Terms & Privacy

Welcome to INOCULENS Tunnel. These Terms of Service and Privacy Notice govern your use of our website and services. By using our service, you agree to these terms in full. There are no accounts: the service works with random session identifiers stored in your own browser.

1. Description of Service

INOCULENS Tunnel provides URL shortening, deep linking (opening supported links directly in their apps), per-link analytics for link creators, and managed custom short domains with TLS certificates. The free tier (links on our shared short domain) requires no payment. Managed custom domains are a paid service described in §3.

2. Acceptable Use Policy

You are solely responsible for the content you link to using our service. You agree not to use INOCULENS Tunnel for:

• Spamming or unsolicited bulk messaging.
• Phishing, identity theft, or fraudulent activities.
• Distributing malware, viruses, or harmful code.
• Linking to content that is illegal in the European Union or the jurisdiction of the origin/destination.
• Content involving the exploitation of minors or non-consensual sexual material.

Submitted destinations are screened automatically against threat lists, and our administration reviews flagged content. We may quarantine links or suspend custom-domain integrations that violate this policy, without prior notice. If you believe a link or domain was restricted in error, contact us through the in-app Report page and we will review it.

3. Custom Domains, Payments, Refunds & Withdrawal

3.1 Fee, quotes & coverage

Managed custom short domains cost $10 USD per domain per year, payable in Bitcoin. Each domain receives its own unique payment address, so multiple domains may be paid in any order. A quote is valid for 7 days; requesting a new quote for the same domain re-uses the same address. Send the exact quoted amount — the Bitcoin network fee is separate and paid by you. Underpayments must be topped up to the same address; overpayments or payments to expired addresses are handled case by case through the Report page.

Your domain activates after the payment's first blockchain confirmation (unconfirmed payments never activate; partial payments are shown so you can top up). Coverage lasts one year and early renewals stack remaining time on top. If coverage lapses, links on that domain stop resolving until renewed; deleting a domain permanently deletes its links and statistics. Discount codes, where issued, are single-use unless stated otherwise, bound to the first domain redeeming them, may carry an expiry date, have no cash value, cannot be transferred, and removing a code returns the domain to full price.

3.2 Refunds

Blockchain payments are irreversible by nature, and coverage usually begins immediately upon confirmation. If you believe a fundamental malfunction of the service itself — as opposed to registrar, DNS, or wallet-side issues — deprived you of the coverage you paid for, you may submit a refund request through the in-app Report page from the session that owns the domain, identifying the domain, the payment address, and the transaction. Where a refund is granted, it is paid exclusively to the address the funds originated from, within a reasonable time after our review. All refunds are at the administration's sole discretion following its review and are not guaranteed. Nothing here limits your mandatory statutory rights, including the withdrawal right in §3.3. No refunds are due for discount-code activations, as no payment was made, nor for miner/network fees, which we never receive.

3.3 Statutory right of withdrawal

Consumers in the EU have a 14-day right of withdrawal for online purchases. Because coverage normally starts immediately upon payment confirmation, the payment screen asks for your express consent to begin performance at once, together with your acknowledgment that you lose the withdrawal right once the service has started; we record that consent with the order. Where the service has not yet started (no confirmation credited), withdrawal is honored with a refund to the originating address. This section does not affect the discretionary malfunction refunds in §3.2.

3.4 Renewal

It is your responsibility to renew before expiry to avoid interruption. Renewals work exactly like first-time payments: a fresh address is issued per domain and the new year stacks onto any time remaining.

4. Privacy Notice

The data controller is [LEGAL NAME], [COUNTRY]. Contact for all privacy matters (including the address below): through the in-app Report page, or the contact address revealed after the human check in §7. [POSTAL ADDRESS — TO COMPLETE: a geographic address is required by Art. 13(1)(a) GDPR and EU consumer law; this page ships knowingly incomplete here.] No data protection officer has been designated; direct all privacy matters to the controller contact above. The competent supervisory authority is that of [COUNTRY — TO COMPLETE, e.g. ANSPDCP for Romania], and you may complain to it or to the authority of your residence at any time.

4.1 What we process, why, and on what basis

• Session ID, link history, analytics choice (browser local storage: tunnel_session_id, tunnel_history, tunnel_consent). Purpose: operate the account-free service, remember your links and your consent choice. Basis: performance of the service you requested (Art. 6(1)(b) GDPR); the consent record itself is kept to demonstrate compliance (Art. 7(1)). Kept in your browser until you clear it.
• Your content with us: links, labels, custom-domain records, quotes, payment records, and the withdrawal-consent record. Purpose: provide shortening, domains, billing, and proof of consent. Basis: contract, Art. 6(1)(b).
• Click data (other people clicking your links): timestamp plus the visitor's full IP address, shown to the link creator in Click Analytics so repeat and unique visits can be told apart; no device, referrer, or other attributes are stored. A truncated form (IPv4 reduced to the /24 network, IPv6 to the /64 network) is kept alongside for rate limiting and for entries recorded before full addresses were stored. Purpose: per-visit analytics for creators and service security. Basis: legitimate interests, Art. 6(1)(f). This data reaches us through creators' use of the service. Deleting a link's click history (per entry or Purge All Logs) removes these addresses with it.
• Issue reports: your message, Session ID, IP address, browser identifier, and an email address only if you leave one so we can reply. Purpose: support and abuse handling. Basis: your consent by submitting, plus legitimate interests in keeping the service safe. Emailed to us; removed on request (see §4.2).
• Human-verification challenges: your IP address is sent to Cloudflare during a check. Purpose: fraud and abuse prevention. Basis: legitimate interests, Art. 6(1)(f).
• Site analytics (Google Analytics): loads only after you accept the banner; declining disables it entirely; change your choice anytime via the banner or by clearing site storage. Basis: consent, Art. 6(1)(a).
• Fonts (Google Fonts): your IP address and browser identifier are technically transmitted to Google to render page text. Purpose: site functionality. Basis: legitimate interests; no content or profile data.
• Link safety screening (Google Safe Browsing): submitted destination URLs are checked against threat lists before a link is created. Basis: providing the service securely.
• Domain verification (Google DNS-over-HTTPS, Cloudflare SaaS certificates): custom-domain names and validation data. Basis: providing the ordered custom-domain service.
• Payment detection (mempool.space) and price feeds: payment addresses and public price data; no personal data beyond the pseudonymous address. Basis: providing paid coverage.
• Mail delivery (Zoho, EU region): issue-report notifications containing your report. Basis: handling your request.

4.2 Retention & erasure

Links and their click details persist until you delete them — individually or with “Delete All Links,” which removes your session's link records and their click logs (aggregate counters may persist in summarized form). Deleting a custom domain permanently removes its links and statistics. Sessions, counters, domain records, promo redemptions, and reports persist until removed: link creators delete their own data in the app; anything else — including full session erasure — is done on request: send us your Session ID through the Report page (or the §7 contact) and we will erase everything tied to it. “Start Fresh” clears only your own browser, never our servers.

4.3 Processors & transfers

We use: Netlify (hosting, functions, database — all service data lives here), Cloudflare (network delivery, human verification, custom-domain certificates), Google (Fonts, consent-based Analytics, Safe Browsing, DNS lookups), mempool.space and public price feeds (payment detection and quoting), and Zoho Mail in the EU (report notifications). Each receives only what its function requires, under data-processing terms. Where processing happens outside the EEA, transfers rely on the GDPR Chapter V safeguards in those terms. Where we cannot identify you (e.g. bare click data), your Session ID or equivalent detail is needed to act on a request (Art. 11).

4.4 Your rights & breach notice

You hold the GDPR rights of access, rectification, erasure, restriction, portability, objection, and consent withdrawal (Arts. 12–22), plus the right to complain to a supervisory authority (Art. 77). Exercise them with your Session ID through the Report page or the §7 contact; we respond within one month. If personal data is breached in a way that risks your rights, we notify the supervisory authority within 72 hours and inform you directly where required (Arts. 33–34).

5. Limitation of Liability

The service is provided “as is.” We warrant that coverage you paid for resolves your links while valid, and we are liable without limitation for intent and gross negligence. Otherwise, to the extent permitted by law, we are not liable for destination content, indirect losses, or interruptions beyond our control. Nothing here limits liability that cannot be limited under applicable law, including GDPR Art. 82 claims and mandatory consumer rights.

6. Governing Law & Disputes

These terms are governed by the laws of [COUNTRY]. Courts there have jurisdiction on a non-exclusive basis: as an EU consumer you keep the right to bring proceedings in your own domicile, and nothing here removes mandatory protections of your home country. For out-of-court settlement, contact us first; you may also turn to a recognized national consumer ADR body in your country.

7. Contact

The data controller is [LEGAL NAME], [COUNTRY]. For legal inquiries, abuse reports, refund requests, or data-protection requests (access, erasure), contact us at the address below. To keep it out of spam harvesters, the address is revealed only after a quick human check — no data is collected for the check itself beyond the verification:

Tip: link creators can delete their own links immediately in the app; no request needed. Only issue reports require contacting us for removal.

8. Age Requirement

Our service is directed to persons aged 16 and over. If you are under 16, you may use it only with verifiable parental consent.

9. Changes to These Terms

We may update these terms as the service evolves. Material changes take effect on the new effective date stated above and are announced on this page and, where reasonable, inside the app. Continued use after the effective date constitutes acceptance.

10. Intellectual Property, Severability & Language

INOCULENS Tunnel, its design, and its code are our intellectual property; these terms grant you only a limited, revocable, non-transferable license to use the service. If any provision is found unenforceable, the remainder continues in full force. These terms are provided in English, which prevails in case of translation differences.