What SendURL Records for Every Click (and What It Doesn't)

For every click, SendURL records the time, the country, the device, browser and operating system, the referrer, the IP address and the full user agent, plus whether the click came from a QR code. It doesn't record the city, or anything that names the person. Every plan records the same fields.

The redirect happens first and the click is recorded right after, so visitors never wait for analytics (how URL shorteners work follows one tap from start to finish). Below is each field, where it comes from, and its limits. The product page is per-link analytics; the question of identifying visitors is covered in can you see who clicked your link.

Where to see clicks

Open a link's page in the console and scroll to Recent clicks. Each row shows the time, a QR badge for scans, the country, device, browser, operating system and referrer. Load more clicks goes further back. Choose any row to open the click's own page, which shows every field, grouped as below.

Location

Country is the only location field SendURL records. It comes from Cloudflare, which sits in front of snu.to and works out a country from the visitor's IP address. The console shows the country's name and two-letter code, such as "Germany (DE)" or "Japan (JP)".

A few things to know:

• IP-based location is usually right about the country, but VPNs, corporate networks and some mobile carriers can place a visitor elsewhere.
• Visits through the Tor network show as "Tor (T1)", because their real location can't be known.
• If Cloudflare can't tell, or only knows a region rather than a country, the field is left empty.

SendURL does not record cities. The click page has a City row, but nothing is ever written to it.

Device

From the visitor's user agent, SendURL works out:

• Type: mobile, tablet or desktop, and rarer ones such as smart TVs and game consoles. When the user agent names no device type, the click counts as desktop.
• Vendor and Model, when the user agent includes them, such as Apple and iPhone

Browser and operating system

Also from the user agent:

• Browser, with its Version, Major version and Type where known
• The browser Engine and Engine version, such as Blink or WebKit
• OS and OS version, such as iOS or Android
• CPU architecture, when the user agent reveals it

Browsers have been trimming what they put in the user agent, for privacy, so version numbers, operating system versions in particular, can be less precise than they look. Treat them as a guide.

Request details

• IP address: the visitor's IP address, as Cloudflare saw it
• Referrer: the page the visitor came from, when their browser sends one
• User agent: the full string the browser sent, which the fields above are read from

The referrer is often empty, and that's normal. Many apps, including email clients, messaging apps and mobile apps, open links without sending a referrer, and many websites limit what they send. An empty referrer usually means a direct visit, an app, or a site that keeps it to itself.

Time and source

Each click has the moment it happened, shown in your local time, and a unique Click ID. Clicks from a link's QR code carry a "QR scan" label, so scans can be told apart from taps on the link. More on QR codes.

What isn't counted

A click is recorded only when SendURL actually redirects the visitor. These don't count:

• Visits to a disabled link, which shows "Link not found"
• Visits to an expired link, or to one at its visit limit, which show "Link expired" or "Visit limit reached"
• Views of a password page, until the right password is entered

What does count is every successful redirect, from people and from software alike. When a chat app or social network fetches your link to build a preview, that can appear as a click. The user agent usually gives these away, so if a click looks odd, open it and check.

Privacy

An IP address together with a user agent can single out a person. In the EU, the Court of Justice ruled in Breyer (case C-582/14, 19 October 2016) that a dynamic IP address can be personal data for a website operator with the legal means to identify the person behind it.

What that means in practice, as a rule of thumb and not legal advice:

• If you use tracked links in your own marketing, say so in your privacy notice.
• A link made for one named person, such as one link per email recipient, ties clicks to that person. Counting clicks per placement (a post, a poster, a newsletter) is the lower-risk use.
• Whether you need consent depends on where you and your audience are. Data protection regulators, such as France's CNIL and the UK's ICO, publish guidance on audience measurement.

Tracking also travels inside the links people share: a link copied from Facebook or YouTube often carries fbclid or si. The free URL cleaner strips those before you pass a link on.

How SendURL itself handles this data is in its privacy policy.

Clicks through the API

Every field above is in the API as well. GET /links/:id/clicks lists a link's clicks, newest first, 10 per page with a cursor for the next page, and GET /links/:id/clicks/:clickId returns one in full:

curl "https://api.sendurl.to/api/v1/links/LINK_ID/clicks?limit=10" \
  -H "Authorization: Bearer $SENDURL_API_KEY"

That's also the way to get your raw data out, since there's no CSV export: page through the clicks and store them wherever you like. See The SendURL REST API and the click object in the docs.

For counts over time rather than single clicks, see Clicks over time.