What we record, and what we don't
more.ws measures links, so it necessarily records something about the people who open them. This page says exactly what that is, in plain words, without the parts that make a policy sound reassuring while saying nothing.
Last updated 23 October 2026
The short version
- Opening a more.ws short link sets no cookie. The redirect runs with the cookie and session machinery switched off entirely.
- We do record the visitor's IP address, along with an approximate city, the kind of device, and the site they came from. We are not going to pretend otherwise.
- There are no third-party trackers, ad networks or analytics scripts anywhere on this site, and nothing on a page loads from another company's servers on its own. A landing page with a video or a map loads it from YouTube, Vimeo or OpenStreetMap only when the visitor taps to play or open it.
- We have never collected a card number, because there is no way to pay through this site at all.
- Click records belong to the customer whose link it is. They are deleted when the link is deleted, and when the account is.
- We do not send any email at the moment. When we do, it will be about your account and your plan only, never marketing.
1. If you have an account
To run an account we store your name, your email address, and your password as a one-way bcrypt hash. A hash cannot be turned back into a password, which is why not even an administrator can look yours up — we can only set a new one.
Alongside that we keep the ordinary records of running the service: your workspace, the links, QR codes and pages you create, which plan you are on, the dates of your term, the price agreed, and the cash payments an administrator has recorded against it.
We have never held a card number, and we cannot. There is no checkout on this site, no card field anywhere in it and no payment provider connected to it. Payment is arranged with us directly and settled outside the application. See the Terms for how that works.
2. When someone opens one of your links
This is the part that matters, so here is the whole of it. When a short link is followed or a QR code is scanned, one record is written, and it contains:
- The IP address the request came from, in full.
- A salted one-way hash of that address, kept beside it. This is what counts unique visitors, and it is how records made before we started storing the address itself still work.
- An approximate country and city, looked up from the address.
- The kind of device, the operating system and the browser — worked out from the browser's user-agent string. The raw string itself is not kept, only what we read out of it.
- The hostname of the site the visitor came from, if any — "instagram.com", not the full address of the page they were on.
- The date and time, and whether the hit arrived from a link, a QR scan or an SMS.
- Whether it looked automated. Traffic identified as a bot or a crawler is recorded but excluded from every headline number.
3. What we do not do
- Nothing loads from anyone else's servers until the visitor asks for it. Stylesheets, scripts and fonts are all served from more.ws, so visiting a page does not quietly tell a third party that you did.
- Videos and maps wait for a tap. A landing page with a video shows a still picture served from more.ws. Only when the visitor taps play does their browser load the video from YouTube, through its privacy-enhanced player at youtube-nocookie.com, or from Vimeo, with Vimeo's do-not-track setting switched on. A map on a page loads from OpenStreetMap in the same way, only when it is tapped. From that tap on, the company concerned receives the visitor's request, IP address included, as it would on its own site.
- Buttons that lead elsewhere are only links. Open in Google Maps, Apple Maps, Waze, WhatsApp, a phone number, a social network: nothing is sent to any of them unless the visitor taps that button.
4. Cookies
Cookies appear only once you are using the site itself, and only these:
- A session cookie, so that signing in survives from one page to the next. It expires after two hours of inactivity.
- A CSRF token, which stops another site from submitting a form as you. It does nothing else and identifies nothing.
- A "remember me" cookie, only if you tick that box when you sign in. Changing your password invalidates it.
- A short-lived marker recording that you entered the password for a password-protected link, so you are not asked twice in the same session.
None of these are advertising cookies and none of them follow you anywhere.
5. Images you upload
Images added to a landing page are stored on our server and served publicly at their own address — they have to be, for the page to show them. Treat anything you upload as public, because a page you publish is public.
When a page has a video, our server fetches the video's preview picture from YouTube or Vimeo once, as you save the page, and keeps it with your other images. Showing that picture to a visitor involves no one else.
Replacing an image deletes the old file, and deleting a page deletes its images, video pictures included.
6. Email
more.ws does not send any email at the moment. When it does, it will only ever be about your account and your plan: a password reset link you ask for, notice that a plan has been activated or a plan request declined, and reminders before your term ends. Never marketing.