Privacy Policy

This page explains how OpenGraph Preview handles information when you use the inspection and metadata tools.

Last updated: 30 October 2026

Information you submit

OpenGraph Preview does not require an account. When you use URL inspection, the URL you submit is sent to our server so the service can retrieve the public page and its referenced social image. The server processes the returned HTML and metadata to create the report. The URL and page content are not intentionally saved as a user history by this application.

When you use Paste HTML, parsing runs in your browser and the pasted document is not sent to the URL inspection API. If the parsed or manually entered metadata contains an image URL, the preview loads that image through our same-origin image-preview endpoint; the image URL is therefore sent to our server so it can safely retrieve and validate the public image. When you use Create Preview, other entered metadata stays in browser state unless you explicitly copy it elsewhere.

Technical logs and abuse prevention

The hosting provider may process technical request information such as IP address, user agent, timestamp and error logs. The inspection API applies request limits. In production, Upstash Redis rate limiting must be configured for inspection endpoints to operate. In local development only, a temporary in-memory limiter is used per application instance and is not a persistent identity system.

Third-party websites

When you inspect a URL, the service makes a request to that public website. The website operator may receive a request from our infrastructure and process it under its own privacy policy. The tool also links to external resources such as official platform debuggers. We do not control those third-party services.

Cookies and analytics

The application does not require advertising or analytics cookies to use the core tool. If the site operator adds analytics or advertising services after deployment, this policy must be updated to describe the provider, data collected and consent controls applicable to visitors.

Data security

URL inspection blocks localhost and private/reserved IP targets, limits redirects, response size and request time, and accepts only standard HTTP/HTTPS ports. These controls reduce abuse risk but cannot guarantee absolute security. Operators should keep dependencies updated and configure an edge firewall or distributed rate limiting before public launch.