Privacy policy

There is no sign-up and no login, so we hold no account data. When a payment completes we store the listing address, category, amount, and payment-confirmation identifiers. Card details are entered on Polar's hosted checkout and are never submitted to or stored by ONWI. Device, browser, and access logs may be processed when you reach the server. For optional email notifications, only if you opt in at checkout, we also receive the email address confirmed by the payment processor (Polar) and store it encrypted. Decline the notification box and no address is stored in the notification list. Billing records, including customer names and emails, are also imported from Polar into our private SaaS Pro revenue system. This is separate from the optional email notification list. If you allow analytics, your anonymous visit ID can be linked to your verified purchase for conversion and revenue attribution.

We use this data to run ranking boards, deliver visibility seats, prevent abuse, meet paid-ad disclosure duties, answer inquiries, and improve the Service. We do not send marketing mail without a separate opt-in. An address you opted in with at checkout is used for four things only: a notice when your seat is outbid, a monthly performance report, your seat-management link, and receipt information. You can withdraw that consent at any time.

Under the Korean E-Commerce Act we keep advertising records for 6 months and contract, withdrawal, and payment records for 5 years. Other items are deleted without delay after the purpose ends. A notification address is kept until the campaign is removed from the board or you withdraw consent, and is destroyed without delay on withdrawal. Data held in this browser stays on the device until you clear browser storage.

We do not sell personal data to third parties or provide it for marketing. We give the payment provider (Polar) the minimum data needed to process your payment.

Database and hosting: Supabase (United States). Payment processing: Polar (United States). Optional AI screening: the configured provider. Email delivery: Resend Inc. (United States). None of them may use the data for any other purpose.

If Polar or the AI review provider is outside Korea, transferred items are the URL, campaign text, and payment identifiers needed for payment and pre-publication review. We also transfer to Resend Inc. (United States) for email delivery; ask support@onwi.lol and we will give you that recipient’s contact details. The items transferred are the recipient’s email address and the subject and body of the mail; the transfer happens over HTTPS at the moment an alert, report, or manage-link mail is sent; the purpose is sending that mail. Retention lasts until each processor’s purpose ends. If you would rather nothing were transferred abroad, withdraw your notification consent — no mail is then sent, and nothing else about the Service changes.

When retention ends, electronic files are deleted so they cannot be restored, and paper copies are shredded. Browser-stored data is removed when you delete it or clear site data.

You may request access, correction, deletion, suspension of processing, or withdrawal of consent. Send requests to support@onwi.lol. Notification consent can also be switched off — or the address deleted outright — from the manage link carried in every mail we send, and deleting the address leaves the campaign you paid for exactly where it is.

Name: AKBAROV ABDURASHID RASULJON UGLI. Contact: support@onwi.lol.

We apply access control, encryption in transit, and permission management. Board data is held in a managed Postgres database the server alone can reach; the browser never receives database credentials.

To screen submissions we process the submitted link and related campaign text through an automated review pipeline (keyword and domain rules, and an optional AI reviewer). When the AI reviewer is enabled, the submitted URL and context are sent to the review provider solely for the compliance check and are not used for advertising. Review outcomes may be logged to enforce these rules and prevent abuse.

Only if you tick the box at checkout, we take the one email address confirmed by the payment processor (Polar) and attach it to that campaign. It is used for four things and nothing else: a notice when your seat is outbid, a monthly performance report, your seat-management link, and receipt information. The address is encrypted with AES-256-GCM before it is written, and the key lives in the application environment rather than the database — so the database alone cannot recover it. Matching the same person again uses only an HMAC-SHA256 hash under that same key; the plain address exists only in server memory at the moment a mail is sent. Delivery is handled by Resend Inc. (United States). We keep the address until the campaign is removed from the board or you withdraw consent, and every mail carries a manage link that turns notifications off or deletes the address on the spot. Deleting it leaves the campaign you paid for exactly where it is.

Cookieless visitor estimates run without optional analytics opt-in. Our server sends the visiting IP address and browser user-agent transiently to SaaS Pro, which combines them with the site and a random salt changed daily at midnight UTC to produce a pseudonymous visitor hash. Raw IP addresses and user-agent strings are not stored by this counting feature. Daily hashes and their deduplication records are removed after at most two UTC days; salts are replaced daily. We retain aggregate totals and breakdowns for public page paths, referring hostnames, country and device/browser categories. Aggregate history follows application retention; the lifetime total remains while the application exists. No counting ID is stored in cookies or browser storage, and these counts are not linked to purchases, recordings or person profiles. Returning visitors may count again on a new day, and shared networks may affect estimates. Do Not Track, Global Privacy Control and the footer counting switch disable collection. Hosting and security logs are separate. With your permission, our SaaS Pro platform receives page views, browser information, anonymous identifiers and performance measurements. We exclude query strings, payment tokens, management pages, checkout forms and raw error messages. An anonymous ID in browser storage recognizes returning visits. Analytics consent is renewed after 30 days; the footer preferences can stop collection and clear the ID. Session recordings and heatmaps each need an additional choice. Recordings mask text and inputs and exclude forms, images and private content. Heatmaps contain approved layout identifiers and numeric click/scroll measurements. Server reliability and AI moderation telemetry contain technical measurements, without submitted URLs, prompts or responses. Polar supplies billing records separately for revenue reporting. Previously collected records follow the SaaS Pro retention settings. Billing records, including customer names and emails, are also imported from Polar into our private SaaS Pro revenue system. This is separate from the optional email notification list. If you allow analytics, your anonymous visit ID can be linked to your verified purchase for conversion and revenue attribution.