Privacy

1. Scope and controller

This page describes how TabOnly, the TabOnly URL shortener, processes personal data. It covers the website, the short links it stores, and the API.

The controller is:

Email:

Important: This address is only for privacy and data protection requests. For everything else, in particular support, bug reports, feedback, marketing, partnerships, or collaborations, use the support page. Those requests sent to this email address will not be handled. Please type the address manually.

Telephone: +491636985193

2. This website

When you request a page, the server receives the technical connection data needed to deliver it. Depending on the hosting, that can include the IP address, the time, the requested URL, the response status, browser and operating-system information, and a referrer if the browser sends one.

The purpose is to deliver the website, keep it secure, and detect misuse. Where the GDPR applies, the legal basis is Article 6(1)(f) GDPR, the legitimate interest in operating a secure and reliable website.

This site does not run advertising or analytics scripts, and it does not load third-party fonts. The typefaces are served by TabOnly itself. A link to another site, including bookmer.com, is opened only when you follow it.

3. What this browser stores

TabOnly does not set a tracking cookie. Storage that the shortener needs does not wait for consent, because it is not used for advertising. On this device the browser keeps:

• the list of short links you created on this screen, including the name, the short code, the target address, and any end date
• a key that lets this browser open the stats for those links
• appearance, sort order, whether the footer is hidden, and the language you choose, once you set them
• your privacy choice, so this notice is not shown again

Clearing the site data for TabOnly removes that list from this device. The short links themselves stay on the server until you delete them or a date you set is reached. The legal basis is Article 6(1)(b) GDPR where the storage is needed to provide the shortener you asked for, and § 25 (2) TDDDG because that storage is strictly necessary for the service. The privacy choice is kept so a refusal is remembered. Its legal basis is Article 6(1)(c) GDPR, the duty to be able to show what you decided, and § 25 (2) TDDDG. The language choice is stored in the tabonly.lang cookie under Article 6(1)(f) GDPR.

Link marks next to a short link are drawn by the app.

4. Short links

When you shorten an address, TabOnly stores the target URL, the short code, the time it was created, and the end date if you set one. Shortening a link does not create an account by itself. The same address returns the existing code instead of a second one.

The purpose is to run the short link you created. The legal basis is Article 6(1)(b) GDPR. A link with no end date stays until you delete it. Delete removes the code, and it stops redirecting. A time in hours, days, weeks, or months removes it after that time.

Sign-in is optional. Login and Join send you to Bookmer LoginSign at id.bookmer.com. After you allow access, TabOnly stores your Bookmer user id, name, the email address you chose to share, and the profile image address when you share one. A session cookie on this browser keeps that sign-in for 30 days. Logging out deletes the cookie. The legal basis is Article 6(1)(b) GDPR. Bookmer processes the sign-in under its own privacy policy.

5. When someone opens a short link

An open is counted so the person who created the link can see how it is used. What is stored is the time, the source (for example a direct open, Google, a social app, or email), the country, and the device, browser, and system. Link previews and known bots are not counted. The same visitor is counted once every 30 seconds.

The IP address is used to determine the country and to build a hash of the visitor. The IP address itself is not stored with the open. The hash cannot be turned back into the address. The legal basis is Article 6(1)(f) GDPR, the legitimate interest in showing the creator of a link whether and from where it was opened.

6. The API

A project can create short links through the API without an account. New links are counted per month so the free allowance and any amount above it can be applied. The counter is stored against a hash of the caller’s IP address, not the address itself. The legal basis is Article 6(1)(b) GDPR for the link you asked to create, and Article 6(1)(f) GDPR for the monthly count.

7. Support and email

If you write to the controller, the message is processed in order to reply. That can include your email address, your name if you give one, the text, technical details, and attachments you choose to send.

Processing that relates to a contract, or to steps you ask for before a contract, is based on Article 6(1)(b) GDPR. Other correspondence may be based on Article 6(1)(f) GDPR, the legitimate interest in answering inquiries. Messages are kept only as long as needed to handle the request, to meet a legal retention duty, or to establish, exercise, or defend a legal claim. Please do not send passwords or other secrets.

8. Your rights

Where the controller processes your personal data and the legal requirements are met, you can ask for access, rectification, erasure, restriction, and data portability, and you can object to processing based on legitimate interests. You can withdraw consent at any time, as easily as you gave it, with Privacy choices on the Cookies page or under Settings. Withdrawal does not affect the lawfulness of processing before the withdrawal.

You can lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work, or the place of the alleged infringement. The authority for the controller’s seat is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

TabOnly does not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

The list kept only in this browser is not held by the controller. Requests about data the controller does hold go to the address in section 1.

9. Changes

This policy is updated when the service, the infrastructure, the law, or the data practices change. New processing is described here before it starts. Provider details are in the Imprint. Cookies and browser storage are described in Cookies. The terms for using TabOnly are in the Terms of Service.