Every click,
on the record.

FAQ

The questions people actually ask

Do I need an account?

No, and you could not make one if you wanted to — there is no account system yet. You paste a URL, you get a short link, and that link keeps working. The trade-off is in the next answer.

Where do I see the analytics for a link I create?

Through the API, if you hold a token — and today only the operator does. Every field is recorded against your link from its first click, and the v1 API reads the aggregates back, per link or across an account. What does not exist yet is a way for you to get a credential, because there are no accounts. So if you need a dashboard you can log into this week, we are still not the right tool; say so on the waitlist form and we will let you know when accounts land.

Can I put my own domain in front of it?

Not yet. Every link is gecis.in plus a seven-character slug. Custom domains are on the roadmap and we have not put a date on them, so treat it as unavailable when you are deciding.

Is there an API?

Yes, as of this release. A versioned REST surface under /api/v1 covers creating links one at a time or in bulk, listing, updating and deleting them, analytics per link and across an account, token management, and QR codes as PNG or SVG. It is documented at /docs/api and machine-readable at /api/v1/openapi.json, and that document is generated from the same schemas the handlers validate with, so the two cannot drift apart. Authentication is one bearer token. The honest caveat: there is no signup, so the only token in existence is the operator’s. Holding one is not a way around anything either — the API runs the same target validation, the same private-range refusal and the same reserved-slug list as the public form. The one older public endpoint, /api/stats/:slug, is still there and still answers only for the six demo links.

What exactly happens to my visitors' IP addresses?

The raw address goes into the click row, so a per-IP breakdown is possible, and it is separately hashed with a salt that rotates every day. A nightly retention job clears the raw address out of any click row older than 90 days, and because click_events is partitioned by month, the partition holding those rows is later dropped whole — which releases the storage as well, up to a month after the clearing. What survives is the hash, and a hash does not turn back into an address.

How do you count unique visitors without cookies?

The IP hash and a hash of the User-Agent are combined into a visitor key. Five clicks from one person on one day are five clicks and one visitor. The salt rotates at midnight, so the same person tomorrow is a different key — which is the point. It counts a day, it does not follow a person.

What stops someone shortening a phishing link?

Cloudflare Turnstile on the create endpoint; 10 links an hour and 50 a day per IP address; a hard refusal of any target that resolves to a private or reserved range, including a hostname that resolves there later; and noindex plus nofollow on every redirect, so we cannot be used to launder SEO. Whatever still gets through, report it and we look within 48 hours.

Where does this actually run?

On our own hardware in Germany, with Cloudflare in front of it. Postgres 17, no third-party analytics vendor in the request path, and no data sold or shared for advertising.

What will it cost?

Nothing today. There is no payment integration on this site. When the plans open, the waitlist hears first and gets the launch price.

How fast is the redirect?

Two numbers, and they measure different things. The server’s own share, timed from inside our cluster against the service address so the internet is out of the picture: median 2.3 ms and 3.0 ms at the 90th percentile, pooled over 60 requests across 3 separate runs to a warm process with nothing else running. The full spread ran from 1.8 ms to 25.9 ms — occasional outliers in the tens of milliseconds are real, a short run simply never samples one, and we would rather publish the ugly maximum than a tidy one we cannot reproduce. That is the part we control and the only figure we will quote as ours. End to end is another matter — from a client in Turkey, through Cloudflare, the median over 10 requests was 282 ms, and almost all of that is the round trip to you, which no shortener can shrink. Both were measured on the same day with scripts/measure-redirect-latency.sh, which is in the repository so you can run it yourself.

Are the numbers on this page real clicks?

The clicks are not; everything else is. The panel is filled from a demo dataset we seeded across 90 days, marked in the database with a visitor key that starts with demo: — because six links with three clicks between them tell you nothing about what the product does at volume. The schema, the SQL, the aggregation and the rendering are the shipped ones, running per request against the real table. Real clicks on those links land in the same table and are counted alongside. When accounts ship, your own links will show your own clicks and none of this.

Do I get a QR code for a link?

Yes, from the API: PNG or SVG, at a size and error-correction level you choose. The image encodes the short link with qr=1 on the end, which is what makes a scan record itself as a scan rather than as a click. The redirect strips that marker again before sending the visitor on, so the destination never sees it.