toui.io

Privacy Policy

Last updated: October 24, 2026

toui.io (the "Service") is operated by combolab Co., Ltd., registered in Taiwan (no. 62064963). We value your privacy. This policy explains how we collect, use, and protect your personal data.

1. Data We Collect

When you use the Service, we may collect the following data:

  • Account data -- Your email address and name (obtained through the login process)
  • Usage data -- Short URLs you create and their click statistics (such as country distribution and referrer pages)
  • Click records -- When someone clicks one of your short URLs or views your link-in-bio page, we record the time, the country and city (estimated from the connection), the device and browser information the browser sends (User-Agent), the referring page, and a hash of the IP address. The IP address is hashed one-way with a key only the Service holds before anything is written, so click records never contain the raw IP address.
  • Payment information -- Processed by a third-party payment processor; we do not directly store your credit card information
  • Technical data -- Connection information used for security and service improvement. To prevent abuse, some features (such as creating a short URL without logging in, reporting a link, and registering an AI connector) count requests per IP address. These counters store a keyed hash of the IP address, never the address itself, and are deleted within 7 days; our database's disaster-recovery backups keep them for up to 30 days. Execution logs at our hosting provider, Cloudflare, which include connection information such as the IP address, are deleted automatically within 7 days.
  • AI connector data -- When you connect an AI assistant (such as ChatGPT or Claude) to your account, we store the authorization you granted it. The assistant sends us only what a request needs, such as the URL to shorten or the link to look up. We do not receive your conversation. Section 8 lists every field.
  • Bot data -- If you link the toui LINE or Telegram bot to your account, we store your user ID on that platform so the links you send to the bot are saved to your account.
  • Website analytics -- Pages on toui.io use Google Analytics, and our public pages use the Meta Pixel. These tools record the pages you view, your browser and device, and an approximate location, so we can see how the website is used and which ads lead to sign-ups.

2. How We Use Your Data

  • Providing URL shortening, redirection, and management services
  • Generating click analytics reports
  • Recalculating and correcting click statistics
  • Processing payments and managing subscriptions
  • Sending login verification emails
  • Preventing abuse and maintaining security
  • Measuring how the website is used and how our ads perform

3. Data Security

We use industry-standard encryption and security measures to protect your data, including:

  • All connections use encrypted transport
  • Sensitive information (such as login credentials and API keys) is stored using one-way hashing
  • IP addresses in click records are stored only as a keyed one-way hash, never as the raw address

4. Third-Party Services

The Service uses the following third-party services to provide full functionality:

  • Cloudflare -- Hosting, redirection, and the processing and storage of click records
  • Google -- Account login, and website analytics (Google Analytics)
  • Meta -- Measuring ad performance (Meta Pixel). It loads on public pages; in the dashboard, only on the first page after you sign up.
  • Paddle -- Payment processing (Paddle acts as the Merchant of Record for this Service)
  • Amazon SES -- Login verification email delivery
  • LINE and Telegram -- If you use the toui bot, your messages to it pass through that platform
  • AI assistants you connect -- When you use toui through an assistant such as ChatGPT or Claude, the links, titles and click statistics you ask for are returned to that assistant and are handled under its provider's privacy policy

Each third-party service has its own privacy policy, which we recommend you review.

5. Cookies

The Service uses the following cookies:

  • Necessary -- Keeping you logged in and remembering your language
  • Analytics -- Google Analytics, for measuring how the website is used
  • Advertising measurement -- Meta Pixel, for measuring which ads lead to sign-ups. It loads on public pages; in the dashboard, only on the first page after you sign up.

You can block or delete cookies in your browser settings. You can also opt out of Google Analytics with Google's opt-out browser add-on, and control how Meta uses this data in your Meta ad preferences.

6. Data Retention

  • Account data -- Retained until you delete your account, then permanently deleted 30 days later (you can restore the account before then)
  • Click statistics -- Click statistics aggregated by day and by hour (total clicks, and breakdowns by country, city, referrer, device and browser) are kept long-term and are never deleted because of your plan. How far back you can view them in the dashboard depends on your plan, as listed on the pricing page; upgrading makes earlier statistics visible.
  • Raw click records -- Kept for up to 2 years to recalculate statistics and prevent abuse, then deleted. In long-term storage, the referring page keeps only the address itself; anything after ? or # is dropped. Deleting your account does not remove raw click records individually; they are deleted when the period ends.
  • Short URLs -- Retained as long as your account exists. Anonymous (not logged in) URLs are deleted 30 days after creation

7. Click Data on Your Short URLs

For the click records left by people who click your short URLs, you, the link owner, decide what they are collected for, and the Service processes them on your behalf. We use them only to give you statistics, to prevent abuse, and to keep the Service secure. We do not sell click data or use it for advertising.

8. AI Assistant Connector

You can connect an AI assistant such as ChatGPT or Claude to your toui account through our connector at mcp.toui.io. The connector acts only on your own account and only when the assistant calls one of its tools. This section covers exactly what it receives, returns and keeps.

  • What the assistant sends us -- Only the fields of the tool it calls: a destination URL; a link title; a campaign name and description; UTM tags (utm_source, utm_medium, utm_content, utm_campaign); a social preview title, description and image URL; destination URLs for iOS, Android or specific countries; a short code or link-in-bio handle; a search text, sort order, page number or time window; and link-in-bio titles, descriptions and link labels. No tool asks for your conversation history, messages, files or other context, and we do not receive them.
  • What we send back -- Only data from your own account that the request needs: short links with their destinations, titles, campaigns and QR code links; campaign names; link-in-bio pages with their links; and click and view statistics. Statistics are aggregate counts by day, country, city, referrer, device and browser. They never include individual click records or IP address hashes.
  • What we keep -- Links, campaigns and link-in-bio changes you ask for are saved to your account, the same as changes made in the dashboard. We also keep the authorization you granted (access tokens that expire after one hour, and the grant that renews them) and a daily count of calls per tool for each connection, used to run and improve the connector. We do not keep a log of tool requests or responses beyond that; Cloudflare execution logs are deleted within 7 days (see section 1).
  • Who receives it -- The provider of the assistant you connected (for example OpenAI or Anthropic) receives the tool results and handles them under its own privacy policy. Cloudflare hosts and processes the requests. We do not sell connector data, use it for advertising, or use it to train AI models.
  • How long we keep it -- Access tokens expire after one hour. The grant lasts until you revoke it or delete your account. Daily call counts are deleted after 400 days. Links, campaigns and statistics follow section 6.
  • Your controls -- An assistant can connect only after you sign in to toui and approve it on our consent page, or after you give it an API key you created in the dashboard. Disconnecting in the assistant's settings stops it from using toui; to also delete the grant on our side, email us. You can delete an API key in the dashboard at any time. Deleting your account stops every connection immediately.

9. Your Rights

You may at any time:

  • Log in to the dashboard to view, edit, or delete your short URLs
  • Delete your account and all associated data from your account settings in the dashboard, or contact us to do it for you (except raw click records, which are not deleted per account and are deleted when their period of up to 2 years ends; see section 6)
  • Cancel your paid subscription
  • Disconnect an AI assistant in that assistant's settings, or contact us to revoke its authorization (see section 8)

10. Contact

For any privacy-related questions, please contact: service@toui.io