The Legal Route Map of app.onepassapps.com: 15 URLs, 12 Anchors and the Refund Policy in Plain Words

I work on OnePassApps, the team behind app.onepassapps.com, so this is our own site, and every number below was measured on it today with plain HTTPS requests - no browser session, no cookies, no JavaScript.

Most product pages tell you what a thing does. Legal pages tell you what a company promises when something goes wrong. This post is about the layer underneath both: how the legal URLs on our site are wired, and what the single document they all point at actually says.

Fifteen URLs, one document

I asked the site for fifteen plausible legal URLs. One of them is the document itself. The other fourteen answer HTTP 301 with a Location header - never a page of their own.

Fourteen redirects, nine distinct destinations. Thirteen of them land inside the terms document; the fourteenth leaves the legal set entirely and lands on the plans page.

Follow any of the fragment redirects and you land on a real place in the document. The page carries twelve section anchors - agreement, service, acceptable-use, content-and-rights, newsflow-sources, movie-data, payments, privacy, privacy-rights, liability, ending-use, law-and-contact - and every fragment the redirects use resolves to one of them.

One detail: /support/data-deletion points at #account-deletion, and that id exists on the page, but it is not one of the twelve section anchors. It sits on a nested element inside the privacy-rights section, so a reader who follows that link lands in the right part of the text even though the id is not a top-level section.

The document itself

/terms answers HTTP 200 and returns 74,746 bytes - the same number on four consecutive fetches. Strip the tags and it is 244 lines of text. The version stamp at the top reads Effective 21 October 2026 and Version 2026-10-21, and the line above it describes what the page is: it includes our privacy notice, subscription terms, cancellation instructions and refund policy.

The table of contents lists ten numbered sections. Two of them carry nested entries of their own - the NewsFlow source permissions and the movie catalogue sources - so the contents run a little longer than ten lines.

There is also one machine-readable block. The page ships a single application/ld+json script whose @graph holds four nodes: an Organization (name OnePassApps, logo /icon-512.png, contact point info@onepassapps.com with contactType customer support), a WebSite (inLanguage en-GB), a WebPage (dateModified 2026-10-21, isPartOf the site), and a BreadcrumbList with two items - Home, then Terms of use.

The refund policy, in the words on the page

The payments section is the one people read when they want to change their mind, so here is what it says rather than what it implies.

• Our voluntary refund policy covers a paid membership charge when you request a refund within 7 days of that charge and have used no more than 5,000 credits since it. An amount already refunded cannot be refunded twice, and a full refund of your latest membership charge ends paid access.
• Statutory rights are kept separate and are not narrowed by that policy. Where a cooling-off right applies, including qualifying UK distance contracts, you normally have 14 days from entering the contract to cancel without giving a reason, refunded in full with no deduction for access or credits used.
• Lemon Squeezy is the merchant of record, so your card or bank statement shows the charge under Lemon Squeezy's name - the transaction description begins LEMSQZY - not under OnePassApps alone.
• Cancellation and refund are two different requests: cancelling stops future charges, and the terms say plainly that you do not need to delete your account to cancel.

The free plan is still the live offer. The terms say Standard is included for every account, with 100,000 credits every 30 days, no payment details required, no end date set, and new plan purchases disabled - so participating will not automatically create a paid subscription or charge.

Deleting an account, and who to write to

The privacy-rights section covers deletion in more detail than a single sentence usually manages. Eligible account data is deleted through the signed-in account controls. If you cannot sign in, you contact us with the subject Delete my account. The deletion process attempts to cancel an existing recurring membership before removing account records, and it does not request a refund - the terms tell you to cancel in Plans or through the billing portal separately. Deletion is not complete until confirmed.

Backups are named honestly: restricted backup copies can remain until the configured backup retention period expires, and deletion controls must be reapplied if a backup is restored. The page does not name that period in public - it says to contact us for it.

You can complain to the ICO at ico.org.uk, or to the relevant regulator where you live. The governing law is England and Wales, with consumer protections and court rights where you live kept intact.

The footer of every legal page links the same way: All apps, Terms of use, Privacy, Refunds and cancellation, Plans and pricing, Support, App guides.

Why I measured it this way

Legal pages are the easiest thing on a site to make untestable. A redirect map is easy to change by accident and hard to notice. Two fetches on different days, or one fetch from a bot, can show you a different page from the one a person sees.

So this was read from outside the browser, with plain HTTPS, no session and no cookies: every status code and every Location header came from a no-follow request, and the document was fetched four times to confirm the byte count is stable rather than a cached accident.

The whole thing is one page: app.onepassapps.com/terms.

For the commitments in the same document, read as prose rather than as a route map, I wrote a separate ledger on our Substack: What OnePassApps' Terms Actually Commit. Same document, different job.