Privacy policy
This policy explains what data rdyrct collects, why, the legal basis for it, and how you can exercise your rights. Last updated 26 October 2026.
Data controller
The data controller for rdyrct is Andrea Bruno. For any privacy request or question, contact support@mail.rdyrct.com.
Data we collect
We collect your account email address and name, and the organizations, links, domains, and settings you create. For click analytics on your links we store only an approximate country, the referrer host, device type, and a timestamp for each click: we explicitly do not store the IP address of the people who click your links, their precise location, or any data that would allow cross-site tracking. If you report a link, we store the address you report, your reason and note, and the email you choose to give. We do not store your IP address. Separately, if you accept analytics in the cookie banner, we use PostHog to understand how the product itself is used: which features you use and app events such as signing in or creating a link, tied to your account email and name. We turn off autocapture and session recording, so PostHog never records what you type or a replay of your screen. Nothing is sent to PostHog, and no PostHog cookie is set, unless you accept. Until you answer the banner, a few steps you take on the current page (such as viewing it or clicking a button) are held in your browser's memory: accepting sends them, with the time they happened; rejecting or leaving the page discards them. We also use Sentry to receive technical error reports from the app. These reports include technical diagnostic data such as the error, browser, and page path. We remove page query strings before sending them.
Why we process it (legal basis)
Under the GDPR, we process account and organization data to provide the service you sign up for (performance of a contract), send transactional email such as verification codes and team invites (contract), and produce click analytics for your own links (our legitimate interest in offering a useful product). The session cookie is strictly necessary and requires no consent. Product usage analytics through PostHog runs only on your consent, given or withdrawn at any time through the cookie banner. Reopen it with , here or at the foot of any public page. We ask again after six months. We process technical error reports through Sentry for our legitimate interest in keeping the service secure and reliable. Sentry does not set a cookie in rdyrct. We check where links point against Google's list of unsafe sites for our legitimate interest in keeping phishing and malware off the service. When you sign up, reset a password, shorten a link from the home page, build a UTM link, or report a link, Cloudflare Turnstile reads signals from your browser and connection to check that a person, not a script, sent the form. We use it for our legitimate interest in keeping automated sign-ups and abuse off the service.
Sub-processors
We rely on a small number of sub-processors to run the service: Cloudflare (hosting, the D1 database, KV storage, and the Turnstile check on forms), Resend (transactional email), Polar (billing, acting as merchant of record), PostHog, EU region (product usage analytics), Sentry (technical error monitoring), and Google (Web Risk). Google receives the destination address of a link when the link is created or edited, when we check it again each week, and when its traffic jumps, and checks it against Google's list of unsafe sites. It receives nothing about you or the people who click the link. Some may process data outside the EU/EEA; where they do, transfers are covered by the appropriate safeguards, such as the EU Standard Contractual Clauses.
Data retention
We retain account and organization data for as long as your account is active. Click analytics are kept only as long as needed to provide reporting, after which they are deleted or aggregated. Deleting your account (Settings → Delete account) removes your personal data within a reasonable period; billing records may be retained where required by law.
Your rights
You have the right to access, correct, export, or erase your data, to object to or restrict processing, and to withdraw consent where it applies. You can delete your account and its data yourself at any time from Settings, or contact us at support@mail.rdyrct.com. If you are in the EU you also have the right to lodge a complaint with a supervisory authority, in Italy, the Garante per la protezione dei dati personali.