Privacy

If you stay a guest, Shorthunt sets an HttpOnly cookie with a random device id. The database stores a hash of that id and, separately, a hash of the network address, with the find count. The screenshot is not stored.

If you sign in, Supabase Auth stores the email and the session. Shorthunt stores a profile row (the name shown in the app, an avatar URL if the provider sends one, and that the account was created from Shorthunt), your likes, your daily card pulls, and your find history. A signed-in find also stores a hash of the network address on its own daily counter, separate from the guest network count.

The device cookie and the Supabase session cookies are HttpOnly and stay on this site. Shorthunt does not use them to follow you across other sites.

Find and the magic-link form send a Cloudflare Turnstile token so a script cannot spend the guest find. Cloudflare processes that check under its own privacy notice at https://www.cloudflare.com/privacypolicy/.

Sign-in with Google is handled by Google and Supabase. Watch links leave Shorthunt for the app you chose.

Daily find counts stay in the counter table. History stays until you delete a row on Me or the account is deleted. Guest hashes are not tied to a name.

To correct or delete account data, email hello@shorthunt.app from the address you used to sign in.

Last updated November 13, 2026.