Data handling
Minimal by design.
Shady Link does not add click-tracking scripts or store per-click redirect records. Cloudflare processes requests and provides aggregate traffic and Worker metrics. The deployment configuration disables persistent Workers Logs and does not configure Logpush; Cloudflare documents detailed HTTP request-log retention as disabled by default, although account-level logging features can be configured independently of this code. Cloudflare currently adds Network Error Logging headers that ask supporting browsers to report failed-request URLs and network conditions to Cloudflare; Cloudflare states that this pipeline does not log client IP addresses or share reports with third parties. An operator can deliberately start a live troubleshooting session that exposes request URLs during the session; Cloudflare states that its live-log feature does not store them.
The application does not write raw IP addresses to D1, KV, or custom logs. Cloudflare receives and processes client IP addresses to deliver traffic and provide rate limiting and Turnstile. The application retains an HMAC-based daily IP fingerprint only for the current and preceding UTC date.
Operational link records include the destination, short code, status and timestamps, a hash of the management capability, and reputation state. Active D1 and KV records are scheduled for deletion 30 days after expiration or revocation, although an unresolved redirect synchronization failure can delay deletion. Daily counters use the same two-UTC-date window. Reputation events, including the short code, destination hash, result, threat types, and timestamp, and privacy-minimized service error categories are scheduled for deletion after seven days. Abuse reports and administrative audit records are scheduled for deletion after 30 days. Hourly cleanup can add about one hour to these periods.
Cloudflare D1 Time Travel is always enabled and can preserve recoverable database history after application deletion for seven days on Workers Free or 30 days on Workers Paid. Each submitted destination URL is sent in full to the Google Web Risk Lookup API for reputation checking.
Persistent Workers logs and traces are disabled for all service Workers. Aggregate Cloudflare platform metrics remain available. Custom error records stored by the application contain only component, operation, category, and timestamp.
Distributed-state notice: Creation, expiration changes, revocation, and reputation blocking can take 60 seconds or more to become visible in every region. A revocation accepted by the control service may therefore continue redirecting briefly.