Privacy Policy
Last updated
1. Who we are, and what this covers
This policy explains what 1QRL collects, why, who else handles it, and what you can do about it. 1QRL is published by Seabird Apps, Inc., which does business as Onespot (“Onespot,” “we,” or “us”) and is responsible for your data here.
It covers 1qrl.app, every short link on 1qrl.cc, the API, and email to or from 1qrl.app addresses. Onespot's other products have their own policies, and we don't combine 1QRL data with theirs.
The short version: we collect as little as the product needs. We don't store the IP address of anyone who clicks a link, we run no ads or third-party analytics, and we never sell your data.
2. What we collect
What we collect depends on how you use 1QRL. Most people only ever click a link, and for them we keep no identifier at all.
| If you… | We collect |
|---|---|
| Click or scan a 1QRL link | We collectThe time, your country, your device type (mobile, tablet, desktop, or bot), your browser family, and the referring site's domain, never its full address. Our host works out the country from your IP address; our code never reads or stores the address itself. |
| Visit 1qrl.app | We collectNothing we store. Our host keeps short-lived request logs (section 8). If you aren't signed in, the home page also loads Cloudflare's bot check (section 5). |
| Shorten without an account | We collectThe destination URL, the slug we generate, and the time. Cloudflare Turnstile checks your browser first. To cap how many links can be made without an account each day, we keep a code made from your IP address with a secret key, and delete it after that day ends at midnight UTC. We don't record the address itself, except during an active wave of abuse, when we may keep it for up to 30 days to find other links from the same source. |
| Have an account | We collectYour email address; your links with their titles, slugs, UTM tags, and QR styles; any logo you upload; click analytics for your links; and a count of the links you make each day. If you sign in with Google, also the details Google sends us (section 4). Our sign-in provider logs each sign-in, including the IP address used. |
| Use the API | We collectEach key's name, a one-way hash of it, a short prefix so you can tell keys apart, when it was last used, and a daily count of the requests all your keys make together. |
| Email us | We collectYour address and what you write. |
3. What we don't collect
These are design decisions, built into how 1QRL stores data, not just promises about how we'll behave:
- No IP address on any click. The click log has nowhere to put one.
- No visitor identifier. No cookie, fingerprint, or ID follows a person from one click to the next, so we can't count “unique visitors” and don't try.
- No full referring URL. Only the referring site's domain, so the page someone came from stays private.
- No ads, no ad networks, and no third-party analytics or tracking pixels.
- No passwords. Sign-in is by email link or through Google, so there's no password of yours for us to lose.
4. How we use it
We use data only to run 1QRL, keep it safe, and meet the law. If you're in the EU or the UK, the right-hand column is the legal basis we rely on.
| Purpose | What it uses | Legal basis |
|---|---|---|
| Sign you in, store your links, and redirect them | What it usesEmail, your content | Legal basisPerforming our contract with you |
| Show you analytics for your own links | What it usesClick records | Legal basisLegitimate interests: knowing your links work, from records that identify nobody |
| Keep bots and abuse out | What it usesBot-check results, abuse reports, daily link and API request counts, and the IP code from section 2 | Legal basisLegitimate interests: security |
| Send sign-in links and important service notices | What it usesEmail | Legal basisPerforming our contract with you |
| Answer your email | What it usesYour address and message | Legal basisLegitimate interests |
| Meet legal obligations | What it usesWhatever the law requires | Legal basisLegal obligation |
Signing in with Google. If you choose to sign in with Google, Google sends us your name, email address, profile picture link, and Google account ID, plus your organization's domain for a Google Workspace account. We use them only to sign you in and to show your name in 1QRL. They're stored with our sign-in provider, updated each time you sign in with Google, and shared with no one else. We never see your Google password, and we can't reach anything else in your Google account. Our use of information received from Google adheres to the Google API Services User Data Policy.
We don't send marketing email unless you've opted in, and every one will let you unsubscribe. We don't sell personal information, share it for targeted advertising, or use it to make automated decisions about you.
6. Who else handles your data
We use a small number of service providers. Each gets only what its job needs and may use it only to provide that service to us.
| Provider | What it does for 1QRL | What it receives |
|---|---|---|
| Supabase | What it does for 1QRLDatabase and sign-in | What it receivesEverything in section 2 that we store, plus sign-in logs that include IP addresses |
| Vercel | What it does for 1QRLHosts 1qrl.app and 1qrl.cc | What it receivesEvery request, including its IP address, in short-lived logs; it works out each click's country, and keeps short-lived copies of logos to serve them quickly |
| Resend | What it does for 1QRLSends sign-in emails | What it receivesYour email address and the email itself |
| Cloudflare | What it does for 1QRLRuns the Turnstile bot check | What it receivesBrowser and device signals, and the IP address of anyone who visits the home page without signing in |
| What it does for 1QRLLets you sign in with Google, if you choose to | What it receivesThat you're signing in to 1QRL. It sends us the details in section 4 | |
| Google Workspace | What it does for 1QRLCarries email to and from hi@1qrl.app | What it receivesYour address and what you write |
Beyond these, we share personal data only when the law requires it, to protect someone's safety or our rights, or if 1QRL changes hands. In that last case, this policy keeps applying to data collected under it. We don't share 1QRL data with Onespot's other products.
7. What's public by design
A short link is public. Anyone who has it, or guesses it, can follow it and see where it goes, and slugs are short enough to guess. So don't shorten a URL that works as a password: a private document link, a login token, or a page with personal details in its address.
A logo you add to a QR code is stored at its own web address, and anyone who has that address can see the logo. The address is far too long to guess, but don't upload a logo you wouldn't want seen.
Everything else about your links stays private to your account: titles, analytics, QR styles, and which links are yours.
8. How long we keep it
Links are permanent, so link data is kept for good; everything else has a limit.
| Data | Kept for |
|---|---|
| Links and their destinations | Kept forAs long as the link exists. A deleted link stays in our database, marked deleted, so its slug can never be reissued. |
| Click records | Kept forAs long as the link exists. |
| Logos | Kept forAs long as a live link uses one. Then it's deleted, and its address stops working within 24 hours. A browser that already showed it may keep its own copy. |
| Your email address, the details Google sends, and your API keys | Kept forUntil you close your account. Your links then stay live, with no owner attached. |
| IP addresses recorded during an abuse wave | Kept forUp to 30 days. |
| Daily link and API request counts, and the IP code from section 2 | Kept forUntil the day ends at midnight UTC. |
| Sign-in emails | Kept forResend keeps each one, and its delivery record, for 30 days. |
| Sign-in and hosting logs | Kept forSupabase keeps sign-in logs for 1 day, and Vercel keeps request logs for 1 hour. Each may keep its own security records longer, under its own policies. |
| Email to hi@1qrl.app | Kept forAs long as we need it to deal with your message and keep a record of it. |
| Backups | Kept forOur database plan keeps no backups, so what we delete is gone. |
9. Security
Every connection to 1QRL is encrypted with HTTPS. API keys are stored only as one-way hashes, and there are no passwords to steal. Browsers can't query the database for links or analytics; only our servers can, and they check ownership on every request, so an account reaches only its own data.
No system is perfectly secure. If a breach affects your data, we'll tell you promptly and as the law requires.
10. Your rights
Wherever you live, you can ask us to show you, correct, export, or delete the personal data we hold about you, and to stop any use you object to. Email hi@1qrl.app from your account's address and we'll answer within 30 days. We won't treat you differently for asking.
Two limits follow from how 1QRL is built:
- Deleting your account doesn't delete your links. They stay live without an owner, as section 13 of the Terms explains. Delete the ones you want gone first.
- We can't find your clicks. Click records carry no identifier, so there's no way to tell which ones were yours.
If you're in the EU or the UK, you can also complain to your data protection authority. California residents have the rights above under the CCPA; we don't sell or share personal information as it defines those terms.
11. Transfers, children, changes, and contact
Where data lives. Our database is in the United States. Our providers may process data in other countries, and we rely on their standard contractual clauses or equivalent safeguards when data leaves the EU or the UK.
Children. 1QRL isn't for anyone under 13. If we learn a child under 13 has an account, we'll delete it.
Changes. We'll post any change here with a new date, and email account holders before a change that matters takes effect.
Contact. hi@1qrl.app, or Seabird Apps, Inc., 1111B S Governors Avenue, Unit 20452, Dover, DE 19904.