The information we actually need.
We keep the information needed to provide short links, basic click counts and a responsibly managed service. We do not build profiles of people who follow links.
Who operates swurl
Steve Contact: steve@tulips.org.uk.
Accounts and account activity
We hold your verified email address, account memberships, public username, stated purpose, links, folders and tags. We record who creates, edits, moderates or hands over an account or link. A generated public username hides your chosen identity from the URL; it does not make your use anonymous to the service.
When someone follows a link
We record the link identifier and time of a counted visit. No analytics cookie, IP address, referrer or browser profile is stored in these click records. Repeat clicks count. Recognisable bots and preview requests are filtered, but some automation will be counted and some genuine visits may be missed.
Retention
| Information | Retention |
|---|---|
| Exact click times | 180 days |
| Daily morning, afternoon and evening counts | 24 months |
| Monthly totals | While the account remains active |
| Statistics after account closure | Erased after the 30-day reopening period |
| Sign-in security events | 180 days |
| Anonymous service-wide monthly click totals | Five years; no account identifiers |
| Report contact details | 180 days after the report is resolved |
| Sign-in tokens | 15 minutes; invitation tokens up to three days |
| Rate-limit identifiers | Short-lived keyed hashes, removed after their limit window expires by daily maintenance |
| Queued email contents | Deleted on delivery; failed messages removed within seven days |
After handover, the dated action history uses internal identifiers. Former users’ email addresses are removed after 90 days without an account membership or sign-in, unless they still serve on the moderation team. Closed account access ends after 30 days; surviving link mappings remain for a further 12 months. Reserved codes and minimal moderation records prevent reassignment and preserve decision history.
Security and service providers
We use 20i hosting and the configured email service. The hosting provider may keep server access logs, including IP addresses, independently of our click statistics. Our site uses necessary session cookies and short-lived rate limits for account security.
Backups are intended to use encrypted, separate storage with a 30-day expiry. Deletions must be reapplied after a restore. Export your data if you need a longer personal record. Advertising and donation providers have not yet been enabled; their details and any required choices will be added before integration.
Your choices and requests
You can export your account’s data, correct link details, remove links or close your account in settings. Contact the operator for requests about your personal information or to question an ownership change. Provider details, processing grounds and the final rights wording require operator review before this notice is published for live use.