Two tools that send nothing anywhere

There's a new Tools item in the menu. Two to begin with:

QR code generator — type a URL or any text, pick a size, colours and error-correction level, download PNG or SVG. The code is generated in your browser; not a single character reaches the server.
Link cleaner — paste an address dragging utm_source, fbclid, gclid and similar tails behind it, get a clean version plus a list of what was removed. Also local. If you like, one click shortens the cleaned link in cutty.

No account, no limits, no history kept. These are the first tools beyond the shortener and we're treating them as a test: if you use them, more will follow.

Stats you can show other people

Every link now has a "public stats page" switch in its edit view. Once it's on, anyone visiting cutty.dev/your-link+ (with a plus at the end) sees the click count, a 30-day chart, countries, sources and devices. No IP addresses, no personal data, no full destination URL — only what belongs in a newsletter or a Discord channel.

Everything is off by default, and nothing changes until you tick the box yourself.

Abuse: you report, we check

Shorteners attract spam, and spam wrecks a domain's reputation for everyone, not just the spammers. So:

There's a Report abuse page. Enter the link, a reason and an optional note. Every report lands in a queue we review by hand; a blocked link shows a page with the reason instead of redirecting.
When a link is created or edited we check the destination against known malicious domains (among others, the public URLhaus feed). Malware and phishing are rejected on the spot. Links to other shorteners are followed to the end of the chain so we see where they really lead.
Ordinary links won't notice a thing: the check happens once, on save, not on every click.

Easier to keep a link made without an account

Shortening while logged out? Below the result you'll now see a bar saying the link is stored only in this browser, with a button that creates an account and moves your existing links onto it right away. The mechanism had been there for a long time; nobody could see it.

Under the hood

After the summer move to new infrastructure the app saw every visitor as a single address, which made unique-visitor stats and anti-spam limits meaningless. Fixed; the old, worthless data is marked as unknown rather than pretending it means something.
Click webhooks now go through the same safe client as the shortener import: public addresses only, no redirects, with a timeout.
A dozen page paths (such as /tools, /report, /faq) are reserved and can no longer be used as link slugs.
Click statistics older than 400 days will be pruned automatically.

As always, if something's broken or missing — [email protected].