The unit is the redirect
CTAurl counts the moment a request passes through its redirect. There is no script on your website and no cookie on the person tapping. That is why every CTAurl report says requests, not people: counts can include bots, security scanners and link previews.
Those systems open links automatically. Microsoft Defender for Office 365 scans the URLs in an email before delivery and checks them again at click time (Microsoft Learn, October 2026), and Slack's servers fetch every URL posted in a message to build a preview (Slack Developer Docs). A raw count can include all of them, and CTAurl's counts do too, which is why CTAurl calls its numbers requests.
What a click record holds
On links with the standard privacy setting, each CTAurl click record keeps this short list:
| In the click record | What it is used for |
|---|---|
| Time | When the tap or scan happened |
| Link, domain and back-half | Which link was used |
| Link or QR | Whether it was a tap or a scan |
| Country and city | Where requests came from, by city |
| Referrer host | The site that sent it, host name only |
| Device type, operating system, browser family | Phone or desktop, iOS or Android, and similar |
| Platform | Social, messaging, direct and similar |
| utm_source, utm_medium and utm_campaign from the destination | Which campaign it belongs to |
| QR design variant | Which design of a QR code was scanned |
| Position, only with consent | Where a visitor who agreed was, to within about 40 metres |
What it never holds
A CTAurl click record never holds the IP address, the full referring address, the raw user agent or a cookie. The IP address is used for the moment of the request and then not stored, the referrer and user agent are cut down to the short forms in the table above, and the redirect sets no cookie.
| Not kept in the click record | Why it matters |
|---|---|
| IP address | Used for the moment of the request, then not stored |
| Full referring address | Only the host name is kept |
| Raw user agent | Only the device, system and browser family are kept |
| Cookies on the visitor | A redirect sets none |
A privacy setting on every link
Every CTAurl link has its own privacy setting. Standard keeps the record above. Minimal keeps only the time and whether it was a link or a QR scan. Off keeps only a count of taps and scans with their time. Links on either setting appear in totals but not in breakdowns. Reports say how much of the traffic in a period comes from standard links.
Location, and when we ask
In a CTAurl click record, country and city come from the request. They do not come from the device's GPS. A QR code can be set to ask for location: the person scanning then sees a consent page first, and only someone who agrees shares their position, to within about 40 metres. That position is kept with the click record and deleted with it after about 90 days. Everyone else goes on to the destination without sharing it.
How long it is kept
CTAurl keeps detailed click records for about 90 days and then deletes them. Reports show totals and breakdowns from that window.
What counting at the redirect cannot show
Because CTAurl counts the redirect and not the visit, it cannot show what people did on your website after they arrived. For that, keep UTM tags on your destination: they pass through the redirect untouched, so your own analytics can follow the visit.
Questions people ask
Does CTAurl put a script or cookie on my website?
No. CTAurl counts the request as it passes through the redirect on our server. Your pages never load a CTAurl script, and the redirect sets no cookie on the person tapping. Your own analytics can follow the visit through the UTM tags in your destination.
Why does CTAurl say requests, not people?
CTAurl says requests, not people, because a request is what the redirect can count accurately. Bots, security scanners and link previews also request links, and one person can tap twice. Reports do not separate bots out, so a count of requests is never a count of people, and CTAurl does not present it as one.