Redirect behavior

`GET /<slug>`

Public, unauthenticated. Redirects (307) to the link's url. If the slug doesn't exist, is disabled, or has expired, redirects to / instead. Click metadata is logged after the redirect is sent, so it never adds latency.

OpenGraph previews

Requests from known link-unfurling crawlers (iMessage, Slack, Discord, Twitter, etc.) get a 200 HTML page with OpenGraph/Twitter Card tags instead of a redirect:

og:title / twitter:title: the link's title, falling back to its slug.
og:description / twitter:description: a generated description including the destination URL.

This means shares show a proper preview card instead of whatever (if anything) the destination itself exposes. These requests are never logged and never touch the destination URL.

Click-count protections

These exist so clickCount reflects real visits, not shares or speculative prefetches.

Crawlers (above) are not logged.
Browser prefetches: requests carrying a Sec-Purpose/Purpose: prefetch header still redirect normally but aren't logged, since the navigation may never actually happen.
Rapid repeats: hits from the same visitor (daily-hashed) within a 60-second window are deduped to a single click, absorbing client retries and redirect loops without undercounting genuine repeat visits later on.