Privacy Policy

Requests to the site and contact messages

You can use Kitly without creating an account. Requests for pages and APIs pass through Cloudflare, which can process network and request metadata such as an IP address, request headers, requested path, status, and time. Worker observability is enabled, but Kitly has not published a verified log-retention period.

If you email Kitly, the email providers involved receive your address and the message content. Do not send files, passwords, payment details, identity documents, or other sensitive material.

Tool pages include email links for problem reports. The link opens your email app and is sent only when you send it. Do not include passwords, file names, file contents, pasted JSON, destination URLs, QR contents, short codes, or other secrets.

File processing

The current image conversion, compression, background removal, and PDF text extraction tools process the selected file in your browser. The selected file is not sent to a Kitly server for processing.

Local file processing does not mean the page makes no network requests. Pages still load from Kitly and Cloudflare. On its first model-based run, the background remover downloads ONNX model and WebAssembly resources from IMG.LY's staticimgly.com service; the source image remains in the browser. If that load fails, the current tool attempts a local heuristic fallback.

Short links and rate limits

The URL shortener sends the destination URL and optional custom slug to Kitly. D1 stores the destination, short code, creation and update timestamps, click count, last-click time, and any disable time and reason.

To enforce creation limits, Kitly derives a SHA-256 hash from the connecting IP address when available, or from limited request headers as a fallback. D1 stores that hash with time windows, request counts, and expiry timestamps; expired rate-limit rows are cleaned up opportunistically. Short links currently have no automatic expiry, and no verified retention schedule is published.

Analytics and advertising status

The current site code includes Google AdSense publisher verification metadata and an ads.txt seller record. It does not include an ad-serving script, ad placements, a production analytics script, or a consent-management interface. Verification metadata and ads.txt do not by themselves serve ads or set advertising cookies.

Before advertising or analytics is activated, Kitly must update this notice and configure the disclosures, choices, and consent controls required for the selected services and regions. Google's current requirements include a Google-certified consent management platform for Google ads served in the EEA, the United Kingdom, and Switzerland, plus applicable privacy choices for covered US states and Brazil.

Questions, reports, and data requests

For privacy questions, short-link abuse reports, or requests concerning information you believe Kitly holds, contact contact@kitlyapp.com. Include the relevant short URL or page and enough context to evaluate the request, but do not send sensitive content.

Kitly may need information to locate a record and verify a request. The site does not currently offer an automated deletion portal or promise a response time.

How Google may use data

If Google advertising or measurement products are active, Google and its partners may use cookies, web beacons, IP addresses, and other identifiers to measure ads, prevent abuse, and personalize advertising where consent and law allow it. Read Google's explanation: How Google uses information from sites or apps that use its services .