Privacy
RSLVR is a private URL resolver. This page describes what the application stores, what it does not, and how request infrastructure fits in.
Redirects
A successful GET to a RSLVR identifier records aggregate counts only:
- a running total of redirects for that identifier
- the UTC timestamp of the most recent counted redirect
- a per-UTC-day integer for that identifier
By default, RSLVR does not persist IP addresses, user agents, cookies, referrers, device identifiers, or location for redirects. There is no per-request visit log. HEAD requests, unknown keys, and inactive keys are not counted.
Optional country analytics
An owner may enable country analytics on a project or a link. When that flag is on, a successful GET also records a daily count keyed by Cloudflare’s two-letter country code for the request. RSLVR does not store raw IP addresses, exact timestamps tied to a country, user agents, or per-click geo events.
Country breakdowns use a privacy threshold: buckets with fewer than 5 redirects in the selected range are grouped as Other.
Request processing
RSLVR runs on Cloudflare. Handling an HTTP request necessarily involves Cloudflare processing network data such as IP addresses. That is request processing by the infrastructure provider, not a dataset RSLVR keeps. See Cloudflare’s privacy policy.
Accounts
Admin accounts store a username, an email address, a role (user or superuser), a password hash, session records, and hashed API tokens. Email is required at signup and can be changed in Settings with the current password. Addresses are stored for account identity; they are not verified until a later verification flow exists, and RSLVR does not send mail. A superuser may inspect account-level metadata for support. They cannot impersonate an account, receive another user’s session, or view password hashes or API token secrets. The browser session cookie is rslvr_session (HTTP-only, 30 days). Public redirects do not require an account and do not set that cookie.
Account deletion
Deleting an account tombstones every link that account owned, then removes the user, their projects, sessions, and API tokens. RSLVR identifiers stay reserved forever and are detached from the deleted user. They never become available to a later account with the same username or email. Redirect counts that already exist on those keys remain as anonymous tombstone history.
Contact
Questions: contact@didac-crst.com.