Privacy Policy

This policy explains how Ytgo (https://ytgo.me) handles personal data: on the website, on short links and bio pages (on our own domains and on custom domains our members connect), and in the e-mails we send. It takes effect on November 11, 2026.

In short: we only collect what the service needs. We do not store the IP address or the full browser identifier (user agent) of anyone who opens a short link, signs in or visits the site. We use no advertising or analytics trackers and do not sell or rent personal data. Payments are handled by Stripe; we never see your card details.

1. Who is responsible

The controller of your personal data is:

• Company: Bidi Media LLC
• Address: 169 Madison Ave, STE 11534, Unit 292, New York, NY 10016, USA
• Registration number: —
• Country of registration: United States (New York)
• E-mail: [email protected]

You can contact us at this e-mail address about anything in this policy.

2. What we process and when

2.1 Visiting the website

When your browser requests a page, our servers and our network provider Cloudflare necessarily receive your IP address, your browser's user agent and the address you request. We use them only to deliver the page, to keep the service secure (for example to limit how many requests one address may send) and to tell people from bots. We do not write your IP address or user agent to our database.

On some forms (creating a link without an account, sign-up, sign-in, password reset and the abuse report form) we use Cloudflare Turnstile to check that the request comes from a person. Turnstile runs in your browser and Cloudflare evaluates signals from your browser and device; we send Cloudflare the result token and your IP address to verify the check.

2.2 Creating a short link without an account

You can shorten a YouTube link without signing up. We store:

• the YouTube address you entered and what it points to (a video, Short, live stream, playlist or channel);
• public information about it that we fetch from YouTube: the title, the thumbnail address and the channel name. No information about you is sent to YouTube for this;
• a keyed hash (HMAC) of your IP address, never the address itself, to recognise abuse such as mass creation of links;
• a random identifier stored in a cookie in your browser (__Host-anon_id, see the Cookie Policy) and a hash of it next to the link, so that you can add the links you made in this browser to an account you create later. We cannot tell who you are from it.

2.3 Your account

When you sign up we process:

• your e-mail address, and whether you have confirmed it;
• your password, stored only as a one-way hash (scrypt). We cannot read it;
• sessions: a random session token kept in a cookie, with its creation and expiry time. We store no IP address and no user agent with a session;
• short-lived tokens for e-mailed links: sign-in links and password reset tokens are stored only as hashes and expire after 5 minutes and 30 minutes; address verification links are signed and expire after one hour.

You can sign in with your password or with a sign-in link we e-mail to you. When you request a sign-in link, a short-lived cookie ties the link to the browser that requested it (see the Cookie Policy).

You can also sign in or sign up with your Google account: with the "Continue with Google" button, or with Google's own prompt ("One Tap") that may appear on our public pages while you are signed out of Ytgo and signed in to Google. Google then gives us your e-mail address (and confirms that Google has verified it), your name and your profile picture; we do not store Google's access tokens. To show the prompt, your browser loads Google's sign-in script from accounts.google.com, so Google receives your IP address and browser information and uses its own cookies to recognise your Google account. We receive nothing unless you choose an account. If you close the prompt, Google does not show it again for a while.

2.4 Your links, bio page and custom domain

For links you create while signed in we store the same link information as in section 2.2, linked to your account, together with your settings: a custom short name, a changed destination, whether the link is disabled. If you use Pro features we also store your bio page (handle, display name, description, which link's thumbnail is used as the picture, which links are shown) and your custom domain (the hostname, its verification and certificate status). To serve your custom domain we register the hostname with Cloudflare.

Your bio page is public at ytgo.me/@handle while it is published. Anything you write on it can be seen by anyone.

2.5 People who open a short link

When someone opens a short link, we record a click for the link owner's statistics. A click record contains:

• the time;
• the country and city, as determined by Cloudflare from the IP address (we receive only the result, not the address);
• the platform (for example iOS, Android or desktop) and the app the link was opened in (for example Instagram or TikTok), derived from the user agent. The user agent itself is not stored;
• the host name of the referring site, if the browser sends one (for example instagram.com), not the full referring address;
• the browser's preferred language (for example tr);
• how the link was opened (directly, through our intermediate page, in the YouTube app or the browser);
• a daily visitor hash: a keyed hash of the IP address, user agent and date. It changes every day, so it lets us count unique visitors within one day without being able to follow anyone across days, and it is not the IP address.

Requests from bots and link previews (for example when a messaging app builds a preview card) are not stored individually; we only count them per link and day.

When a short link is opened inside an app's built-in browser, we show an intermediate page that asks the phone to open the YouTube app. That page (and bio pages) show the video or channel thumbnail, which your browser loads directly from YouTube's image servers, so Google receives your IP address and browser information for that image. Once you are taken to YouTube, Google's own privacy policy applies; Ytgo has no control over what YouTube collects.

The link owner sees statistics built from these records in their dashboard: free accounts see basic counts, Pro accounts see detailed breakdowns and can download the click records of their links (without any identifier of the visitor). Link owners never see IP addresses or visitor hashes.

2.6 Referral and coupon links

Some creators and partners share links to Ytgo with a referral code (?ref=…) or a coupon code (?coupon=…). When you follow such a link:

• we count the visit for that referral source, once per day, using the same kind of daily-rotating visitor hash described in section 2.5. Bots are not counted;
• we store the referral code in a cookie (ref) for 30 days. If you sign up during that time, we note on your account which referral source you came from. This lets us see how many sign-ups and subscriptions each source brings. Referral sources do not receive your e-mail address or any other personal data from us;
• a coupon code is stored in a cookie (coupon) for 30 days so it can be filled in for you, and is kept with your account until your first checkout.

2.6a Where visits to our website come from

To know which channels bring visitors and members (search engines, social networks, AI assistants, e-mails, other sites, our campaigns), we note where each visit to ytgo.me came from: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), a referral code, the name of the site that linked to us (from the Referer header, without the path), the kind of ad link if there was one (never its click ID), the page you landed on, the in-app browser (for example Instagram), your device type (phone or computer, from the user agent) and the country (from Cloudflare, not stored with the IP address).

• Each visit is counted with the same kind of daily-rotating visitor hash as in section 2.5: once per browser, day and source. We do not store your IP address or user agent. Bots are not counted. These records are kept for 400 days.
• Your first and your latest source are kept in a first-party cookie (src, 90 days). If you sign up, they are copied to your account together with how you signed up (e-mail, sign-in link or Google), your device type, in-app browser and country, so we can see which channels bring members and subscriptions. This stays with your account until you delete it.
• We use this only for our own aggregate statistics. It is never sold, shared with partners or advertisers, or used for advertising or profiling.

2.6b Google Analytics (only with your consent)

If you accept analytics cookies in our cookie banner, we use Google Analytics 4 to see how visitors find and use our website: the pages viewed, how a visit arrived (referring site, campaign tags), device, browser, approximate location and a few actions (sign-up, link created, Pro purchase started or completed, with its amount). Google processes this for us; Google Analytics 4 does not store IP addresses, and its advertising features are off. Without your consent the script is not loaded. Details and the cookies are in our Cookie Policy.

2.7 Pro subscription and payments

Payments are processed by Stripe. You enter your card details on Stripe's checkout page; they never reach our servers. Stripe may also ask for your billing address, for example to calculate tax.

We create a Stripe customer with your e-mail address and our internal account id, and store the billing state Stripe reports back: your Stripe customer and subscription ids, the plan (monthly or yearly), the subscription status, the current billing period, whether it is set to end, any discount or coupon applied, and which of our coupons you have used. Invoices and receipts are kept by Stripe.

An operator can also give a member complimentary Pro without payment; we then store the end date (if any), the reason and which operator granted it.

2.8 Abuse reports

Anyone can report a short link or bio page at ytgo.me/en/report. We store the reported address, the reason, the details you write, the contact e-mail address if you choose to give one, and a keyed hash of your IP address (not the address itself) to limit misuse of the form. We store how and when the report was handled and which operator handled it.

2.9 Moderation and administration

To keep the service safe, our operators can disable links, block destinations (YouTube videos or channels) and block members. We keep a record of these actions: which operator did what, when, to which member, link or destination (including the member's e-mail address as it was at the time), and the reason given.

2.10 E-mails

We send the e-mails the service needs, whether or not you opted in to anything: sign-in links, address verification, password reset, a welcome message, billing notices (a failed payment, a cancelled or ended subscription, complimentary Pro given or about to end) and a daily summary when a video or playlist one of your links points to is no longer on YouTube. To find such links we regularly ask YouTube's public oEmbed service whether the video or playlist still exists; only the video or playlist id is sent, never anything about you or your visitors.

Product news and offers are sent only if you ask for them (an unticked box at sign-up, or the setting on your account page). We record when and where you gave that consent, and every such e-mail has a one-click unsubscribe link that works without signing in; we record when you unsubscribe. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

For every e-mail we keep a record of its kind, when it was queued and sent, and whether delivery failed, as long as your account exists, so that the same notice is never sent twice and so that our operators can answer questions about it. The text of a sent e-mail is deleted from our queue after 30 days. Stripe may send you payment receipts on our behalf. E-mails are sent from our own mail server.

3. Why we process data and on what legal basis

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on these legal bases:

Where we rely on legitimate interests, you can object (see section 8).

We do not use your data for advertising, we do not build advertising profiles and we make no decisions that have legal or similarly significant effects on you based solely on automated processing. Automated checks we do use (Turnstile, bot detection on short links, the list of blocked destinations) only decide whether a request is answered or counted.

4. Cookies

We use only the cookies the service needs, such as the session cookie and the anonymous-link cookie, plus the referral, coupon and source cookies described above. There are no advertising cookies. Google Analytics is loaded only if you accept it in the cookie banner (section 2.6b). The full list is in our Cookie Policy.

5. Who receives your data

We share personal data only with the service providers we need to run Ytgo, who process it on our behalf and under our instructions, and with no one else unless the law requires it.

Our e-mail, including product news, is sent from our own mail server, not through an e-mail marketing service.

To show titles and thumbnails we fetch public metadata from YouTube (Google) on our server; no data about you is included. Your browser loads thumbnails directly from YouTube on our intermediate page and on bio pages (see section 2.5).

We may disclose data to authorities or courts when we are legally required to, and to protect our rights or the safety of others. If Ytgo is sold or merged, the data may pass to the new owner, who must keep honouring this policy.

6. International transfers

Cloudflare, Stripe and Google are based in the United States and process data in several countries, which may be outside your own country, the European Economic Area or Türkiye. Where the GDPR applies, these transfers rely on the providers' certification under the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses in their data processing terms. You can ask us for more information about these safeguards. For transfers from Türkiye, see the information notice in the Turkish version of this policy.

7. How long we keep data

8. Your rights

Depending on the law that applies to you (for example the GDPR), you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict our processing;
• data portability: receive data you gave us in a structured, machine-readable format;
• object to processing based on legitimate interests;
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

You can do much of this yourself: your dashboard shows your links and statistics, Pro members can download click records as CSV, and you can delete your account at any time under Account in the dashboard (this also cancels a running subscription; see the Terms of Service).

For everything else, write to [email protected], preferably from the e-mail address of your account so that we can confirm it is you. We may ask for additional information to verify your identity. We answer within one month; if a request is complex we may extend this as the law allows and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

People who opened a short link can also contact us. Because we store no IP addresses and the visitor hash changes daily, we usually cannot find the click records of a particular person.

9. Security

We use encrypted connections (HTTPS) everywhere, store passwords and sign-in tokens only as hashes, store no IP addresses in our database and encrypt our database backups. Access to the admin area is limited to a small number of operators. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities as the law requires.

10. Children

Ytgo is not directed at children. You may only create an account if you are at least 16 years old, or older where the law of your country sets a higher age. If you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We will update this policy when the service or the law changes. The date at the top of the page shows the latest version. If a change significantly affects how we use your data, we will tell members by e-mail or in the dashboard before it takes effect.

12. Contact

Bidi Media LLC, 169 Madison Ave, STE 11534, Unit 292, New York, NY 10016, USA
E-mail: [email protected]