Privacy Policy & GDPR

Last updated: October 14, 2026

This policy explains what personal data oly.ad ("we", "us") processes, why, for how long, and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We collect as little as the Service needs: there are no ads, analytics run only if you agree to them, and we do not sell personal data.

1. Controller

The operator of oly.ad is the controller for the personal data described here. Contact: oly.ad/contact.

For responses submitted through forms that users publish on oly.ad, the form's owner is the controller and we process the responses on their behalf (see section 5).

2. If you have an account

• Login name and email address. Your email must be confirmed before you can sign in.
• Password, stored only as a one-way hash (never in plain text).
• Phone number and country, only if you choose to add them.
• If you sign in with Google: your Google account ID and email address. We do not receive or store your Google password, and we do not store your name or photo.
• Settings such as the colour theme, saved QR styles and UTM presets.
• Security data: failed sign-in counters and temporary lock times, and a session marker that lets you sign out of all devices.
• Everything you create: links and their settings (smart-link rules, UTM tags, tags, QR designs, privacy settings — link passwords are stored only as a hash), webhooks, landing pages, uploaded images, and forms.
• Connected browsers and API keys: the name you give each one, when it was created and last used. The key itself is stored only as a hash.

Purpose and legal basis: providing the Service you signed up for — Art. 6(1)(b) GDPR; keeping accounts secure — Art. 6(1)(f).

3. If you open a short link

To redirect you and to show the link's owner aggregate statistics, we record for each visit:

• date and time;
• country, worked out from your IP address with a database on our own server (your IP address is not sent anywhere else and is not stored);
• device type, operating system and browser, from your browser's user-agent;
• browser language;
• the website you came from (its domain only), if your browser sends it;
• whether the visit came from a QR code, and whether it looks like a bot or link preview;
• a pseudonymous visitor code — a one-way hash of your IP address and browser with a secret key — used only to count unique visitors. It cannot be turned back into your IP address.

We do not set cookies on people who open short links, landing pages or forms. Link owners see only totals and breakdowns (for example "35 % mobile"), never individual visits.

Smart links use your device, operating system, country and the current time only to pick the destination at that moment.

For password-protected links, wrong password attempts are recorded with a hashed IP address for 24 hours to stop password guessing.

Purpose and legal basis: delivering the redirect, statistics for the link owner, preventing abuse — our and the link owner's legitimate interests, Art. 6(1)(f).

4. Abuse reports

If you report a link at oly.ad/report, we store the link, your email address if you give one (so we can tell you the outcome) and a hashed IP address (to limit spam). Legal basis: legitimate interest in keeping the Service safe — Art. 6(1)(f).

5. Forms published on oly.ad

When you fill in a form hosted on oly.ad, your answers are stored for the person or organisation who published the form, together with the time and a hashed IP address used to limit spam. If the owner has turned it on, they also get your answers by email.

The form's owner decides what is collected and why, and is responsible for it. To access or delete your answers, contact the form's owner. If you cannot reach them, or the form looks abusive, contact us or report it at oly.ad/report.

6. The oly.ad browser extension

The extension for Chrome, Edge and Firefox works only for you, with your own account, and only when you use it:

• When you open the extension (or choose "Shorten with oly.ad" from the right-click menu), it sends oly.ad the address of that one page or link, plus the alias and tags if you enter them. You can turn off automatic shortening in the extension's settings; then nothing is sent until you press "Shorten".
• It reads the current tab's address and title only at that moment, to show them in the extension. The title is not sent to us.
• It does not read page content, does not track the sites you visit, does not keep a browsing history and contains no analytics or advertising code.
• In your browser it keeps the key for your account, your extension settings and the links it made in the last 24 hours (so the same page is not shortened twice). "Disconnect this browser" deletes the key on our server and removes this data from the browser; removing the extension removes it from the browser too.

Links created with the extension or an API key are stored like any other link in your account (section 2). Legal basis: providing the Service you asked for — Art. 6(1)(b) GDPR.

7. Recipients and processors

• Our hosting provider, which runs the servers and database in the European Union.
• Google Safe Browsing (Google LLC): when a link is created or changed, its destination URL is sent to Google to check whether it is known to be dangerous. No information about you or your visitors is sent.
• Google Sign-In (Google LLC): only if you choose "Continue with Google".
• Google Analytics 4 (Google Ireland Ltd.): only if you accept analytics cookies on the cookie notice. It receives the oly.ad pages you open, device and browser type, language and approximate location; Google does not store IP addresses for Analytics, and advertising features and data sharing are off. Legal basis: your consent — Art. 6(1)(a) GDPR; you can withdraw it any time with Cookie settings at the bottom of the oly.ad home page and of your account. Google keeps this data for up to 14 months. Short links, landing pages and forms never load Google Analytics.
• Emails (sign-up confirmation, password reset, form notifications, report outcomes) are sent from our own mail server.

Google may process data outside the EEA; it does so under the EU–US Data Privacy Framework and Standard Contractual Clauses.

Webhooks: a link owner can set up a webhook so that, when their link is opened, the visit details they select (for example time, country, device, browser, language and referring site) are sent to a service of their choice, such as their CRM. Your IP address and browser user-agent are sent only if the link owner explicitly turns them on. The link owner decides on and is responsible for this transfer; the request is kept in their delivery log for 30 days.

We do not share personal data with anyone else, unless the law requires it.

8. How long we keep data

• Account data and everything you created: until you delete it or delete your account.
• Detailed visit records: 13 months, then deleted automatically. Daily click totals per link (numbers only, no personal data) are kept while the link exists.
• Form responses: until the form's owner deletes them, the form or their account.
• Sign-in and password-guessing protection records: 24 hours.
• Email confirmation and password reset links: expire within 24 hours and are deleted within a week.
• Abuse reports: up to 24 months after they are resolved.
• Webhook delivery logs (what was sent to the link owner's service and its answer): 30 days.
• Our hosting provider's standard server logs, for the period set by the provider, for security and troubleshooting.

9. Your rights

You have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where we rely on it.

You can do most of this yourself: change your email, password, phone and country in Profile, and delete your account in Profile → Delete account — this erases your account and everything in it immediately. You can export link statistics as PDF and form responses as CSV. For anything else, contact us at oly.ad/contact. We may ask you to confirm your identity and will reply within one month.

10. Complaints

You can complain to a data protection supervisory authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija, https://www.dvi.gov.lv). We would appreciate the chance to resolve your concern first.

11. Security

Connections are encrypted (HTTPS). Passwords and link passwords are stored as hashes, IP addresses are never stored in plain form, sessions use secure cookies, and sign-in is protected against password guessing. No online service can promise absolute security, but we work to protect your data.

12. Children

oly.ad is not intended for children under 16, and we do not knowingly collect their data.

13. Changes

We may update this policy. The date at the top shows the latest version.

14. Contact

Questions about privacy or your data: oly.ad/contact.