Privacy Policy
2to.uk · Last updated
2to.uk is a link-shortening tool, built and run by Lightmorphic. This policy explains what it does and doesn't do with your data, in plain language.
The short version
- No tracking cookies, ever, and no cookies at all unless you log in. The only cookies we ever set are a first-party session cookie that keeps you signed in to your account and a small companion cookie whose only job is to block forged requests - never shared, never sent to anyone else, and never used to track you.
- No tracking pixels, no analytics scripts, no ad networks anywhere on this site or in the redirect path.
- We don't sell or share your data. We have nothing to sell it to anyone for - there's no ad business here.
What we collect
If you create a customer account, we store:
- Your username, email address, and a securely hashed version of your password (we never store or can see your actual password).
- The short links you create: the destination URL, the slug, and a running count of how many times it's been visited. We don't log who visited or when, beyond that count.
- If you turn on two-factor authentication, the secret used to check your codes, and hashed versions of your one-time recovery codes.
If you use the "Try it yourself" tool on the homepage without an account, the link you create works for real but is automatically deleted 30 minutes after creation. Nothing about it is kept afterward.
Cookies
Browsing 2to.uk - including using the "Try it yourself" tool - sets no cookies at all. When you log in to an account we set a first-party session cookie so you stay signed in, plus a small companion cookie whose only job is to stop forged requests being made in your name. The session cookie is marked HttpOnly (JavaScript can't read it) and only ever sent back to 2to.uk itself. Both carry opaque ids and nothing else - no profile, no tracking, no advertising identifiers - and both are cleared when you log out. The full list is on the cookies page.
What we don't collect
We don't use tracking cookies, browser fingerprinting, analytics scripts, or third-party ad tech anywhere on 2to.uk, whether you have an account or not. We don't log IP addresses against your account or your links beyond what's briefly needed to apply basic abuse/rate-limit protections in real time.
Malicious link checking
Before a link is created, its destination is checked against a public malicious-URL feed (abuse.ch's URLhaus, via the urlhaus-filter project) and against a manually-maintained blocklist, to stop the service being used for phishing or malware distribution. This check only looks at the destination URL itself - it doesn't send any of your account information anywhere.
How long we keep it
For as long as your account exists. Deleting your account is immediate and permanent: it releases every short link you created back into the pool and removes your account data. There's no recovery period and no way to undo it, which is stated plainly at the point of deletion, not buried in fine print.
Who else sees it
Nobody. 2to.uk doesn't share, sell, or rent customer data to any third party. The service is created and run by Lightmorphic, the company behind it - Lightmorphic doesn't receive customer data as part of running it.
Your choices
- You can view and change your username, email, and password at any time from your account page.
- You can delete any short link, or your whole account, at any time - both take effect immediately.
- You can enable or disable two-factor authentication whenever you like.
Contact
Questions about this policy, or a request relating to your data, can go to privacy@lightmorphic.com.