, DexURL's servers request each saved address and record the result (status, final address after redirects, and time checked). We don't store the page's content. The site sees a request from DexURL, not from you.
Visitor redirect data: When someone opens a short link or scans a QR code, we add one to a daily count for that link, split by broad device type, country, and referring website. We do not store the visitor's IP address, full browser details, or a cookie. Daily counts are kept for up to 180 days and are deleted with the link or account. We also keep limited redirect metrics needed for product operation and abuse response.
Website visits and landing-page clicks: We use Cloudflare Web Analytics and a first-party counter to measure aggregate visits to our public pages and clicks on landing-page buttons. The counter records the event, country, and device type only, with no IP address, cookie, or identifier. Neither one sets cookies or tracks you across sites. The first-party counter skips browsers that send Do Not Track or Global Privacy Control.
Bio page views and clicks: When someone opens a public Bio page or one of its links, DexURL adds one to a daily count for that page and that link, so the page owner can see views and clicks. We don't store the visitor's IP address, browser details, or a cookie; the IP address is used only for a moment to limit abusive traffic. Browsers that send Do Not Track or Global Privacy Control are not counted. Counts are kept for 30 days on Free and 180 days on Pro, and are deleted with the page.
Support tickets: When you contact support, we keep the ticket you send, our replies, and the email address you gave so we can answer you.
Abuse and safety signals: Abuse reports may include the reported URL, optional reporter comments, and whether a Turnstile bot check succeeded when Turnstile is enabled. DexURL verifies Turnstile tokens with Cloudflare and stores a success/failure result — it does not persist the raw challenge token.
Embeds on Bio pages: A Bio page owner can add players and maps from YouTube, Vimeo, Spotify, SoundCloud, or Google Maps. When a page has one, the embed loads from that provider as it scrolls into view, not on click. The provider then receives the visitor's IP address and browser details and may set its own cookies, under its own privacy policy. DexURL does not receive that data.
Billing: Subscription and payment processing are handled by Stripe. DexURL stores Stripe customer id (when present), plan tier, and billing status needed to sync Pro access. DexURL does not store full card numbers.
2. How We Use Information
Account information is used to manage login, support, subscriptions, and critical notices. Redirect metrics and abuse signals are limited to product operation, analytics rollups, and abuse response. We do not use advertising, marketing, or cross-site tracking cookies.
3. Data Sharing and Sign-In
DexURL does not sell personal data to advertising brokers. We use these service providers to run DexURL, and they process data only to provide their service: Clerk (sign-in and account identity, including Google sign-in), Stripe (payments and billing), and Cloudflare (hosting, delivery, Web Analytics, and Turnstile bot protection). We only use the account data required to authenticate you and operate your workspace.
4. Browser Storage
See the Cookie & Storage Policy for categories of cookies and local/session storage used by the app. DexURL currently does not use advertising, marketing, or cross-site tracking storage, and therefore does not currently present a marketing-cookie consent UI.
5. How Long We Keep Data
Account, link, Bio, and Vault data is kept while your account is active and removed when you delete it (section 6). Daily redirect counts are kept for up to 180 days. Bio page views and clicks are kept for 30 days on Free and 180 days on Pro. Support tickets and abuse reports are kept while needed to handle the case and for up to 24 months afterward; tickets are also deleted if you delete your account. Stripe keeps payment records as the law requires.
6. Account Deletion and Retained Anti-Abuse Records
You can delete a normal DexURL account from Settings → Delete account. Deletion removes or anonymizes workspace data, including links, Bio pages, Vault bookmarks, analytics associations, custom-domain bindings, billing mappings, and the sign-in identity after required cleanup succeeds. Public links stop resolving as soon as deletion begins. Active or trialing subscriptions are canceled without an automatic refund.
DexURL keeps a minimal one-time benefit ledger so a later registration with the same verified identity cannot receive another first-time Pro trial or similar one-time reward. That ledger stores only versioned keyed-HMAC digests of conservatively normalized identifiers. It does not store raw email addresses, raw card or payment identifiers, device IDs, or plain hashes; only keyed digests. We also keep keyed digests of deleted account identifiers so a deleted account cannot be reactivated by mistake. Stripe keeps its own payment records.
Purpose: prevent repeat redemption of one-time signup benefits after account deletion. Retention: digests are kept for the life of the anti-abuse program or until that benefit type is retired. They are not used for advertising or cross-site tracking.
7. Your Rights
You can ask for access to, correction of, or an export of your account data, and you can delete your account, at any time. Export and correction of link, Bio, and Vault content can be done directly from the app. Full account deletion is available from Settings → Delete account and is described in section 6 above. For anything you cannot do yourself in the app, email support@dexurl.com and we will handle it. DexURL does not send marketing email, so there is no marketing list to opt out of.
8. If You Are in the EU or UK
DexURL, operated from Malaysia, is the controller of your personal data. We process it to provide the service you asked for (performing our contract with you), and for security, abuse prevention, and keeping the service running (our legitimate interests). Our providers (Clerk, Stripe, and Cloudflare) may process data in the United States and other countries, under their standard contractual clauses or equivalent safeguards. You can ask us to access, correct, export, or delete your data, or object to how we use it, by contacting us below. You also have the right to complain to your local data protection authority. A data processing agreement is available on request. DexURL is not directed at children under 13.
9. Contact
Privacy questions: support@dexurl.com or the Support Centre at dexurl.com/support.
Contact & Support
support@dexurl.com. Or use the Support Centre.
Operator: DexURL, Malaysia.