Privacy Policy

OG Cover is operated by Rawand. For anything in this policy, or to exercise any of the rights in section 9, write to [email protected]. We aim to answer within two working days.

Under the GDPR we are the controller for the data described below. Full operator details are on the legal notice.

Worth stating first, because it is most of the answer:

• No account. There is nothing to sign up for, so we never ask for your name, your email address or a password.
• No stored images. Cards are rendered on request and streamed straight back to your browser. Nothing you make is written to a database or an image store, and nothing is kept after the response is sent.
• No stored uploads. A logo or screenshot you add travels with the render request and is never written to disk.
• No stored headlines. The text you type stays in your browser and in the request that renders it. It is not logged.
• No first-party cookies. The site itself sets none at all.
• No selling of data, ever, to anyone.

Rate limiting keeps a short-lived count in the server’s memory, keyed by IP address. It is discarded when the window passes and it is never written to disk.

This site sets no cookies. Not first-party, and at present none from anyone else either. It keeps one preference in your browser’s local storage, which is not a cookie: it stays on your device and is never sent with a request. Our analytics tool (Umami) is cookie-free by design (see section 5).

Clearing site data in your browser removes it immediately.

We use Umami Analytics, a privacy-focused, GDPR-compliant analytics tool, which we host ourselves. Umami does not use cookies, does not collect personally identifiable information, and does not track you across websites. It only collects anonymous, aggregated data such as page views and referral sources to help us understand how people use the service. The legal basis is our legitimate interest in seeing how the site is used; no advertising is involved.

No advertising runs on this site today, and no advertising cookies are set. This section is written in advance so you can see what will change before it changes.

The tool is free and carries no watermark, and rendering images costs money, so advertising is the intended way to pay for it. When it is switched on, ads will be served by Google AdSense, a service of Google Ireland Limited and Google LLC, and the following will apply:

• Google, as a third-party vendor, will use cookies and similar technologies to serve ads on this site.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• Google may use an advertising identifier to build an interest profile and show you personalised advertising, and may combine what it collects here with data it holds from elsewhere.
• Those cookies are set by Google in your browser, not by us. We never see them, and we receive only aggregate reporting about ad performance.
• Data collected by Google may be transferred to, and processed on, servers in the United States.

You can opt out of personalised advertising at Google Ads Settings, and out of third-party vendor cookies more broadly at aboutads.info/choices. Google’s own explanation of how it uses data from sites that use its services is at policies.google.com/technologies/partner-sites.

Where the law requires consent, no advertising cookie will be set before you have given it, and this page will be updated with how that consent is collected before any ad appears. Declining will leave the tool fully usable: nothing here will ever be gated behind accepting ads.

We do not sell personal data and we do not share it for anyone else’s marketing. These are the only third parties involved in running the site, including the one that is documented but not yet switched on:

We may also disclose data where the law requires it, or to establish or defend legal claims.

The rendering server sits with our hosting provider inside the European Economic Area. Google and Cloudflare operate globally, and our network layer is a global edge network. Where personal data leaves the EEA, the UK or Switzerland, the transfer relies on the European Commission’s Standard Contractual Clauses, on the UK Addendum where the UK GDPR applies, or on an adequacy decision such as the EU-US Data Privacy Framework.

Under the GDPR and similar laws you may request access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done beforehand.

In practice there is very little to request: with no account and no stored renders, we hold almost nothing that identifies you. For advertising data, the fastest route is Google, using the opt-out links in section 6.

Email [email protected]. We respond within 30 days, and usually within two working days. You may also complain to your local data protection authority.

Whatever you type onto a card ends up in the picture you download, and that picture is meant to be published. Do not put anything on a card that should not be public, including personal data about other people that you have no basis to publish.

• All traffic is encrypted in transit with TLS.
• There are no accounts, so there are no passwords or credentials to lose.
• Images are rendered on request and streamed back. Nothing you make is written to a database or an image store.
• Uploads travel with the render request and are never written to disk.
• Remote images referenced in a card are fetched through a guard that blocks private and link-local network ranges, re-checks redirect destinations, and enforces size and time limits.
• Cards are validated against a strict allowlist before rendering, with limits on nesting depth, layer count and canvas size.
• Rendering runs in a process with no ability to execute visitor-supplied code: a card is data, not a script.
• Rate limits are applied per IP address to keep one visitor from denying the service to everyone else.

To report a vulnerability, email [email protected]. We will not pursue legal action for good-faith research that avoids privacy violations, service degradation and data destruction.

This service is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us data, write to [email protected] and we will delete it.

We will post updates here and move the date at the top. For changes that materially affect what is collected, the notice will be obvious on the site rather than buried in this page.