Case study
Go – a self‑hosted, privacy‑first link shortener
A Next.js‑based application that lets you create, organise and redirect short URLs while storing only aggregate click data. The code lives in the arjav1181/Go repository and can be run locally or deployed to your own infrastructure.
What it is
The repository contains a web application that provides a link‑shortening service. It lets a user create short links on a domain they control, assign custom or generated slugs, and organise those links with tags and folders. The service also offers analytics, QR‑code generation, conditional redirects, A/B experiments, password protection and a public link‑in‑bio page. All click data is stored only as aggregated daily counts, referrer host and coarse device category; no IP addresses, cookies, fingerprints or visitor‑level rows are kept.
The problem it addresses
Many link‑shortening services collect detailed visitor data for advertising or analytics, which can conflict with privacy‑conscious users or organisations that want to retain control over their data. The author wanted a self‑hostable short link tool that provides useful features (expiry, tagging, redirects, QR codes) while guaranteeing that no personally identifiable information is retained about the people who click the links.
How it works
The application is built with Next.js 16 (App Router) and TypeScript, using Tailwind CSS and the Vercel Geist design system for the UI. Data persistence is handled by Supabase: Postgres for relational data (links, tags, folders, redirects, experiments, rate limits, etc.) and Supabase Auth for owner authentication. The redirect engine decides where a request goes based on stored configuration: it can schedule temporary destinations, split traffic by weighted variants, or apply conditional rules on query parameters and time windows. Because the decision is made from a deterministic hash of the link and the current configuration, no per‑visitor state (cookies, fingerprints, IP) is needed to reproduce the same outcome. Analytics are incremented as simple daily counters; QR codes are generated client‑side via a canvas element; API keys are hashed and scoped for owner‑only access. The project includes a set of SQL migrations that create the required tables, functions and role grants, and a Docker Compose setup that runs the Next.js app alongside a local Postgres instance for development.
How it is built
The codebase is organised into a typical Next.js structure: the `app` directory holds route handlers, UI components and API routes; `supabase/migrations` contains ten numbered SQL files that must be applied in order; `docker/` holds a Postgres init script and a compose file that defines two services (`app` and `db`). The README lists the required environment variables (Supabase URLs and keys, owner email list, public app URL) and explains the distinction between `NEXT_PUBLIC_*` variables (baked into the client bundle at build time) and server‑only values (read at runtime). CI is configured via `.github/workflows/ci.yml` and runs `npm ci`, lint, typecheck, test, build and an audit on every push and pull request.
Where it actually is
The source lives at https://github.com/arjav1181/Go. The repository contains a README, documentation files (`app/docs`, `app/privacy`, `API.md`, `SECURITY.md`, `CONTRIBUTING.md`), the migration scripts, Docker configuration and CI workflow. No public deployment URL is provided in the README, and there is no mention of a live demo or hosted instance. The project can be run locally by following the supplied setup steps (installing dependencies, copying `.env.example`, applying migrations, creating an owner account in Supabase Auth and starting the dev server) or via Docker Compose as described.
Limits
- The README does not include a live URL or instructions for deploying to a production platform (e.g., Vercel, Fly.io, a VPS).- There are no screenshots, videos or walkthroughs showing the UI in use.- While the CI workflow runs tests, the README does not describe what those tests cover or provide a test suite overview.- The documentation links (`./app/docs`, `./app/privacy`, `./API.md`) are referenced but their contents are not reproduced here, so the depth of guidance is unknown.- The project has only one star and no indicated community activity, so external support or third‑party integrations are unverified.- No performance benchmarks, scalability notes or load‑testing results are mentioned.