Your personal information is never for sale
We do not sell personal information to any third party whatsoever. No exceptions, no excuses. We do not rent or trade personal information as a substitute for selling it.
We handle privacy with care: we limit access to private account information, use access controls and secure password hashing, and process information for the purposes explained in this policy. Using infrastructure providers to operate the service does not create an exception to our no-sale commitment.
Scope and our responsibilities
This policy explains information handling for the Ons.Bio website, account dashboard, public link-in-bio pages, visitor inbox, creative tools, and support interactions. “Ons.Bio,” “we,” and “our” refer to the service operating this platform. It applies whether you create a page, browse a page, leave a message, report content, or contact us. It does not replace the separate notices of websites you visit through a profile link.
Ons.Bio determines how information is used to operate accounts, authenticate users, protect the platform, administer access, and respond to support and legal matters. For these purposes, we act as a controller where that term applies. We also host content and process page activity for page owners. Our role for a particular activity depends on who determines its purposes and means; describing us as a processor in a page disclosure does not remove our independent responsibilities for our own operations.
Page owners and privacy disclosures
Page owners select the profile information, images, typography, links, and other content they publish. They also decide whether to enable their inbox and how to use the analytics available to them. A page owner may have separate privacy responsibilities for messages received, their use of analytics, and information collected by services they link to.
The privacy panel on a public page identifies the parties and responsibilities described for that page. These disclosures are maintained by Ons.Bio administrators, not edited directly by ordinary account holders. A displayed controller name is context for that page; it is not a blanket statement about every processing activity. Contact support with the page URL if a disclosure appears inaccurate or you need help identifying the appropriate recipient of a request.
Account and operational information
When you register or manage an account, we process your name, email address, account identifier, authentication records, and account creation information. Password authentication uses password hashing rather than storing the password as ordinary readable text. We retain one-way password hashes to prevent reuse of current and previously recorded passwords. Password recovery uses expiring, single-use links; a successful reset invalidates outstanding reset links and existing sign-in sessions. Session records can include technical information such as IP address, browser user agent, and expiry timestamps. Session cookies allow the service to recognize a signed-in browser.
We also store onboarding status, the country inferred at signup when available, country-sharing preferences, role and restriction status, verification status, plan entitlements, and administrative changes. Administrative audit records identify the affected account, the administrator, the action, and its time. Support correspondence includes the information you choose to send and what is needed to address your request.
If you provide a birthdate at signup or in Settings, we store it privately to determine age-appropriate access. It is not included in public profiles or public-page responses. Age eligibility is calculated from this self-declared date; it is not identity or document verification. Once recorded, birthdate corrections require contacting support. Accounts without a birthdate do not receive age-restricted features.
Your account email is not automatically displayed on your public profile. If you put an email address or other personal information in your biography, links, images, or messages, it will be available to the intended audience of that content.
Public profiles, uploads, and visibility
A public page is created as part of the account experience. Saved profile edits and enabled links can reach visitors without a separate publication step. Public information can include your username, display name, biography, profile images, page design, links, selected fonts, browser title and icon where available, verification badge, and account join month and year. Signup-country sharing is enabled by default where a country is available; you can turn it off in Settings.
We store uploaded file content and associated details such as filename, file type, size, ownership, and creation time. Font uploads also store the selected license category, agreement version, and acceptance time. Images uploaded through the standard image uploader are re-encoded, removing embedded metadata such as GPS tags. This does not remove information visible in an image or guarantee that every externally hosted or generated asset has the same processing history.
Assets attached to public content are delivered to visitors so their browsers can display them. Unpublished uploads are access-controlled rather than intentionally listed as public assets. Public display is not copy protection: a visitor may capture or redistribute what they can see, and search engines or third parties may retain copies outside our control.
Page analytics and approximate location
Our first-party page analytics store event identifiers, the page involved, whether an event was a view or link click, the relevant link identifier and title, a timestamp, and approximate country and state or region when available. Pages with administrator-granted Private Client access can also store approximate city information supplied by hosting geolocation. These locations are not GPS coordinates or a precise address. They can be wrong or unavailable, including because of a VPN or network routing.
Page owners can see totals, recent events, link performance, and available geographic breakdowns. These are activity counts, not verified identities or a reliable count of unique people. Visits to your own public page can count. Editor previews and recognized bots are excluded, but detection is not perfect. A combination of timestamps, location, and other information someone already knows may still allow inferences about a visitor.
The page-event table does not store visitor names, email addresses, raw IP addresses, or precise coordinates. This limitation applies to that table, not to all systems involved in a request: hosting, authentication, and abuse prevention can process additional technical information. Production pages also include Vercel Web Analytics for service-level usage measurement. Its collection and processing are separate from the page-owner analytics described above.
The current application has no automatic expiry for stored page-event records and no built-in visitor switch that disables all page analytics. Cookie removal alone is not an analytics opt-out. See Your data, your choices for available request routes and the limitations of identifying an individual event.
Visitor messages and anonymous names
The inbox is off by default. When a page owner enables it, a visitor can send message text and an optional name without creating an account. We store the message, recipient account, message identifier, sender-provided name if supplied, creation time, and read status. The recipient can read these messages through their authenticated inbox; they are not automatically published on the bio page.
Leaving the name blank means no sender name is attached for the recipient. It does not mean the submission is technically untraceable. To limit spam, the server derives a keyed hash from the request IP address and recipient page and stores that hash with the message. The inbox response shown to the owner does not expose that hash. Hosting infrastructure still receives request information. A name entered by a sender is not verified identity.
Messages are not end-to-end encrypted. Treat them as correspondence processed by the service and delivered to another person, not as a confidential vault. Do not send passwords, payment details, or highly sensitive information. Turning off an inbox prevents new submissions but does not delete existing messages. There is currently no self-service message-deletion control; contact support for a deletion request.
Creator subscriptions and promotional email
When you submit a creator’s follow form after reading its email disclosure, we send your email address and creator-specific opt-in preference to Resend. Resend stores the contact and its segment and topic memberships. The creator can see email addresses, contact creation dates, and the topic preferences of contacts in that creator’s own profile segment through the authenticated Audience dashboard. Your address and subscription records are not included in public profile responses.
A creator may send updates and promotional messages using Ons.Bio’s sender address. Campaign content and sender mailing-address disclosures are stored in Resend. Each campaign includes a Resend-managed unsubscribe or preference link. Creator-specific topic opt-outs do not opt you out of other creators, while account-wide opt-outs and provider suppression may prevent delivery across Ons.Bio. Existing account-wide opt-outs are not reversed by submitting a follow form.
We use request information, including a keyed profile/IP hash held temporarily in the application runtime, and provider request limits to reduce signup abuse. This feature does not add subscriber geography, a separate database consent audit history, or custom delivery analytics. Unsubscribing stops eligible future campaign delivery but does not delete the stored contact or recall emails already handed to the provider. Contact support@ons.bio with the relevant creator page and email address for access or deletion requests.
Payments and paid account features
Stripe processes payments for Celeste and the separate Verified Star add-on. We store purchase identifiers, the account email used for checkout, product, amount, currency, payment status, and related Stripe identifiers. Payment-card details are collected by Stripe rather than stored in the platform database.
Verified Star indicates a purchased creator add-on, not an identity or notability review. It is separate from both Celeste and administrator-reviewed profile verification. A paid star is visible on public profiles belonging to the account while the entitlement is active.
Records from discontinued creative features may remain in storage until removed through an operational process. Discontinuing a feature does not erase its historical records or previously published uploads. Contact support to request access or deletion.
Reports, abuse prevention, and security
When you report a page, we store the reported account, selected reasons, optional details, a report identifier, timestamps, review status, and relevant administrator information. Abuse prevention uses a keyed reporter hash derived from a date and available request information, such as an IP address or browser user agent. A hash is a pseudonymous identifier, not a promise of complete anonymity.
We use access checks, upload validation, request limits, and administrative review to help protect the service. Reports and security records may be processed to investigate misuse, resolve disputes, protect people, or respond to lawful requirements. Avoid including unnecessary personal information in a report. A report is not posted publicly by the reporting feature, but information may need to be shared for an investigation or legal obligation.
Purposes and legal grounds
We use information to deliver public pages, maintain accounts, save edits, provide requested messages and creative features, show analytics, support users, and address misuse. We do not treat every use as consent simply because someone visits a page. Where a data-protection law requires a legal basis, the basis depends on the activity and the relationship with the person concerned.
For account services you request, processing may be necessary to perform the service agreement. Security, fraud prevention, service reliability, and appropriate operational measurement may involve legitimate interests, subject to applicable balancing requirements and rights to object. Legal compliance can require processing independently of a contract. Where consent is required for a particular use, it must be obtained in the manner required by law; withdrawing consent does not invalidate processing lawfully carried out beforehand.
A page owner is responsible for identifying an appropriate basis for their own use of visitor information. Our platform notice is not a substitute for a page owner’s notices, consent obligations, or other legal duties.
Recipients, providers, and external links
Information is processed by infrastructure and service providers needed to run Ons.Bio. The current stack includes Vercel for hosting and related delivery or analytics services, Neon for database storage, Resend for account and security emails, creator subscriber storage, subscription preferences, and promotional campaigns, and Stripe for payments. Better Auth supplies the authentication software; account authentication records use the platform database. Authorized operational access may be needed for support, security, or administration.
Public content is shared with visitors by design; inbox content goes to the intended page owner; analytics are made available to the relevant account. Information may also be disclosed when required by law or reasonably necessary to protect rights and safety. We do not sell personal information to any third party whatsoever, including as part of a business transfer. There are no exceptions to our no-sale commitment. Necessary service processing and lawful disclosures are not permission to sell your information. These descriptions are not a promise that all data remains with one organization or in one country.
YouTube thumbnails are retrieved through our server rather than loading your browser directly from YouTube’s image servers. Selecting a video opens YouTube; no video player automatically runs on the bio page. Some older externally hosted profile images may still load from their original host. Other profile links open destination websites, which can receive request information and apply their own cookies and policies. Do not assume that Ons.Bio’s settings control those services.
Retention, deletion, and international processing
The application currently retains most account content, uploads, inbox messages, reports, analytics, and records from discontinued features until they are removed through an available control or an operational process. It does not implement a single automatic deletion period for these categories. A session expiry or a usage-limit window is not the retention period of the associated content.
Unused uploaded fonts can be permanently deleted from the font library after they are deselected. Removing a link or changing an image changes the live page; it does not necessarily delete the underlying upload, past analytics, or assistant change records. For account closure, other erasure, or retention questions, contact support. Requests may need to account for security records, legal requirements, disputes, technical backups, and other people’s rights. We do not promise immediate erasure from every backup or third-party copy.
Providers may process information in countries other than your own. This policy does not assert that a particular storage region, certification, or transfer mechanism applies to every account. Where cross-border safeguards are legally required, they must be addressed for the relevant processing. Contact support for information about arrangements applicable to your request before relying on a location-specific requirement.
Your rights and requests
Depending on the law that applies, you may be entitled to request access, correction, deletion, restriction, or a portable copy of information; object to certain processing; or withdraw consent where consent is the basis. Rights can be subject to exceptions and verification. You may also have the right to complain to the relevant data-protection authority. Nothing in this policy limits rights that cannot lawfully be excluded.
Email support@ons.bio with the relevant account or page URL and a description of the information and action concerned. We may ask for proportionate evidence that you are the account holder, affected visitor, or authorized representative. Never send your password, session token, or unnecessary identity documents in an initial email. Where another controller is responsible, we may need to direct you to them or coordinate a response.
Because page events do not contain a visitor account identifier, we may not be able to reliably associate a particular event with you. Provide relevant context such as the page and approximate time without assuming that we can retrieve a personal browsing history. Your data, your choices explains the current dashboard controls and request process in more detail.
Children, safety concerns, and policy updates
Ons.Bio is not designed to collect information from children who cannot lawfully use the service or provide the permissions required in their location. If you believe a child’s information has been shared improperly, contact support with enough context to locate it. Do not forward harmful material or unnecessary identifying details. Applicable child-protection and privacy requirements remain in effect regardless of account access.
We may update this policy when the service or its information practices change. The date at the top identifies the latest revision. Material changes may require additional notice or consent under applicable law; a revised page is not, by itself, permission to use information for an incompatible purpose. Contact support if you need clarification about a change or which notice applied to an earlier activity.