Draft for operations. Not legal advice. Operator details are placeholders until counsel reviews.
Controller: operator of ok.la (details in Legal notice). Contact: privacy via the operator email once published.
We process Google account identifiers and verified email addresses, session cookies, short-code mappings, encrypted destination URLs, IP addresses used for rate limits and abuse reports, daily aggregate click counts, and moderation records. We do not store account passwords.
Cookies used: sid (session), csrf (forgery protection), lang (language), oauth_state (Google sign-in), __Host-pending_create (encrypted URL held for up to ten minutes to finish creation after Google login). No advertising or third-party analytics cookies.
Services used: OVHcloud (hosting in France), Google (sign-in). Destination URLs may be sent to URLhaus when that feed is configured.
Do not shorten URLs that contain secret tokens or sensitive personal data.