Privacy Policy

Last updated: 2026-10-19

This policy covers frwrd.to: the short links and bio pages served at frwrd.to and at customers' own domains, the website at frwrd.to/@frwrd.to, the web app at app.frwrd.to, and the API at api.frwrd.to with its MCP server and command-line tool.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Who is responsible for what

Swat.io GmbH is the controller within the meaning of the GDPR for the service: the workspaces, the counting of clicks and page views, and the website. It decides what is collected and why, and it answers your requests itself.

The owner of a workspace is responsible for what its pages say and where its short links lead. A question about a page's content goes to its owner, named by its address or its domain.

For the payment and invoicing data of a paying customer, Swat.io GmbH is the controller, as is its payment provider (section 5.1).

1. Data controller

The controller is Swat.io GmbH, an Austrian company. Full contact details are listed in our Imprint.

For data protection inquiries, including requests to access, correct or delete your data, write to lab@swat.io.

2. Visiting a short link or a page

2.1 What a click or a page view records

When you open a short link, scan its QR code, or view a bio page, we record one row: the time, which link or page, whether it came from a link, a QR code or a page, the kind of device (desktop, mobile or tablet, read from your browser's user-agent, which itself is not kept), and the address of the page you came from (the referrer).

We do not store your IP address, we set no cookie, and we attach no identifier to you, so no visit can be linked to another or to a person. Visits by known bots are not recorded. The owner of the link or page sees these numbers added up.

The full referrer address is kept for 90 days; after that only its domain (for example google.com) remains.

2.2 Bio pages

A bio page loads no analytics script and no third-party script. An image its owner put on the page may load from the server the owner chose, which then sees your request as for any image on the web.

2.3 Server logs and abuse protection

Our servers log each request with the IP address and the requested address, to run and secure the service. These logs stay on the server, are rotated by size (at most 100 MB per service) and are never copied elsewhere. To stop abuse, the number of requests per IP address is counted in memory for a few seconds; it is never written down.

3. The website and the web app

The website and the web app measure their own use with PostHog, in cookieless mode: nothing is stored on your device, your IP address is discarded, and no profile is built about you. Page titles, the referrer and anything after ? in an address are removed before sending, and ids in an address are replaced by placeholders. In the web app it runs only on signed-in pages, never where a key is typed or shown.

Customers' bio pages never carry it (section 2.2).

4. Your workspace

4.1 No account, no password

A workspace needs no name, no e-mail address and no password. Its key is the only credential: we store it only as a hash, so we can never show it to you again. Signing in to the web app sets one session cookie (section 9); rotating the key, or recovering it, ends every session.

4.2 What a workspace holds

The domain you claim and the proof of it (a DNS record we look up), the handle you choose, your pages and links, and your settings. A domain you claim and never prove is released after 31 days.

4.3 Images you upload

On the paid plan you can upload images for your pages, or let us fetch one from an address you give. We re-encode every image and remove its metadata, the location included, before we store it. An image is public at its address, like the page that shows it. An image no page of yours shows for 30 days is deleted, and all of them go when your workspace is deleted.

4.4 The recovery e-mail

If you set one, we store only a fingerprint of the address (a keyed hash), never the address itself. We cannot show it to you and cannot write to you unasked: we use the address only at the moment you type it, to send you a code. To recover a lost key, you type it again. Proving a domain, rotating the key or deleting the workspace removes it.

Codes are stored only as a hash and work for 10 minutes. The record of how many codes went out is deleted after a day.

4.5 Product events

To learn which features are used, the service sends PostHog an event when you do something in your workspace (for example "Link Created"), through any door. An event carries the workspace's public id (w-...), which door it came through, and counts or yes/no values. It never carries a domain, an address, a URL, a page's text or anything that names a person. Server errors are reported the same way, by their type, never their text.

5. Where your data is processed

Our processors, and where they run. Everything is in the European Union.

Amazon Web Services EMEA SARL (AWS). Hosting and database (Amazon Lightsail), backups and uploaded images (Amazon S3) and the recovery e-mail's codes (Amazon SES): all in eu-central-1 (Frankfurt). AWS privacy notice.

PostHog, Inc. (United States, EU Cloud). Product and site analytics and error reports (sections 3 and 4.5). Processing and storage take place exclusively in the EU Cloud (Frankfurt), under a data processing addendum. The company is American, so the Standard Contractual Clauses of the European Commission apply to any access from the USA. PostHog privacy policy.

5.1 Billing: Stripe

Stripe is listed separately because it is not our processor. For the processing of payments, Stripe acts as an independent controller: it decides its own anti-money-laundering checks, fraud detection, PSD2 obligations, and card-scheme rules, and it answers for them itself.

Stripe receives the paying customer's billing and payment data. Card numbers never reach us: payment is taken on Stripe's hosted checkout. We store only the subscription status and the billing period. Stripe privacy policy.

6. How long we keep it

• Clicks and page views: as long as their link exists, and at most 720 days. The full referrer address: 90 days, then only its domain.
• Your workspace: until you delete it. Deleting takes your pages offline at once and deletes them, with your settings, after 7 days. Short links keep redirecting, because printed codes point at them.
• Uploaded images: until no page shows one for 30 days, until you delete it, or until your workspace's pages are deleted; a deleted image's last copy goes after 35 days.
• Backups: up to 35 days (70 for an overwritten copy), used only to restore the service after a failure.
• Sessions: 7 days, or until you sign out or the key changes.
• Recovery e-mail: until you remove it, rotate the key, prove a domain or delete the workspace. Codes: 10 minutes; the count of codes sent: one day.
• Server logs: rotated by size, at most 100 MB per service.
• Analytics and product events: in PostHog's EU Cloud; a workspace's events are deleted on request.
• Billing records (subscription status, billing period): for as long as the workspace is billed, and afterwards for the seven years Austrian accounting law requires (section 212 UGB, section 132 BAO).

7. Automated decisions

No automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR takes place.

8. Your rights

You have the following rights under the GDPR:

• Right of access (Art. 15): confirmation of whether we process data about you, and a copy of it.
• Right to rectification (Art. 16): correction of inaccurate data.
• Right to erasure (Art. 17): deletion, subject to legal retention requirements.
• Right to restriction (Art. 18): limitation of processing.
• Right to data portability (Art. 20): your data in a machine-readable format. Your pages are Markdown, and the API returns every link and number.
• Right to object (Art. 21): to processing based on legitimate interest.
• Right to lodge a complaint (Art. 77) with a supervisory authority. The competent authority for Swat.io is the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Write to lab@swat.io; we respond within 30 days as required by Art. 12(3) GDPR. Because a workspace has no name or e-mail address, we may ask you to prove it is yours, with its key or its domain.

9. Cookies

Short links, bio pages and the website use none. No analytics cookie, no advertising cookie, no consent banner needed under Art. 5(3) of the ePrivacy Directive.

The web app uses up to three, all strictly necessary and none for tracking: the session cookie that keeps you signed in (7 days), a cookie that remembers the interface language you picked (one year), and a cookie that remembers you dismissed the hint to prove your domain (one week).

10. Security

Everything is encrypted in transit with TLS, and the server's disk and the backups are encrypted at rest. Workspace keys, session ids and codes are kept only as hashes, and the recovery e-mail only as a keyed hash. Every query that reads a workspace's data is scoped to that workspace.

11. Changes

We may update this policy. The date at the top reflects the most recent revision; material changes are announced on the website.

12. Contact

Questions, requests, and complaints about personal data: lab@swat.io.

Company details: swat.io/en/imprint.