What Doorbell collects, and what it deliberately does not

If you have an account

Signing in uses Google or a magic link sent to your email address; there are no passwords. We store your email address, the name Google provides if you use it, the time you signed in, and a personal workspace that holds your Links. Session cookies keep you signed in on this site only.

Everything you create, from destinations and rules to pages and version history, is stored so the service can work and so you can restore earlier versions. An audit trail of changes is kept for your own workspace.

You can publish a read-only report of one Link's numbers at an unlisted address. It carries counts only — no destinations, no settings, nothing about your account — and anyone holding that address can open it until you revoke it.

If you open a Link

When someone opens a short URL or scans a QR code, Doorbell records one event for the request. That event contains:

• which Link and version was opened, which destination or page was served, and which routing rule decided it;
• the channel (short link or QR code) and the outcome (redirect, page, expired, paused, warning shown and so on);
• a visitor key: a hash of the visitor's IP address and browser user agent, computed with a secret that changes every day. The address and user agent themselves are never stored, and the key cannot be reversed. Because the secret rotates, the same person produces a different key each day;
• country, region and city, taken from the hosting platform's request headers. No coordinates are recorded and location never goes below city;
• device type (mobile, desktop, tablet), operating system family and browser family;
• the referring domain when the browser sends one, folded into a source category (direct, QR, search, WhatsApp, and so on), and the utm_medium and utm_campaign values carried by the short URL itself, when whoever shared it added them;
• a bot class: known crawlers, link-preview services and security scanners are recorded as such and excluded from all counts;
• response time and status code, for operating the service.

Opening a plain redirect sets no cookie and runs no script in the visitor's browser. Doorbell has no analytics cookie at all. The only cookies a visitor can receive are two short-lived functional ones: one after entering a Link's password, which lasts 12 hours, and one after choosing to continue past a safety warning, which lasts an hour. Both are set by the server, cannot be read by scripts, are tied to that one Link and the settings it had at the time — changing the Link cancels them — and expire on their own.

Images you upload

Cover images, pictures inside a page and QR logos are held in a public store: the file's address is an ordinary URL and anyone who has it can fetch the image without signing in, exactly like the page it appears on. Beside the file we keep its real type, size in bytes, pixel dimensions, the workspace it belongs to, who uploaded it and when. Every upload is checked on the server before it counts, and anything that is not a PNG, JPEG, WebP or GIF within the size and dimension limits is deleted again; an upload that never finishes is deleted once it is a day old. Deleting an image removes both the file and its record.

How long data is kept

• Raw events are stored in monthly partitions and deleted after 90 days (whole months are dropped, so in practice 90 to 120 days).
• Hourly and daily totals and breakdowns (opens by country, device, source and so on) hold no visitor keys and are kept for as long as the account exists. A limit of 13 months on the hourly figures is intended and is not yet in force.
• Account data is kept while the account exists. Deleting a Link retires its short address for 90 days, so nothing already printed can quietly start pointing somewhere else; after that the address may be issued again. Renaming a Link keeps the old address resolving to it for good.

Who else sees it

Doorbell does not sell data, share it with advertisers or use it to build profiles. Data is processed by the providers that run the service: Supabase (database, file storage, authentication and the messages that carry sign-in links), Vercel (hosting, and the request headers that give country, region and city) and Upstash (a short-lived cache and event queue). Two more are used only once the operator has configured them: destination URLs, and only URLs, are sent to Google Safe Browsing to be checked, and notification emails are delivered by Resend — your address is read at the moment of sending and is never stored on the notification itself.

Abuse reports

Anyone can report a Link from its warning page, or from the page shown when a Link has expired, been paused or been blocked. A report stores the Link it is about, the reason chosen, anything typed into the optional description, whether the reporter arrived by short link or by QR scan, and the reporter's hashed visitor key, which exists so the form can be rate-limited. No name, address or contact detail is asked for or kept. Reports are reviewed by the operator; Links found to be phishing, malware or otherwise abusive are blocked.

Your rights

Account holders can delete any Link from the dashboard, read everything in their workspace back through the same API the dashboard uses, and ask for the account and all of its contents to be removed; there is no one-click export yet. Because visitor data holds no identifier that can be traced back to a person, individual visitor requests cannot be matched to events; that is by design.

Changes to this notice

Material changes are announced on the changelog with the date they take effect. The facts above are kept in step with the code that implements them.