How ONNO handles your information.

Redirects and saved links

Opening a destination page does not create an ONNO login session or add a session cookie. ONNO does not keep a click history or load the destination to make a preview. Your browser may still send cookies it already has, for example if you are signed in.

A Direct link contains its destination URL without a saved link record. Short links store the destination, short code and link restrictions; links created while signed in also store their account ownership. Revoking a link keeps its short code reserved so it cannot be reused.

After a short link is revoked

After a short link has been permanently revoked for more than 30 days, we remove eligible destination URLs and hostnames in batches. Links connected to reports, evidence holds or blocking restrictions are retained while those exclusions apply.

We keep the short code and revocation status so the code is never reassigned. Some identifiers needed to match creation requests, enforce ownership and validate revocation also remain. This does not make the record fully anonymous.

You can still report a short code after its destination has been removed, but we cannot retrieve its original destination. Older backups may retain removed information until they are retired under the existing backup rotation rules. Backups are not a service for retrieving removed destinations.

Accounts and reports

ONNO stores your email address and a one-way password hash, not your readable password. Two-step setup keys and recovery codes are stored encrypted. Account forms use secure session cookies to keep you signed in and protect form submissions.

Reports retain the URL, explanation and optional contact details you submit so an administrator can review them. Administrative changes keep a minimal record of the action and the item affected, without copying full personal profiles or complete destination query strings.

Human verification

Registration, short-link creation, password-reset requests, verification email resends and reports use Cloudflare Turnstile and make requests to Cloudflare. Verification does not certify a destination as safe or guarantee anonymity.

Direct links are constructed locally. Redirect pages and local tools do not load Turnstile. Tool inputs remain in your browser.

Local tools

URL encoding and decoding, parameter cleanup, referrer display and QR Code generation happen in your browser. These tool contents are not sent to ONNO or saved in browser persistent storage.

Cookies and service boundaries

Encrypted backups are kept separately for recovery. Deleting an account does not immediately remove its data from earlier backups.

ONNO no longer sends the hosting firewall’s visitor-identification cookie. Account features still need session cookies. An older visitor cookie may remain in your browser until it expires. These application behaviors do not mean that hosting or network services keep no logs, or that your IP is hidden.

This page describes verified application behavior. The service and privacy contact email is confirmed; data retention periods and other operator details have not yet been fully published. This does not mean a full privacy review is complete.

Contact

For questions about the service or your privacy, email [email protected]. To report a link, use the report form.