Privacy Policy

This Privacy Policy describes how 1get ("1get", "we", "us", or "our"), a link shortening, QR code, and analytics platform operated by Future Dev Solutions ("FDS"), collects, uses, discloses, and protects information when you use the 1get web application at 1get.site, our REST API, and the 1get browser extension (together, the "Service"). This policy applies to visitors, registered account holders, organization members, and API consumers.

1. Information We Collect

We collect the following categories of information:

Account information

When you register, we collect your email address, first and last name (optional), and a password, which is hashed with bcrypt before storage — we never store passwords in plain text. If you sign in with a third-party identity provider instead of a password, see "Sign-in with third-party providers" below.

Sign-in with third-party providers

You may create an account or sign in using Google, GitHub, or LinkedIn OAuth. When you do, the identity provider shares your provider account ID, name, email address, and profile image with us, along with an access/refresh token we use solely to maintain your authenticated session. We do not receive your third-party account password.

Organization and team data

If you create or join an organization, we store the organization name, URL slug, logo, and the roles (Owner, Admin, Member, Viewer) assigned to each member. Invitations you send or receive record the invitee's email address and the inviting user.

Links, QR codes, and content you create

We store the destination URLs and custom slugs you create, along with optional settings such as expiration dates, click limits, redirect type, UTM parameters, tags, and — if you password-protect a link — a bcrypt hash of that link password (never the plain-text password). If you generate a QR code, we store its format, size, foreground and background colors, and, if you upload one, a logo image (up to 1MB, PNG/JPEG/WebP/ GIF) that is overlaid on the code.

Analytics and click data

Each time a short link is clicked, we record the timestamp, an approximate country, city, and region derived from the visitor's IP address using MaxMind GeoLite2 data, device type, browser, and operating system (parsed from the User-Agent header), the HTTP referrer, and whether the click came from a direct visit, a QR code scan, or the API. The visitor's IP address itself is never stored in raw form for click analytics — it is passed through a one-way SHA-256 hash before being written to the database, solely to support unique-visitor deduplication within a 24-hour window. We do not collect precise GPS or device location.

Billing information

Subscription checkout and billing are handled by Polar.sh, our merchant of record, and — for legacy accounts and webhook processing — Stripe. We store the identifiers these processors return to us (customer ID, subscription ID, checkout/order ID), your plan, billing cycle, and subscription status. We do not receive or store your full payment card number, CVC, or bank account details — those are collected and processed directly by Polar.sh and Stripe.

API keys and API activity

If you generate an API key to access the 1get REST API, we store a one-way hash and a display prefix of the key (never the full key after initial creation), its name, scopes, and expiration. Each API request is logged with a hashed IP address, the endpoint path, HTTP method, response status code, latency, and — for failures — a failure reason.

Audit and security logs

State-changing actions (creating or deleting links, changing roles, inviting members, logins and failed logins, subscription changes, and more) are recorded in an audit trail containing the actor, action, affected resource, a before/after snapshot of the change, IP address, and User-Agent string. This data exists to secure your account and organization and to let organization owners and admins review activity within their own organization. Platform-level actions taken by 1get super administrators (for example, support actions or account suspension) are logged separately.

Support and communications

If you contact support through the support form or by email, we collect the email address, subject, and message you submit. We keep delivery records of transactional emails we send you (welcome emails, email-verification codes, password-reset emails, billing notices, and — where applicable — follow-up emails from our team), including the recipient address, subject line, template used, and delivery status. We do not log the full body of every email we send.

In-app notifications

We store the notifications we show you inside the dashboard (title, message, type, and read status) so you can review them later.

Affiliate / partner program

If you apply to the 1get affiliate or partner program, participation begins with creating a standard 1get account; the referral source of that registration is recorded so we can attribute it correctly. Any additional information you submit as part of a partner application (for example, business or audience details) is used only to evaluate and manage your participation in the program.

2. How We Use Information

We use the information described above to:

• Create and secure your account, and authenticate you across sessions
• Provide the core Service: creating, redirecting, and managing short links, QR codes, and their analytics
• Operate multi-tenant organizations, team membership, and role-based permissions
• Process subscription checkout, plan changes, renewals, and billing through Polar.sh and Stripe
• Send transactional emails, such as welcome messages, email-verification codes, password resets, and billing/subscription notices
• Broadcast real-time click and analytics updates to your organization's dashboard via WebSocket
• Maintain audit and security logs to detect abuse, investigate incidents, and enforce our Terms of Service
• Apply rate limiting to protect the Service from abuse of authentication, link-creation, QR-generation, and API endpoints
• Respond to support requests and, with consent, send optional analytics-driven product communications
• Comply with legal obligations and enforce our agreements

We do not sell your personal information to third parties.

3. Cookies and Tracking Technologies

We use a cookie consent banner that distinguishes between mandatory and optional cookies. Your choice is stored in a user-consent-level cookie for one year, and you can change it at any time via the Cookie settings link in the footer.

Mandatory cookies (always active, cannot be disabled without breaking core functionality):

• next-auth.session-token — keeps you signed in across page navigations
• next-auth.csrf-token / __Host-next-auth.csrf-token — protects authentication forms against cross-site request forgery
• user-consent-level — remembers your cookie preference

Analytical cookies(optional, only set if you choose "Accept All", and only if the corresponding third-party service is configured for the site you are visiting):

• _ga, _ga_*, _gid (Google Analytics) — page-view and usage analytics, with IP anonymization and ad-personalization signals disabled
• _fbp, _fbc (Meta Pixel) — conversion attribution for marketing campaigns, loaded with limited data-use settings

These analytics and advertising scripts are only injected into the page after you consent; if you select "Mandatory Only", they never load.

4. Third-Party Service Providers

We rely on the following third-party service providers to operate 1get:

• Polar.sh — checkout, subscription billing, and customer portal for paid plans
• Stripe — legacy payment processing and webhook-driven subscription updates
• Google, GitHub, and LinkedIn — optional OAuth sign-in providers
• SMTP email delivery (for example NordMailer or Gmail SMTP, depending on configuration) — delivery of transactional emails
• MaxMind GeoLite2 — IP-to-location lookups used to derive approximate country/city/region analytics
• Google Analytics and Meta Pixel — optional, consent-gated web analytics and ad-conversion measurement
• Redis — self-managed caching and rate-limiting infrastructure used to serve redirects quickly and enforce request limits

Each provider only receives the data necessary to perform its function and is bound by its own privacy and security practices.

5. Data Sharing and Disclosure

We disclose information only in the following circumstances:

• With the third-party service providers listed above, to the extent necessary to provide the Service
• With other members of your organization, limited to what your role permits (for example, admins and owners can see organization-wide links, analytics, and audit logs; members and viewers see a narrower scope)
• When required by law, regulation, legal process, or governmental request
• To protect the rights, property, or safety of 1get, our users, or the public, including enforcing our Terms of Service
• In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy continuing to apply to your information

We do not sell or rent your personal information to advertisers or data brokers.

6. Data Retention

We retain account, organization, link, and analytics data for as long as your account or organization remains active. Links and user accounts use a soft-delete pattern — deleted records are flagged and hidden from the product immediately, and are purged from the database on a schedule rather than instantly.

• Email-verification codes and password-reset tokens expire automatically, typically within a short window (minutes to hours), and are single-use
• Team-invitation tokens expire after a set period if not accepted
• Audit logs and super-admin audit logs are retained for security, compliance, and dispute-resolution purposes even after related resources are deleted
• Billing event records are retained to reconcile subscriptions, invoices, and support disputes with Polar.sh and Stripe

You may request deletion of your account and associated personal data at any time by contacting us, subject to the retention needs described above (for example, retaining minimal billing and audit records required by law or fraud prevention).

7. Data Security

We implement technical and organizational safeguards that reflect what is actually built into the platform, including:

• Encryption in transit via HTTPS/TLS, with HTTP Strict Transport Security (HSTS) enforced on our production domains
• Security response headers, including X-Content-Type-Options, X-Frame-Options, and a restrictive Permissions-Policy that disables camera, microphone, and geolocation access by default
• Passwords hashed with bcrypt; API keys and link passwords stored only as one-way hashes
• IP addresses hashed with SHA-256 before being stored for click analytics and API-activity logs
• Role-based access control (Owner, Admin, Member, Viewer) enforced on every API route, with all data scoped to your organization
• Redis-backed rate limiting on authentication, link creation, QR generation, analytics, and API endpoints, with a fallback to in-memory limiting
• Comprehensive audit logging of state-changing actions, including actor, IP address, and before/after snapshots
• Automated malware-signature scanning of the codebase as part of our deployment pipeline

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will notify you as required by applicable law.

8. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data (for example, via your profile settings)
• Delete your account and associated personal data, subject to the retention exceptions above
• Export your data (for example, analytics and audit-log export tools available in the dashboard for your own organization's data)
• Object to or restrict certain processing, including opting out of optional analytics cookies at any time
• Withdraw consent for optional cookies and analytics without affecting the lawfulness of processing before withdrawal

California residents have the right to know what personal information is collected, to know whether it is sold or disclosed (we do not sell personal information), and to request access to or deletion of their personal information, consistent with the California Consumer Privacy Act (CCPA). Users in the European Economic Area, United Kingdom, and Switzerland have rights under the General Data Protection Regulation (GDPR), including the rights listed above and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us using the details in the "Contact Us" section below.

9. Browser Extension

The 1get browser extension (available for Chrome, Firefox, and Safari) stores your API key and preferences in your browser's encrypted sync storage, and keeps a local history of the last 50 links you have shortened directly in your browser. The extension does not collect your browsing history, does not use analytics or crash-reporting services, and communicates only with 1get.site and its API. The extension's full, dedicated privacy policy is available in its store listing and documentation, and this Privacy Policy governs the 1get account and server-side data referenced from within it.

10. International Data Transfers

1get and the third-party service providers listed above may process and store data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms offered by our providers) to protect data transferred internationally.

11. Children's Privacy

1get is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the "Last updated" date above when we do, and material changes to how we use cookies will re-prompt the consent banner. Continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.