onelink.ninja logo onelink.ninja

Privacy Policy

Last updated: 6 October 2026

onelink.ninja is a private, non-commercial project by Roman Kuba. This page explains what personal data the service handles, why, and what you can do about it. The short version:

  • You can use onelink.ninja without telling us anything about yourself. Making and sharing lists needs no account.
  • If you sign up, we store your email address and the profile details you choose to fill in. We use them to run your account, nothing else.
  • No ads, no tracking cookies, no selling data. We count visits with privacy-friendly analytics that doesn’t use cookies.

1. Who is responsible

The controller under the GDPR is Roman Kuba, St. Pölten, Austria. For anything about your data, email onelinkninja@nerdwerk.com. See also the imprint.

2. Lists

Every list is public: anyone with the link can read it, and claimed lists can show up in search engines (see the Terms of Service). Don’t put anything into a list that you wouldn’t want the world to see.

  • What we store: the title, description and links you enter, when the list was created and changed, and its secret edit token (unclaimed lists) or owner (claimed lists).
  • Why: to show and serve your list. That’s the service you asked for (Art. 6(1)(b) GDPR).
  • How long: until you or we delete the list (see the Terms on cleaning up old lists).

While you work on a new list, your browser keeps an unsaved draft in its own local storage. That draft never leaves your device until you publish.

3. Accounts

An account is optional. If you create one, we store:

  • Your email address, to send you login links and confirm changes.
  • Your name and username, and if you add them, a bio and an avatar URL. These appear on your public profile at /@username.
  • Sessions: when you log in, we store a session together with the IP address and browser (user agent) it came from, so we can keep you logged in and spot misuse. A session ends when you log out, or after 7 days without use.
  • Login links are stored briefly and expire after 10 minutes.

Why: to provide your account (Art. 6(1)(b) GDPR) and to keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a safe service).

How long: until you ask us to delete your account. Email onelinkninja@nerdwerk.com from the address you signed up with. We delete the account; your lists become unclaimed, or we delete them too if you ask.

4. Email

Login and confirmation emails are sent through Scaleway Transactional Email (Scaleway SAS, France). Scaleway receives your email address and the message, only to deliver it. We don’t send newsletters or marketing email.

5. Avatars

If you don’t set your own avatar, our server draws one for you with DiceBear. It’s generated from a scrambled version of your account ID. No email address or other personal data goes into it, and no other service is involved.

If you set your own avatar URL, visitors’ browsers load the image from wherever that URL points.

6. Site icons

The small icons next to links are fetched by our server from favicon.im and cached. Only the website’s domain is sent, never anything about you, and your browser loads the icons from us, not from favicon.im.

7. Analytics

We count page views with Umami (Umami Software, Inc.), a privacy-friendly analytics service. Umami doesn’t set cookies, doesn’t store your IP address and doesn’t follow you across websites. We see totals like page views, referring sites, browser types and countries. Why: to understand which parts of onelink.ninja get used (Art. 6(1)(f) GDPR).

8. Hosting, logs and fonts

  • Hosting: onelink.ninja runs on Fly.io (Fly.io, Inc., USA), on servers in Amsterdam, Netherlands. Like any web server, it handles your IP address and request details to deliver pages, and keeps technical logs for a short time to fix problems and stop abuse. To enforce rate limits, the app counts requests per IP address in memory; those counts are never written to disk.
  • Backups: our host keeps automatic daily snapshots of the database for 5 days, so deleted data can remain in a backup for up to 5 days.
  • Fonts: the website loads its fonts from bunny.net (BunnyWay d.o.o., Slovenia), which sees your IP address when delivering them.

Why: to run the site reliably and securely (Art. 6(1)(f) GDPR).

9. Data outside the EU

Fly.io and Umami are US companies, so some data may be processed in the USA. Where this happens, we rely on the safeguards these providers offer for transfers from the EU, such as the EU–US Data Privacy Framework or the EU’s Standard Contractual Clauses.

10. Cookies

We only set one cookie: the session cookie that keeps you logged in. It’s strictly necessary for logging in and isn’t used for anything else. Without an account, onelink.ninja sets no cookies at all.

11. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to get it in a portable format. Email onelinkninja@nerdwerk.com and we’ll reply within a month. Your lists are always available as Markdown, and you can change your profile in the settings at any time.

If you think we’re handling your data unlawfully, you can complain to a data protection authority. In Austria that’s the Datenschutzbehörde (dsb.gv.at).

12. Changes

We’ll update this page when the service changes. The date at the top always shows the latest version.