Privacy

Last updated: 12 November 2026

minik.cc shows link owners how their links are opened. This page explains what we store about people who click links, visitors to sites that use the minik code, and account holders, why we store it and for how long.

Data controller

Space Island Ltd, a company registered in England and Wales (company no. 17270833). Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We process the data. For visitors to a site that uses the minik code, the data controller is the person or company that runs that site (see below).

People who click a link

When you click a minik.cc link, we store the following for each visit:

The time of the visit.
Your approximate location, worked out from your IP address: country, region, city, postcode and approximate coordinates. We look this up in the DB-IP database, which runs on our own server. It is an estimate of the area, not your street address.
Your network, worked out from your IP address: the name and number (ASN) of your internet provider or organisation.
Your device, operating system, browser, app and, where available, phone model.
Your browser's first two language preferences.
Only the domain name of the page you came from (the Referer).
UTM campaign parameters, if the link or the target has them.
If the same person opened another link belonging to the same link owner in the previous 24 hours, the ID of that link only ("Opened before"). Visits are never connected with other owners' links.
The raw details your browser sends: the User-Agent, client hints (phone model and system version only), the Sec-Fetch headers that say how the visit started, and the language header. We work out the device and language details above from these.
A short visitor digest: a pseudonymous code calculated from your IP address and User-Agent with a random salt that is replaced every day. Each salt is deleted after 32 days, after which the digest can no longer be traced back to an address. It lets us count the same person once: if you come back within 32 days, we can tell it is the same person, but we do not connect you with visits older than 32 days.

Your full IP address is never stored. The redirect sets no cookie and runs no JavaScript. There is no page in between: you go straight to the target. If the link leads to a site that uses the minik code, we connect what you do on that site with this click (see below).

If link owners open one of their own minik.cc links while signed in to minik.cc, that visit is not counted as a visitor in the statistics; it is stored with the same details and marked separately as their own visit. To tell, we read the session cookie the owner already has; no new cookie is set.

The raw User-Agent, client hints, language header and visitor digest are deleted after 32 days. The rest of the visit is kept until the link owner's account is deleted.

For links in the accounts Space Island uses for its own products, we store less: only the country from the location, only the type of device, and the time to the hour. City, network, language, raw browser details and the visitor digest are never stored for these links.

The link owner sees these visits as aggregate statistics and as individual visit rows (time, location, network, device, source, language), and with minik Plus can download them. The raw details and the visitor digest are never shown to the link owner. The public statistics page shows aggregate numbers only; individual visits, cities and networks are not shared there. The link owner can change that page's visibility in their account.

Legal basis: the link owner's legitimate interest in measuring how their link is used.

Visitors to sites that use the minik code

A minik user can add the minik site code to their own website. On a site with this code, we process the following on the site owner's behalf:

The address of the page you open (keeping only the UTM campaign fields from the query string) and where you came to the site from (domain name only).
The same details we listed above for people who click a link: the time, approximate location and network worked out from the IP address, device, system, browser, language, raw browser details and the visitor digest.
How long the page stays open on screen.
Which links and buttons on the site you click: their short label and the address they lead to (without the query string). We do not record labels that look like an email address or a long number. For email and phone links we keep only the type of link. We never read what you type into a form.
Which of the goals set by the site owner (for example, signing up or making a purchase) you completed during that visit. If the site owner attached an amount and currency to a goal (for example, the value of a purchase), we store that too, and the site owner sees it as revenue per link.
If you came to the site through one of the site owner's minik links, which link it was. We find this by looking for a visit with the same visitor digest that arrives right after the click. We never connect your visit with other accounts' links or sites.

By default, the site code sets no cookies and does not use localStorage or sessionStorage in your browser. Your full IP address is not stored. The only exception is the 32-day tracking described below, and it works only after the site's own consent tool has given consent.

32-day tracking (with your consent). The "32-day tracking" setting is on by default for every site; the site owner can turn it off (which deletes all of that site's visitor IDs). Even when it is on, the site code writes nothing unless you give consent in the site's own consent tool and the site calls minik.consent(true). If you consent, the site code writes two things to your browser's localStorage, on the site's own domain: a random visitor ID and the time you were first seen. This entry lasts 32 days. Its purpose is to connect a goal or purchase you complete on the site within 32 days with the minik link that brought you there. The ID does not reveal who you are; it recognises only this browser, and only on this site. It is never combined across sites or across accounts. On the server, the ID is kept for 32 days at most and then deleted. If you arrived through more than one link, the goal is credited to the most recent one; the first link is also recorded. Click IDs in your address are not read.

Consent is given through the site's own consent tool; without it, the site code never writes this entry. If you withdraw consent, the site code deletes the entry from your browser. You can also remove it by clearing the site's data in your browser. Some browsers, such as Safari, may delete the entry on their own if you do not open the site for about 7 days, which breaks the 32-day connection. The site owner is responsible for obtaining the consent and giving the information this setting requires.

If Global Privacy Control (GPC) is turned on in your browser, the site code sends nothing and stores nothing, and you are not counted on sites that use the minik code. GPC is a setting found in some browsers and privacy extensions. The site code also stores nothing if there is no consent or if the site has turned the setting off. If you came to the site through a minik link, your click on that link is still stored as described above.

The controller of this data is the person or company that runs the site. We process it on their behalf and on their instructions, as a data processor. The site's own privacy notice explains why the data is processed and how you can exercise your rights. If you write to us with a request, we pass it on to the site owner and help them deal with it.

The raw browser details, the visitor digest and (if you gave consent) the random visitor ID are deleted from the server after 32 days. The entry in your browser lasts 32 days. Everything else is kept until the site owner deletes the site or their account, and is then deleted straight away.

People who create a link without an account

You can create one link from each browser without an account. That link's visit count and chart are public: anyone who adds + to the end of the short address can see them. Your browser remembers in its own localStorage that it has created a link; a second link needs an account. No cookie is used for this. Links created earlier without an account keep working and can still be added to an account.

A link created without an account is stored together with an ownership key. The key is kept in localStorage only in the browser that created the link; the server keeps only a digest of it. This is not a cookie, and nothing is placed on the devices of people who click. By verifying your email address or signing in with Google, you can add this browser's links to your account. If a link without an account was created as public, its visit count and chart stay public after you add it to your account; you can hide them from your account. The visibility of links created before this does not change.

minik.cc's own pages

To improve minik.cc, we count which pages are opened on our own site and in the panel, and which buttons and links are pressed: the page, the label of the button pressed, where the person came from (the previous site's name and campaign tag), the country and the type of device. This counting sets no cookie, stores nothing in your browser and does not store your full IP address; to group visits within the same day, it uses a code that is specific to that day and changes the next day. If you are signed in, the record is kept with your account. Nothing you type is recorded. If Global Privacy Control is turned on in your browser, nothing is sent. Records are deleted after 400 days.

Legal basis: our legitimate interest in improving the service.

Which language you see

minik.cc is in English and Turkish. For each page we pick the language in this order: a language you picked, your account's language, and otherwise your browser's language preferences and the country worked out from your IP address. The country is looked up on our own server and is not stored for this. If you pick a language, a language cookie (minik_lang) remembers your choice for a year; it is used for nothing else, never for tracking. Apart from this cookie and the ones listed under account holders, minik.cc sets no cookies.

Our emails are written in your account's language. Their links, such as the one to stop emails, carry that language, so the page opens in it.

Legal basis: our legitimate interest in showing the service in a language you understand.

Account holders

Your email address, for signing in and for account emails.
A session cookie, set only when you sign in (HttpOnly). It is also read to recognise you when you open your own minik.cc links.
A sign-in cookie, set only while you sign in with an outside account such as Google. It lasts 10 minutes at most.
Your account's language: the one you picked or, if you never picked one, the one you signed up in. Pages and our emails to you use it.
Your links, notes and tags.
If you use Sites, your site's address and your goals.
Payment details are held by Stripe. Your card details never reach us; we see only your plan and payment status.
If someone invited you through minik's affiliate program, which affiliate it was. For your first 12 months that affiliate sees the day, plan and amount of each of your payments and their share of it, never your name or email.
If you join the affiliate program, the name you show on your invite page, how many times it was opened, the people you referred and your shares. We keep paid shares as payment records.

Legal basis: our contract with you, so that we can provide the service.

AI assistants (MCP)

If you connect an AI assistant such as ChatGPT or Claude through MCP, the assistant works in your account on your behalf, with the permission you give it. When you connect it, you see on a screen which permissions you are giving, and you approve them. With these permissions, the assistant can read and change your links, channels, events, sites and goals, domains, settings and plan.

The assistant's provider (for example, OpenAI or Anthropic) receives our answer to every task the assistant asks for. That means your links' addresses, titles, notes and tags, aggregate visit counts and breakdowns (such as by country, city, source or device), your sites and goals, your account settings and your plan status. Individual visits, visitors' IP addresses and raw browser details are never given to the assistant.
There, the provider's own privacy policy and terms of use apply, and the provider decides how your conversation is stored and used. This is outside our control.
We do not see or store the content of your conversation. Only the tasks the assistant carries out reach us (for example, "create a link to this address"). Links, notes, events and other data the assistant creates or changes stay in your account just like changes you make yourself, and follow the retention periods on this page. We do not keep a separate record of these tasks; if a tool fails, only a short error code is written to our server logs.
If you want, the assistant can ask us to download an image or logo from an address; in that case we open that address.
For your plan, the assistant can only get a Stripe payment or billing address, ask for your plan to end at the end of the billing period, or undo that request. Neither the assistant nor we see your card; you confirm the payment yourself on Stripe.
Each connection is kept in your account as an API key. You can revoke it at any time in Settings → API keys; after that, the assistant can no longer reach your account. To have data the assistant already passed to its provider deleted, you need to contact the provider.

Legal basis: our contract with you, so that we can provide the service, and your consent.

Checking link targets

When a link is created or changed, and once a day after that, its target addresses (the main address and any device or country targets) are checked for malware and phishing with Google Web Risk. Only the target address is sent to Google; nothing about visitors is sent.

People who report abuse

We store the short link, the reason and the description you enter in the report form. Giving your email address is optional; if you do, we use it only to look into the report and, if needed, to get back to you.

Legal basis: our legitimate interest in preventing abuse of the service.

Chrome extension

The minik Chrome extension talks only to your own account. When you connect it, an API key is created in your account; the key is kept in the extension in your browser and can be revoked in Settings → API keys.

When you open the popup, right-click, or type m https://… in the address bar, that page's address and title are sent to minik.cc, to find its link if there is one or to create one if there is not.
If the counter on the icon is on, the addresses you browse are not sent to our server. The extension downloads your own list of links and does the comparison in your browser; it only asks for the count of your own link when one matches.
If rb.gy reading is on, the numbers on any rb.gy/CODE+ page you open are sent to minik.cc.
When you open the popup, the extension looks for old short links (rb.gy, Bitly…) on that tab. The search runs in your browser, and the page's content is not sent. If you connect an old link, only that old link and its target are sent to minik.cc. "Find target" opens the old link once from your browser; the old service may count this as a click.
In Google Docs, "Replace in document" asks Google only for permission to edit documents. The key Google gives stays in your browser session and is never sent to minik.cc; the document is changed directly with Google.
If "Channel on paste" is on, text you paste on the chat and social sites you have chosen is compared with your own list of links in your browser. If it is one of your own minik links, a channel is added to the end; the text is not sent anywhere.
Settings are kept in Chrome's sync storage; the list of links and the key stay in your browser. The extension sends data nowhere else and contains no advertising or analytics tools.

Companies we work with

Hetzner: Servers. Data is stored in Germany.
Cloudflare: CDN and proxy. Requests pass through Cloudflare first.
Amazon Web Services: Sends our emails with Amazon SES. Emails are sent from the EU, from the Stockholm region.
Stripe: Takes payments.
Google: Web Risk checks link targets against lists of harmful addresses; only the target address is sent. Google Drive holds our encrypted backups; we hold the key that decrypts them.
DB-IP: Location database. It runs on our own server; no data is sent to DB-IP.

We do not sell data or use it for advertising.

How long we keep data

The raw User-Agent, client hints, language header and visitor digest of each visit, and the random ID of visitors who gave consent (kept on the server only as a digest specific to that site), are deleted after 32 days. The 32-day entry in a visitor's browser lasts 32 days at most. The rest of the visit data is kept until the account is deleted. If you permanently delete a link, its visits are deleted at once. You can delete your account in Settings, and your links and their visits are deleted with it. Links created without an account that were never added to one, and their visits, are kept separately and are not deleted when an account is deleted. Deleted data stays in our backups for no more than 30 more days and is then deleted from them too.

Your rights

Under the GDPR and the UK GDPR, you have the right to access, correct, delete and transfer your data, and to object to its processing. You can complain to the data protection authority in the country where you live or, in the UK, to the ICO.

If you clicked a link, we usually cannot tell which visit was yours, because we do not store your IP address. If you write to us, we will still do what we can.

If you visited a site that uses the minik code, send your request to that site's owner. If you write to us, we pass your request on to them and help them deal with it.

Contact

For questions about your account, the service or privacy, write to [email protected]. You can report abused links with the report form.

This page is written in English and Turkish; if the two differ, the English version applies.