Trust & Security

PORTLS is a link shortener and commerce attribution tool for creators. A workspace owner creates short links, optionally connects a store (Fourthwall, Ko-fi), and sees which links drove clicks and orders.

Security is shared across three parties: the underlying Lovable Cloud platform (hosting, database, auth), PORTLS-the-app (the controls described on this page), and the workspace owner (who decides what links to create and which stores to connect).

This page covers data handling and security. The legal agreement between PORTLS and the people who use it lives on the Terms of Service page.

• Sign-in via email + password or Google.
• Workspaces are private. Only invited members can view a workspace's links, clicks, and conversions.
• Admin actions (approving access requests, managing domains, changing member roles) are gated server-side by role checks.
• Sensitive credentials such as store API keys and webhook secrets are write-only from the browser — once saved they cannot be read back by any client, only used by server-side code.

When you sign up for a PORTLS workspace we store:

• Your email address and a hash of your password (or your Google account ID if you sign in with Google) — managed by Lovable Cloud authentication. We never see or store the password itself.
• The workspace handle and display name you chose.
• Workspace membership: which accounts have access to which workspaces and at what role (owner / admin / member).
• The connection settings you configure: store API keys, webhook secrets, and custom domains. API keys and webhook secrets are write-only from the browser — once saved they can be used by server code but never read back, including by you.
• Operational records: when you signed up, when an access request was approved, the emails we've sent you (for example, an "access approved" notification), and your communication preferences.

We use this information only to operate PORTLS — to authenticate you, run your workspace, deliver service emails, and respond to support requests. We do not sell it, we do not share it with advertisers, and we do not use it to train AI models. Marketing emails are off by default; if we add them, they will be opt-in.

You can request export or deletion of your account data by emailing the security contact below. Deleting an account also deletes the workspaces you solely own, including the click and conversion history attached to them.

You are responsible for the links you create and the destinations they point to. Make sure every redirect target is a URL you own or have permission to send traffic to, and that it complies with the laws and platform rules that apply to your audience.

PORTLS is an attribution and link-management tool. It does not replace legal, tax, or compliance advice, and it does not verify the content of your landing pages. Do not use PORTLS to redirect to phishing, malware, deceptive offers, spam, or any illegal activity. We may suspend or terminate workspaces that are used to violate laws or harm others.

Correct usage also means keeping your account credentials and API secrets secure, only inviting trusted team members, and reviewing the destination URLs of your short links before sharing them publicly.

When someone clicks a PORTLS short link we record:

• Timestamp and the link that was clicked.
• Coarse geography (country, region, city) when available from request headers.
• Browser, OS, and device family derived from the user-agent string.
• Hashed visitor and IP identifiers — raw IP addresses are not stored.
• Referrer URL and any UTM parameters on the link.

When a connected store reports an order we record the order id, amount, currency, and the click it is attributed to. PORTLS never sees passwords or payment card data.

Short-link redirects

Short-link redirects do not set marketing or advertising cookies. We do set one first-party cookie on the short-link domain,portls_vid— a random identifier (no personal info) used to stitch repeat clicks from the same browser to the same visitor so workspace owners can see a coherent journey. The cookie is HttpOnly, SameSite=Lax, lasts up to two years, and is never shared with third parties.

Signed-in app

The signed-in app uses a first-party authentication session cookie required to keep you logged in.

Optional tracking snippet

PORTLS does not inject any script into third-party websites automatically. Workspace owners can copy a small JavaScript snippet from their PORTLS settings and paste it into their own storefront for richer reporting. When the snippet is installed, on that owner's site only it:

• Reads thefw_tidparameter from the landing URL and stores it in a first-party cookie and localStorageentry (90 days) so a purchase can later be matched back to the click.
• Sets a stable per-browser visitor identifier (fw_vid, up to 1 year) and, in the optional "all-traffic" mode, a short-lived session identifier (portls_sid, ~24h).
• Sends behavioral events to PORTLS — page view, product view, add-to-cart, cart view, cart update, checkout started, and purchase — including the page URL, referrer, the product handle when applicable, and the identifiers above.

The snippet does not capture form input, keystrokes, mouse movement, screen recordings, payment card details, or any other content of the pages it runs on. It does not load third-party advertising tags.

Because the snippet runs on the workspace owner's own site, the workspace owner is responsible for disclosing this tracking in their own privacy notice and for obtaining any consent required by their audience's jurisdiction (for example GDPR / ePrivacy in the EU, UK GDPR, CCPA / CPRA in California, LGPD in Brazil). PORTLS provides the tool; the owner controls whether and how it is deployed.

• Lovable Cloud — hosting, database, and authentication.
• Paddle — Merchant of Record for payments, subscriptions, tax, invoicing, dunning, and refunds.
• Lovable email delivery — sends transactional and performance report emails from notify.portls.to.
• Lovable AI Gateway — routes optional AI helper prompts (e.g. video description drafts) to the configured model provider.
• YouTube Data API — queried on your behalf when you connect a channel, using your own API key.
• Fourthwall, Lemon Squeezy, Ko-fi, Shopify — only when a workspace owner connects that store, to sync products and/or receive order webhooks.

PORTLS applies automated bot detection to short-link clicks (user-agent patterns, burst detection, fleet detection, and per-workspace country / UA rules) so that link previews and crawler traffic are not counted as real clicks. Filtered clicks are stored with a bot flag rather than deleted so that workspace owners can audit them.

Orders received from connected stores are attributed to the most recent qualifying human click for that visitor (attribution model: last-touch by default, configurable to first-touch). Orders that arrive without a click id are matched against recent cart / checkout events for the same visitor when possible.

• Webhook delivery logs are pruned after 30 days.
• Raw click telemetry is pruned per your plan's retention window. Clicks tied to a conversion are kept alongside the conversion record.
• Commerce events (page views, add-to-cart signals) are pruned per your plan's retention window.
• Workspace-level data (links, products, sources, settings) is kept while your subscription is active. Owner-initiated deletion (Settings → Danger zone) applies a 30-day grace period and then permanently erases the workspace.

PORTLS processes click data on behalf of the workspace owner whose link you clicked. To request an export or deletion of data tied to your visits, contact that workspace owner directly. Account holders can export and delete their own workspace from Settings; see the Privacy Notice for the full list of rights.

To report a vulnerability or a suspected security issue, email hello@portls.to. Please include reproduction steps and avoid testing against real user data. Machine-readable contact details are published at /.well-known/security.txt.

To report a PORTLS short link being used for phishing, malware, or spam, see Report abuse.

Last updated: June 24, 2026.