---
title: "Keep personal data out of addresses · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/privacy/personal-data-out-of-urls
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep personal data out of addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Privacy](https://agentwranglers.se/playbook/website/privacy)
- Rule: Never put names, email addresses or other personal data in URLs. Send them in the body of a POST request instead. Only single-use links from an email may carry a random token.
- How: Use `method="post"` for every form with personal data. Addresses end up in browser history, server logs, analytics and the `Referer` header sent to other sites. Send `Referrer-Policy: strict-origin-when-cross-origin` or stricter as a safety net. A token in an email link must be random, expire, work once where it signs in, and never appear in logs. Send `Referrer-Policy: no-referrer` on that page. See [sign-in links](https://agentwranglers.se/playbook/email/email-security/sign-in-links).
- Check: Submit every form with test data. Search the access log and the browser history for the test values, and find none. Open an email link, and the access log shows the path without its token.

Example:

```html
<!-- Bad: the email lands in logs and history -->
<form action="/subscribe" method="get">
<!-- Good -->
<form action="/subscribe" method="post">
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy/personal-data-out-of-urls`.

- Previous: [Store each preference where it is needed](https://agentwranglers.se/playbook/website/privacy/preference-storage)
- Next: [Sign a contract with every processor](https://agentwranglers.se/playbook/website/privacy/processor-agreements)
- [Privacy](https://agentwranglers.se/playbook/website/privacy)