Security

How we protect your account, your links, and your data.

Whooshly is built on Cloudflare's global edge, and security is a default, not a paid tier. This page describes the practices we actually run.

Data in transit and at rest

All traffic — the app, your short links, hosted vCards, and QR redirects — is served over HTTPS/TLS.
Account passwords and Pro link passwords are stored only as cryptographic hashes, never in plaintext.
We record only coarse, low-detail analytics on a click or scan (an approximate country, a device-type bucket, the referrer, and any UTM parameters). We do not build advertising profiles or track visitors across other sites.

Payments

Payments are processed by Polar, our merchant of record. You enter card details directly with Polar's hosted checkout — we never receive or store your card number. We keep only entitlement flags (whether your one-time purchase is unlocked, whether Pro is active) and a credit ledger.

Abuse prevention

We rate-limit sensitive endpoints, use a challenge (Turnstile) on the anonymous tools, and disable links, vCards, domains, or accounts that violate our Terms of Service.

Responsible disclosure

If you believe you've found a security vulnerability, please email contact@whooshly.co with the details and steps to reproduce. We'll acknowledge your report, investigate promptly, and we won't pursue action against good-faith research that avoids privacy violations, service disruption, or data destruction. Please give us a reasonable window to fix an issue before disclosing it publicly.

GDPR, privacy and data location

Analytics need your consent. Google Analytics and PostHog stay off until you accept, and you can change the choice at any time in Cookie settings.
Minimal click data. Click and scan records hold an approximate country, a device bucket, the referrer, and UTM values, and no visitor IP address.
Where account data lives. Accounts created from the EU, EEA, United Kingdom, or Switzerland keep their core account data in an EU database; all other accounts use a database in eastern North America. Some supporting services, such as caching, queues, analytics, file storage, and email delivery, are not region-specific, so this is not an EU-only processing guarantee.
Your rights. Ask for access, correction, deletion, or a copy of your data at legal@whooshly.co. We aim to answer within one month.
Vendors and transfers. Vendors that handle personal data work under data processing agreements, and transfers outside the EEA and UK rely on Standard Contractual Clauses. We do not sell personal information. The public assistant runs with zero data retention and no prompt training.

For how we collect and handle information, see our Privacy Policy.