Privacy policy

Who is responsible

The data controller is the publisher of One For All, a private individual acting in a non-professional capacity (see the legal notice).

For any question or request about your data, write to contact@oneforall-tools.com.

Tools that run in your browser

Most tools (PDF, images, video and audio, text, developer, design, calculators, security) process your files and text directly in your browser, using WebAssembly and Web Workers. Your files are not uploaded: they never reach our server, so we cannot see, keep or share them.

To work, these tools download their code and, for some, a model (text recognition, transcription, background removal) from our own server. These downloads contain nothing about you. A few preferences are remembered in your browser only; they are listed in the cookie policy.

Tools that use our server

A few tools cannot work entirely in your browser. Each one says so in its work area. Here is exactly what they send and keep:

• Open Graph preview, SEO analyzer and broken link checker: the web address you enter is sent to our server, which fetches that page itself, under its own name (and also, for the preview, its sharing image; for the checker, each link found on the page). The sites you check see our server, not you. We do not store the address, the page or the results.
• Currency converter: our server downloads the reference exchange rates published by the European Central Bank and keeps them for 6 hours. Your amounts are calculated in your browser and are never sent.
• What is my IP address: the address shown is the one our server sees for your connection. It appears in the page only, is never recorded or logged by the tool, and its approximate country and network provider are worked out on our own server from the free DB-IP databases, without asking any third party.
• Internet speed test: your browser exchanges random data with our server to measure your connection. Nothing is kept, apart from the usual abuse-prevention counter, keyed on a fingerprint of your IP address (see below), which limits the number of tests per hour.

Like any request, these may appear in the technical logs described below.

Your account

An account is only needed for the features that store data: short links, dynamic QR codes, link pages, websites and click statistics. For your account, we store:

• your email address;
• your password, only as an Argon2id hash: we never know or store the password itself;
• your preferred language, so that our emails reach you in that language;
• the dates of creation, last change and email confirmation.

Nothing else: no name, no IP address, no device information. When you change your email address, the new address is kept with its confirmation link until you confirm it or the link expires.

When you sign up or change your email address, we check that it does not come from a disposable email service (a list kept on our server) and that its domain can receive email. For this, our server asks the DNS for the mail servers of the domain only (the part after @) or, if it has none, for its address, never for the full email address. Nothing from this check is kept.

The links we send by email are single-use, and we store only a fingerprint (SHA-256) of each one. A confirmation link (new account or new address) expires after 24 hours, a password reset link after 1 hour.

An account whose email address is never confirmed is deleted automatically once it is more than 7 days old.

You can delete your account at any time from your account settings. Deletion is immediate and final: your account, sessions, links, QR codes, link page, avatar, website (with its images and messages) and statistics are erased.

Sign-in sessions

When you use the sign-in or sign-up pages, a session cookie keeps you signed in and protects forms (see the cookie policy). On our server, we store only a fingerprint (SHA-256) of the session identifier, your account number, a security token for forms and the session dates. No IP address and no browser information.

A session ends after 2 hours without activity, and after 30 days at most. If you choose to stay signed in, it lasts 30 days. Signing out ends it immediately.

Short links, QR codes and link pages

For each short link, dynamic QR code or link on your link page, we store the destination address, the title you give it, its short code and the options you choose (password, stored only as an Argon2id hash; expiry date; click limit; on or off), with its creation and update dates.

For your link page: its address, display name, short bio, avatar, theme, and whether search engines may index it. The avatar is re-encoded on our server as a 256 × 256 image, which removes its metadata (location, camera model…).

A link page and its links are public by nature: anyone with the address can see them. Search engines are asked not to index your page unless you choose otherwise. QR code images are drawn in your browser and are not stored.

Websites

For your website, we keep its content (texts, contact details, opening hours, links and the images you upload), its settings, the published version and, for 90 days, the previous published versions. Images are resized in your browser, then converted on our server, which removes their metadata (place, device).

A website is public by nature: the business details you publish on it (name, address, phone number, legal information) can be seen by anyone, and search engines may index it if you allow it and it meets our conditions.

When a visitor writes to you with the contact form, we keep their message, their name and the contact details they give, encrypted, for 90 days at most, so that you can read them in your account. We do not read them unless you report a message to us. Card numbers, IBANs and one-time codes we detect are masked before the message is saved. To let you block a sender, we also keep an irreversible fingerprint of the sender.

Your website’s statistics (visits, button clicks, messages received) are daily totals, without cookies or IP addresses. They are kept for 13 months.

As the French law on confidence in the digital economy requires of hosting providers, we keep for one year, for each creation, change, publication or deletion of your website, the date and the IP address used, as well as the source port when it reaches our server. This data is encrypted with a public key as soon as it is recorded: the key that can read it is not on our server, and it is only opened at the request of a judicial authority.

If your website is reported or is the subject of a moderation decision, we keep a frozen copy of it (content and images) until the decision, then for 12 months, or longer if an authority asks us to.

When you type an address in the editor, our server sends it, without your IP address, to the French national address database (Base Adresse Nationale, IGN) or, outside France, to Photon (komoot, OpenStreetMap data), to suggest addresses. The map shown on your website is an image our server makes from OpenStreetMap data: your visitors do not contact any third-party service.

Click statistics

When someone opens one of your short links, QR codes or link page buttons, we count the visit without identifying the visitor. We keep only daily totals per link:

• the number of clicks per day, with robots and link previews counted separately;
• the referring website, as a domain name only (for example example.com), never the full address;
• the device class (mobile, tablet or desktop) and the browser family (Chrome, Safari, Firefox…);
• the country, as a two-letter code, only if a trusted content delivery network placed in front of our server provides it; we never work out a country from an IP address ourselves. Otherwise the country is recorded as “unknown”.

We never store the visitor’s IP address, full browser identifier or the full address of the referring page, and nothing allows two clicks to be linked to the same person. To prevent artificial inflation, a visitor is counted only a limited number of times per minute for the same link: this uses a temporary counter keyed on a keyed fingerprint (HMAC) of the IP address, IPv6 addresses being grouped by /64 network. The counter contains no IP address and expires after one minute.

Statistics are kept as long as the link exists, and erased with it or with your account.

Audience measurement

To know which tools are used and to keep the site fast, we count page views: for each day, the number of visits per page of the site and per language, the number of responses in error and the time our server took to respond. Automated visits (robots, link previews) are counted separately, based on the browser identifier, which is not kept.

This counting uses no cookie, no identifier and no IP address, and never records the full address of the page or of the page you came from: no visitor can be recognized or followed from one page to another. The raw counters of the current hour are grouped into daily totals and then erased; these totals are kept for 25 months.

Reports

When you report a link, a page or a website with our reporting form, we keep your report (the address concerned, the type of problem and your explanation) and, only if you give them, your name and email address, to review it and to tell you our decision. They are never shared with the person who created the content, unless the law requires it. Reports are deleted 12 months after they are handled.

Abuse prevention and security

To protect the site against brute force and abuse (sign-in attempts, sign-ups, link creation, server tools), we count requests in short time windows. The visitor is identified only by a keyed fingerprint (HMAC-SHA-256 with a secret key) of their IP address, IPv6 addresses being grouped by /64 network; the IP address itself is never stored. Depending on the action, these counters last from one minute to 24 hours.

To block phishing and malware, our server regularly downloads public lists of dangerous sites (URLhaus by abuse.ch, and OpenPhish) and checks link destinations against them on our own server. Nothing about you or your links is sent to these services.

Links, QR codes, link pages, websites and accounts detected or reported as abusive can be suspended or deleted (see the terms of use). We then keep the date and the reason for the decision, and explain it to you by email. The short code of a suspended or deleted link stays reserved so that it cannot be reused; we keep only that code and the suspension date. Each decision is recorded in an internal moderation log (date, item concerned, reason, author of the decision).

Emails

We send emails only about your account: address confirmation, password reset, change of address, and security notices (password or address changed, sign-up attempt with an address that already has an account). No newsletter, no advertising. They are sent through our email provider, which processes your address and the message only to deliver them.

If you write to us at contact@oneforall-tools.com, we use your address and your message only to answer you.

Technical logs

Like any website, ours runs on web servers that keep a technical log of requests: IP address, date and time, requested address, response status, referring page and browser identifier. This log is kept by our host, OVH SAS, for the period it sets; we use it only to keep the site secure and to fix problems, never for statistics or profiling. The secret links we send by email never appear in it: their secret part is sent only with the form you submit, never in the address of a page.

Legal bases

• Performance of our contract with you (the terms of use): your account, sessions, links, QR codes, link page, website and its messages, statistics, account emails, and the server tools you choose to use.
• Our legitimate interest in keeping the site secure and free of abuse: request counters, anti-phishing checks, moderation and technical logs.
• Legal obligation: keeping the identification data required of hosting providers, and answering requests from the competent authorities with the data we hold.

We do not use your data for advertising or profiling, and we do not need your consent for the few items stored in your browser, as explained in the cookie policy.

How long we keep data

• Account: until you delete it.
• Account never confirmed: 7 days.
• Links sent by email: 24 hours (confirmation), 1 hour (password reset), or until used.
• Sessions: 2 hours without activity, 30 days at most.
• Links, QR codes, link page, avatar and click statistics: until you delete them or your account.
• Ending of a deleted short link: reserved for you alone for 30 days (for nobody if you delete your account), so that no one else can take over the links and QR codes you already shared. After that, as for the names of link pages that are no longer used, we keep only a fingerprint (HMAC) from which the name cannot be read back, with no time limit: it only tells us that it has already been used, and its new visitors then confirm the destination for 7 days. For the name of a link page, we also keep a fingerprint of the account that used it, as long as that account exists: it is erased when the account is deleted.
• Website: until you delete it or your account; previous published versions: 90 days.
• Messages received through your website: 90 days.
• Website statistics: 13 months.
• Data identifying the creation and changes of your website (IP address, and port when it is known): 1 year.
• Frozen copies of a reported website: until the decision, then 12 months.
• Moderation log: 12 months.
• Audience statistics (anonymous daily totals): 25 months.
• Reports: 12 months after they are handled.
• Messages you send to our contact address: as long as needed to deal with your request, then 12 months at most after our last reply.
• Request counters: from one minute to 24 hours.
• Technical logs: kept by our host, OVH SAS, for the period it sets.
• Technical backups (database and files, to recover from a failure): 14 days, then they are erased. Deleted data therefore also disappears from the backups within 14 days at most.

Expired data can no longer be used. It is erased by an automatic clean-up that runs as the site is used, so it may remain stored a little longer than these durations.

Who receives your data

We never sell or rent your data, and we do not share it for advertising. Only these service providers process it, on our behalf and for the purposes above:

• our hosting provider (OVH SAS), which runs the server and stores the database;
• our email provider, to deliver account emails;

Data may also be disclosed to the authorities when the law requires it.

Transfers outside the European Union

We choose hosting and email providers that store data in the European Union. If that changes, this policy will say so and name the safeguards used.

Your rights

Under the GDPR, you have the right to:

• access your data and receive a copy of it;
• have it corrected: you can change your email address, password and language in your account settings, and edit your links and link page at any time;
• have it erased: deleting your account from your settings erases everything linked to it at once;
• receive the data you gave us in a structured, machine-readable format (portability);
• object to processing based on our legitimate interest, and ask for processing to be restricted;
• give instructions about what happens to your data after your death (French law).

To exercise these rights, write to contact@oneforall-tools.com, ideally from the address of your account. We reply within one month. If there is a reasonable doubt about your identity, we may ask you to confirm it.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the country where you live.

How we protect your data

• encrypted connections (HTTPS with HSTS) and strict security headers, including a Content Security Policy;
• passwords hashed with Argon2id and checked against a list of common passwords;
• session identifiers and the secret part of email links stored only as SHA-256 fingerprints, and never placed in the address of a page; IP addresses never stored in clear in our database: only as keyed fingerprints in request counters and, for websites, sealed with a public key in the identification log;
• isolated server tools: web pages are fetched by a component that refuses private and internal addresses, and the images you upload are checked, then re-encoded in a separate process;
• minimal collection: anonymous audience measurement without cookies or IP addresses; no advertising, no tracking.

Changes to this policy

We update this policy when the site changes; the date at the top shows the current version. If a change significantly affects how your data is used, we will tell account holders by email before it applies.