Privacy Policy

Oh Fax (ohfax.com / app.ohfax.com). Effective: September 18, 2026. Contact: support@ohfax.com.

What we do

Oh Fax sends outbound faxes to United States and Canada numbers on your behalf (browser, API, CLI, or MCP/agent).

Information we collect

Fax job data: destination number, page count, timestamps, delivery status, content hash, and payment references needed to send and receipt a fax.
Document files: PDF bytes you upload or provide for transmission.
Account data (optional): if you sign in (e.g. Google) for prepaid API use — email, account id, balance/ledger metadata, API key hashes (not plaintext keys after creation).
Payment data: processed by Stripe (and related payment rails such as MPP). We do not store full card numbers.
Technical logs: IP, user agent, and request metadata for security, abuse prevention, and reliability.

Analytics, advertising, and cookies

The site and app use Cloudflare Web Analytics, page-view analytics provided by Cloudflare. Cloudflare Web Analytics itself does not set cookies.

The site and app also use Google Ads (Google LLC) to measure our advertising. The Google tag sets and reads cookies, and sends Google information such as the pages you visit, your IP address, device and browser details, and whether you arrived from one of our ads. Google processes this data under its own privacy policy (policies.google.com/privacy). You can manage ad personalization at adssettings.google.com or block cookies in your browser.

The site and app also use the Meta Pixel (Meta Platforms, Inc.) to measure our advertising on Facebook and Instagram. The pixel loads a script from Meta, sets and reads cookies (such as _fbp), and sends Meta a page-view event with the page address, your IP address, and device and browser details. Meta processes this data under its own privacy policy (facebook.com/privacy/policy). You can manage ad preferences at accountscenter.facebook.com/ad_preferences or block cookies in your browser.

When you arrive from an ad link that carries campaign parameters (such as utm_source, utm_id, or Google's gclid), the site and app store those values, the landing page, and the time of the visit in a first-party cookie (__stripe_attrib, valid on ohfax.com and app.ohfax.com for 30 days). If you then start a card checkout or an account top-up, we attach the campaign values and visit time to the Stripe Checkout Session so Stripe can attribute the purchase to the ad campaign for our ad measurement. The cookie is only set when such parameters are present.

The site and app use a Stripe analytics cookie (_stripe_tag) that records page paths, referrer origin, and campaign (UTM) tags to understand how people find Oh Fax. We honor Global Privacy Control for Stripe analytics.

How we use it

To provide the service (quote, pay, transmit, receipt, refunds), prevent fraud/abuse, comply with law, and improve reliability. We do not sell personal information.

Retention

Document bytes are deleted after a fax reaches a final state (typically within about 24 hours).
Transaction metadata (destination, pages, timing, status, content hash, payment ids) may be retained for support, accounting, and dispute handling.
Account/ledger records are retained while the account exists and as needed for legal/financial records.

Sharing

We use processors such as Cloudflare (hosting and analytics), Stripe (payments and analytics), Telnyx (fax transmission), Google and Meta (ad measurement). They receive only what is needed to perform their function. We may disclose information if required by law.

Agents / MCP

If you use Oh Fax through an agent or MCP client, the same rules apply to documents and destinations that agent submits.

Your choices

Contact support@ohfax.com to ask about access or deletion of account-associated data, subject to legal retention needs.

Changes

We may update this policy; the effective date above will change. Continued use means you accept the updated policy.