Privacy Policy

onlypens.vip is designed to collect as little personal data as possible. We do not ask for your email address, phone number, or real name. This policy explains what limited data we do process and why.

1. "Anonymous" does not mean "no personal data"

Although we do not collect direct identifiers such as email or phone, certain data we handle may still be considered personal data under laws such as the GDPR and similar regimes. Specifically:

• Nickname — the public handle you choose at signup.
• IP address — processed transiently for security, rate limiting, and abuse prevention.
• Cookies — a signed session cookie and a CSRF cookie required for login and security.

2. Credentials

Your passphrase and optional recovery code are never stored in plain text. We store only a one-way argon2id hash, which cannot be reversed to recover the original value.

3. Cookies we set

• Session cookie (httpOnly, Secure, SameSite=Lax) — keeps you signed in.
• CSRF cookie (Secure, SameSite=Lax) — protects state-changing requests.

We do not use third-party advertising or analytics cookies. The site may be served behind a content delivery network (Cloudflare), which processes request metadata to deliver and protect the Service.

4. How we use data

We process the above data to operate the Service, keep accounts secure, prevent abuse, and respond to reports and legal requests. We do not sell personal data.

5. Retention

Account data is retained while your account exists. Transient security data such as IP addresses in rate-limit state is short-lived and not persisted to long-term storage. You may request deletion of your account as described below.

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data, or to object to certain processing. To exercise these rights, contact [email protected]. Because accounts are anonymous, we may be unable to verify ownership beyond control of the account credentials.

7. Children

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

8. Changes and contact

We may update this policy. Material changes will be reflected by the "Last updated" date above. Questions may be sent to [email protected].