Privacy & checks

LKJ is in beta. No account is needed to create or open a code. Codes and destinations are public identifiers, not secrets. Anyone may guess a code. Do not submit sensitive documents, account access links or URLs containing private tokens.

What we keep

We store the destination, its code, expiry, website-provided metadata and check results. Expired and removed destination payloads are deleted; minimal code, version, status and timing records remain until eligible reuse. Blocked and removed codes are not recycled. Abuse reports are deleted after 30 days. We do not add tracking pixels, third-party fonts, advertisements or visitor tracking. We keep anonymous daily opening totals and per-code opening counts with the most recent opening time. These count redirects, not unique visitors. Anonymous daily creation/opening totals survive reuse; per-code counters reset for the new version. No individual click history is stored. For the agent API and MCP tools, we keep daily-changing, keyed hashes of network addresses to enforce fair-use limits. We do not store the raw addresses. These quota identifiers are deleted within two days and are not used for advertising or tracking between days. Hashed request keys and URL fingerprints support safe API retries for at least 24 hours and are cleared by scheduled cleanup after that window.

What leaves LKJ

Hostnames are sent to Cloudflare’s malware/phishing DNS resolver. Approved preview hosts may receive an ordinary request from a Worker, without your browser’s cookies or credentials. Previews are omitted for URLs with query parameters and common account-action paths. Fragments are not sent to websites.

Cloudflare Turnstile checks browsers when you create a code to reduce automated abuse. On the homepage, its script and challenge load after you enter a website address. They also load on the dedicated sharing page. Entering a numeric code does not start the challenge. We verify each token with Cloudflare and send the connecting IP with that verification. Cloudflare processes network information to deliver the service and limit abuse. The application does not store visitors’ raw IP addresses. Shared networks may share rate limits. Cloudflare Access protects moderation only and may set authentication cookies there.

What checks mean

The DNS filter can identify some known malware and phishing hostnames. It does not inspect every page. Lookalike detection uses a limited reference set and can be wrong. HTTPS proves an encrypted connection was successfully made at the recorded time; it does not prove the website is trustworthy.

The destination page shows the checks in use and flags results that are missing, unavailable or out of date. Required checks must complete before a link can be opened. Preview images are not fetched or displayed. Website descriptions are untrusted statements provided by that website.

Report a problem

Use “Report this link” on its destination page, or start from the report page. Reports require review; submitting one does not automatically remove a link.