A little clarity about your data.

Accounts and workspaces

We store your name, email address, password hash, workspace membership, invitations, links, domains, and integration settings to operate the service. Sign-in uses an essential session cookie. Authentication sessions may include your IP address and browser user agent for account security. API tokens are stored as hashes; webhook signing secrets are encrypted.

Click analytics

Click events contain a link identifier, time, referrer hostname, and approximate browser and device category. Referrer paths and queries, raw user agents, visitor IP addresses, tracking cookies, and browser fingerprints are not stored in click events. Obvious bots and previews are excluded. Repeat visits count separately; counts are estimates and can be lost during a process crash or prolonged outage.

Processed click events are removed once seven days old. Events awaiting processing can remain longer during an outage. Daily report retention is configured by this installation’s operator and shown in the dashboard. Lifetime link counts remain until the owning workspace is deleted. Deleting a link keeps its history in workspace reports.

Integrations and operational records

When a workspace enables webhooks, the selected link or domain changes are sent to its configured receiver. Event payloads and delivery results are retained for 30 days. Link creation retry records last 24 hours. Audit events are kept for one year. Rate-limit records expire after their limiting window and are cleaned by the worker. Infrastructure providers may separately process access logs; the operator controls those settings.

Hosted billing

When this installation offers paid subscriptions, Stripe, the App Store, or Google Play handles payment. RevenueCat verifies store subscriptions using an opaque workspace billing identifier. Shoo stores provider customer, subscription and product identifiers, store, subscription status, and billing dates. Card numbers and payment credentials are not stored by Shoo. Received payment event identifiers and types are retained for 30 days; full payment webhook payloads are not stored.

You can delete your account without waiting for a subscription period to end. App Store and Google Play subscriptions continue until you cancel them in the purchasing store. Personal-workspace Stripe subscriptions are canceled without a prorated refund during deletion, and unfinished checkouts are closed. Provider billing records have their own retention; contact the operator about billing records or refunds.

Abuse reports

Reports contain the short URL, reason, details, and any email address you choose to provide. Reports are available to this installation’s operators. Resolved reports are removed after 90 days; unresolved reports remain until reviewed. Do not submit passwords, payment details, or unrelated personal information.

Exporting and deleting your account

Account settings lets you export your profile, memberships, and links or change your password. You can delete your account after confirming your password or, in the mobile app, confirming deletion after a recent sign-in. Transfer ownership of shared workspaces first. Personal workspaces and their click data are removed. Shared team data remains without your account attribution. Minimal hostname and short-link reservations remain to prevent old links being taken over. Opaque store-purchase ownership records remain to prevent purchases being reassigned. Previously delivered webhooks, payment-provider records, and operator-managed backups have their own retention.

Delete your account or request deletion, including if you no longer have the app installed.

Questions and source code

Contact the person who operates this installation for privacy requests and information about hosting providers and backup retention.