Privacy Policy

This policy explains the data 0bla.com processes for links, accounts and service protection, and the limits of its privacy measures.

For each click: the relevant link, date, approximate location (country, region, city), device type, browser and a daily digest calculated from the browser and language. The IP address is used for location lookup but is not recorded in these statistics. This data is pseudonymised, not guaranteed anonymous.

Depending on the features used: email address and hashed password, optional Google identifier and avatar, account links and settings, subscription information, contact messages and abuse reports. Service protection counters are described in the Security and Abuse section.

No third-party cookies or advertising trackers. The link creation form does not collect a browser hardware fingerprint. Abuse prevention counters are separate from the statistics provided to users.

Primary hosting is provided by Koperateur Consulting in the European Union. Some features use the third-party services described in the Data Sharing section.
Click statistics do not contain plain-text IP addresses. Abuse prevention counters use separate digests; this does not guarantee that all intermediary and provider logs are free of IP addresses.

Data is used to create and manage links, present aggregated click statistics, protect the service against abuse, manage accounts and subscriptions, respond to requests and run configured integrations.

Guest: automatic deletion (5 minutes).
Free: 30 days. Pro: 1 year. Business / Enterprise: unlimited retention.
Account data is retained as long as the account is active.

0bla does not sell or rent your personal data. Some features involve third-party services:

Stripe processes payments and returns the information needed to manage your subscription.

If you choose Google sign-in, 0bla exchanges information with Google to verify your identity and uses your email address and Google identifier to find or create your account. A profile image may also be imported and stored locally.

The contact and abuse report forms send the fields you complete, including your message, reported links and email address if provided, to Formspree for delivery.

Service emails are delivered through the configured mail servers and the recipient's mail servers.

If you enable a webhook, click data is sent to the address you configured. Depending on the format used, it includes the short and destination links, time, click count, approximate location, device type and browser.

Under GDPR: right of access, rectification, deletion, opposition.

0bla only uses strictly necessary cookies for service operation (PHP server sessions). No advertising or tracking cookies are used.

Registration uses spam protection developed for 0bla: an automatic browser check, a honeypot field and server-side sending limits. Protection counters use HMAC digests of the network source and normalized email address, without storing these values in plain text in the counters. They are automatically cleaned up hourly after 48 hours without activity. The temporary challenge stays in the session and expires after 15 minutes. This protection uses no third-party CAPTCHA, movement tracking or device fingerprint. The receiving email domain is checked before sending; this does not confirm that the recipient's mailbox exists.

Without an account, link creation is limited to five attempts per hour per network source. People sharing the same connection may share this limit. The counter uses a daily rotating HMAC digest; it does not contain the network address in plain text. Changing the browser’s declared characteristics does not reset this limit.

This privacy policy may be modified at any time. Users will be notified of any significant change.

For any question regarding privacy: Contact us