Privacy
Last updated October 2026. Plain language first; this page describes what the software actually does.
What we store about creators
- Your Discord account ID, your email address if Discord provides it, and when you signed up. Sign-in is through Discord.
- Your profiles, pages, drafts, published versions and uploaded files.
- Sessions: a hashed token, when it was last used, your browser's user-agent string, and a truncated keyed hash of the IP it started from.
- A security log of sensitive actions (sign-ins, publishes, deletions).
What we store about visitors
When someone views a published page we record: which page, view or link click, the referring site's domain, a device category (mobile, tablet, desktop), a country code from our hosting provider, and a visitor hash.
The visitor hash is a keyed hash of IP address, user agent, page and date. It changes every day, can't be reversed to an IP address, and is only used to count unique visitors and stop inflated numbers. We never store visitor IP addresses. We don't use cookies on published pages for analytics. Browsers sending Do Not Track or Global Privacy Control are not counted at all.
Third parties
- Ohlow runs on the operator's computer. Accounts, profiles, sessions and uploaded files are stored on that computer. Cloudflare Tunnel carries website traffic between your browser and the Ohlow server. Traffic using the previous hosting endpoint also passes through Vercel, which forwards it to the same server on the operator's computer.
- Embeds (YouTube, Spotify, SoundCloud, Twitch, Vimeo, Apple Music) load from those services only when a creator adds them, under their own privacy policies. YouTube uses its privacy-enhanced domain.
- Fonts load from Google Fonts on pages that use them.
- Discord sign-in provides your ID, username, display name, avatar, and email when available. When configured, sign-in also asks your permission to join our community server. The community bot stores your latest status and shared activity. Your email is private. Presence becomes public only when you publish the Discord widget, and stale presence stops being shown after two minutes.
Your controls
- Download all your data as JSON from Settings.
- Delete your account from Settings. This deletes your profiles, pages, files and analytics.
- Sign out other sessions from Settings.