Privacy Policy

Account Information

• Email address (for authentication and account recovery)
• Password hash (we never store passwords in plain text)
• Passkey credentials (if you enable passwordless login)
• Organization activity logs (if you use teams) record who changed a membership or setting, with a truncated IP address that is removed after 13 months

Link Data

• Original URLs you shorten
• Custom aliases you create
• Creation timestamps
• Expiration dates (if set)

Analytics Data (collected when someone opens a short link)

• Click counts and timestamps
• A truncated IP address — we remove the last part of the address before storing it (IPv4: last octet zeroed; IPv6: reduced to /48). The full address is used only in memory to derive an approximate location and for rate limiting, then discarded.
• Approximate, city-level location (country, region, city and city-level coordinates) derived from the IP via a local geolocation database — your IP is never sent to a third party for this
• Browser, device type and operating system (parsed from the user agent, which is also stored temporarily — see retention below)
• Referrer URLs

We use your information exclusively to:

• Provide the service: Redirect shortened links, manage your account, and display analytics.
• Prevent abuse: Detect spam, malicious links, and terms of service violations.
• Improve the product: Understand usage patterns to make opn.onl better (in aggregate, never individual).
• Communicate with you: Send account-related notifications (password resets, security alerts).

We take security seriously:

• All data is encrypted in transit (HTTPS/TLS)
• Passwords are hashed using bcrypt with appropriate cost factors
• Database access is restricted and monitored
• We support passkey authentication for passwordless security
• Regular security audits and updates

We retain your data only as long as necessary to provide the service:

• Account data: Kept while your account is open. When you delete your account it closes immediately, and your email address, password hash, profile, links (destinations, titles and notes), click history, passkeys and API keys are permanently removed 30 days later. Until then an administrator can restore the account; after that nobody can
• Link data: A link you delete stops redirecting at once, but its record is kept until your account is permanently removed. Links you created inside an organization belong to that organization and stay with it
• Per-visitor analytics identifiers: The truncated IP address and raw user-agent string of a click are automatically anonymized after 13 months by a scheduled job
• Aggregate analytics: Non-identifying dimensions (click counts, country, city, device type, browser, referrer) are retained for the lifetime of the link so your statistics keep working
• Backups: Database backups are taken automatically on a schedule (daily by default) and only a fixed number of the most recent automatic copies is kept (14 by default); deleted data ages out of those as old copies are removed. A backup an administrator takes by hand is kept until an administrator deletes it

Your rights

Depending on where you live (e.g. under the GDPR or similar laws), you have the right to access, correct, export, object to the processing of, and delete your personal data. Where self-service deletion is enabled you can delete your account from Settings: it closes immediately and the data is permanently removed after the 30 days described above. Otherwise email us and we will process verified deletion requests within 30 days.

Legal bases we rely on: performance of a contract (providing the service you sign up for), and legitimate interest (abuse prevention, security, and aggregate, non-identifying analytics).

We use your browser's local storage to keep you signed in (your session token). We do not use advertising cookies or cross-site tracking.

We don't sell or share your data for marketing. The following infrastructure providers process data on our behalf, strictly to run the service:

• Cloudflare — network proxy, TLS and DDoS protection in front of our servers (sees connection metadata like your IP, as any network carrier does)
• MaxMind GeoLite2 — the IP-to-city database used for geographic analytics; lookups run entirely on our own servers, so your IP is never transmitted to MaxMind
• Email delivery provider — sends transactional email only (verification, password reset, security notices) to the address you registered
• Object storage (S3-compatible) — stores database backups. They are sent over an encrypted (TLS) connection and are encrypted at rest by the storage provider (Cloudflare R2 encrypts everything it stores)

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: