Privacy Architecture

Privacy Policy & Data Processing

Effective Date: October 9, 2026 · We believe measuring marketing performance shouldn't require invasive surveillance of your end users.

1. Core Philosophy: Privacy-by-Design

TrimMe provides short link routing, dynamic QR codes, and campaign telemetry for marketers, ecommerce operators, and developers. Our core redirect engine is designed specifically to operate without persistent tracking cookies, fingerprinting scripts, or cross-site identity graphs.

2. Data Processed During Link Redirects

When an end user clicks a trimme.co/{slug} link or scans a TrimMe QR code, the redirect engine inspects the incoming HTTP request solely to fulfill routing rules and aggregate high-level metrics:

HTTP Referrer: The origin domain where the short URL was discovered (e.g., twitter.com, google.com).
User-Agent: The client string used to determine high-level device category (Mobile, Desktop, Tablet), Operating System, and Browser.
Country of Origin: Coarse country code inferred from incoming IP routing headers.
Timestamp: Exact UTC time of the redirect event.

Raw IP Address Handling: Raw IP addresses are never stored to disk or written into relational database records. To estimate 24-hour unique visitors, incoming IPs are combined with a daily rotating salt in memory and hashed via SHA-256 before being queued into Redis. Hashes automatically discard after 24 hours.

3. Information Collected from Registered Account Holders

When you create an account on app.trimme.co, we collect:

Account Credentials: Email address and cryptographically hashed password (via bcrypt).
Account Metadata: Account tier (Free, Pro, Business, Enterprise) and registration date.
Created Link Data: Destination URLs, custom vanity slugs, rule conditions, and link titles.

We do not sell, rent, or monetize account data to advertising data brokers or third parties.

4. Data Retention Tiers

Click telemetry rollups are stored based on customer plan tier:

Free Plan

30 Days

Pro Plan

6 Months

Business

12 Months

Enterprise

Custom SLA

5. Third-Party Subprocessors & Analytics

On our public marketing website (trimme.co), we load Google Analytics 4 (G-HK513J81B7) solely to evaluate high-level web traffic and landing page conversions.

Important: Google Analytics is strictly restricted to marketing pages. It is never loaded on short link redirect paths (trimme.co/{slug}) or inside authenticated customer dashboard sessions.

6. Your Data Rights & Account Deletion

You have full control over your stored links and account data. You may export your link history or request permanent account deletion at any time by contacting privacy@trimme.co or via account settings. Account closures purge all associated database records within 30 days.

For questions regarding our privacy architecture, contact: privacy@trimme.co