Privacy Policy

This policy covers Ash Blast pages served from https://ash.qlynk.me, including short-link landing pages at /s/:code, the admin area, and the public content pages that embed or link to other services.

The site may change as the implementation changes. A material change to these practices should be reflected in a later update to this page.

Short-link page views. When a real request reaches an Ash Blast short-link landing page at /s/:code, the server can record a page-view event. A normal page request can record the short-link ID, timestamp, device type, operating-system family, browser family, an available country code, and a server-resolved network IP address when the ingress chain is verified. The event is stored separately from explicit click actions.

Requests identified as bots or preview crawlers are recorded as crawler_view rather than a human page view. They are kept separate from the human-click metrics. Unknown traffic is not treated as verified human traffic.

Next.js prefetch requests are detected from request headers and are not intentionally recorded as page views. Static assets such as images, CSS, JavaScript, and font resources are not themselves converted into page-view events by this application.

Short-link clicks. The “Open in app” and “Open link” actions send an event to the site's own server endpoint. The browser sends the short-link ID, action type, and an event ID used to reject duplicate submissions. The browser does not submit an IP address. The server resolves the available client IP from trusted ingress information in the same way used for short-link page views.

Link and SEO information. The admin system stores destination URLs, slugs, titles, SEO titles and descriptions, preview-image URLs, and configured deep-link targets for managed links. When an administrator asks the site to prepare a URL, the server may fetch bounded public metadata from that destination or from a platform metadata endpoint. The fetcher rejects credential-bearing URLs and private or loopback targets, limits response size/time/redirects, re-checks each redirect destination, and does not forward the visitor's authentication cookies or authorization headers.

A network IP address is used for server-side analytics and operational controls where the trusted ingress chain provides one. The application does not use browser IP-address websites, WebRTC address discovery, canvas fingerprinting, or a browser-supplied IP field to determine it.

The current resolver accepts only verified platform/provider ingress information. For ash.qlynk.me, the application requires a Vercel platform peer that is within Cloudflare's published egress ranges before using Cloudflare's client-IP header. If a Cloudflare Worker is involved, the application treats the client IP as unknown because same-zone Worker requests can alter the header. If Cloudflare Pseudo IPv4 overwrites the IPv4 header, the real IPv6 value is taken from CF-Connecting-IPv6 when available; otherwise the IP is unknown.

Direct *.vercel.app requests use Vercel's platform-provided client-IP value. Arbitrary X-Forwarded-For, X-Real-IP, browser parameters, and similar unverified values are not used as visitor IP evidence.

An IP address can represent a VPN, corporate gateway, mobile carrier NAT, household router, or another shared network. It is therefore not treated by this site as proof of a particular person's identity.

Streaming Mode changes how IP addresses are displayed in the authenticated admin analytics interface; it does not stop IP collection. When enabled, an IPv4 address is displayed using its first two decimal digits followed by *******. For example, 192.168.1.1 is displayed as 19*******. IPv6, invalid, missing, or otherwise insufficient values are displayed as *******.

When Streaming Mode is ON, the raw IP address is not returned to the browser, DOM, tooltip, or client-side state by the analytics endpoint. Switching the mode clears displayed analytics state and invalidates in-flight responses so a stale raw-IP response is not restored. This is partial masking for screen sharing, not anonymization.

Analytics events currently receive an application-set expiry timestamp of 180 days from the event timestamp. The application does not expose a user-facing retention override or bulk-delete control. The codebase does not establish a separate fixed retention period for link records themselves, so this page does not claim one.

Raw-IP analytics are protected behind authenticated admin routes and responses are marked no-store and private. The admin session is an HttpOnly, Secure, SameSite=Strict cookie named ash_admin_session with a maximum session age of seven days.

This website uses and/or links to third-party services. Their handling of network information, cookies, identifiers, logs, content, or other data is separate from the site's own analytics described above.

Vercel. The application is hosted on Vercel and uses its server runtime and platform headers. See Vercel Privacy Policy.

Cloudflare. The production custom hostname is intended to use Cloudflare as the external proxy in front of Vercel. See Cloudflare Privacy Policy.

Google and YouTube. The site uses YouTube-related APIs/resources, Google-hosted resources, and the Google AdSense script on the public site. Google may therefore process requests made to those services under its own policies. See Google Privacy Policy.

Discord. The site embeds a Discord widget and uses Discord links and badges. A browser loading those resources communicates with Discord directly. See Discord Privacy Policy.

SocialCounts. The home page loads a SocialCounts subscriber-count iframe. A browser loading the iframe communicates with SocialCounts directly. See SocialCounts Privacy Policy.

CurseForge / Overwolf. Public project information and media are obtained from CurseForge/Overwolf services. See Overwolf Privacy and Legal Information.

Hugging Face and QLYNK. Some static images and branding assets are served from a Hugging Face-hosted asset service and a QLYNK CDN. Those hosts may process normal web requests to the resources they serve.

Payhip and third-party destinations. The pricing page links to external purchase/services pages, including Payhip. Once you leave Ash Blast, the destination's own processing, cookies, logging, and privacy terms apply. A Payhip privacy-policy link is not asserted here because an official policy URL was not verified during this review.

We link to provider policies, but we do not control or independently verify every provider's collection, retention, cookies, logs, or future changes.

The application intentionally stores unknown when a visitor IP cannot be established from a trusted ingress path. It does not rewrite historical records just because a new resolver becomes available.

The repository does not contain a Cloudflare Worker, Vercel route transform, or browser-side IP collection script. Exact Cloudflare DNS proxy state and any account-level managed transforms are configuration outside this repository and should be re-checked by the owner before relying on them operationally.

The currently published contact route is the Ash City Discord server: open the Discord contact route.

No public contact email is claimed by this policy because no configured contact email was found in the application code.

The exact legal jurisdiction, provider-side retention periods, backup retention, and any account-specific Cloudflare/Vercel configuration are not established by this codebase and are intentionally left unspecified here.