Privacy policy

Who this covers

ug.uy is a URL shortener. This policy covers the public site, the dashboard, short-link redirects, QR codes, bio pages, digital cards, and the HTTP API. Contact hello@ug.uy.

Account and billing

• Sign-in uses Firebase Authentication. We receive the email address on the account and the Firebase user id.
• A bio page can include the profile fields you type into that editor, such as a name and links you choose to show.
• Payments are processed by Stripe. ug.uy stores the Stripe customer id and subscription status so the dashboard can show the plan. Full card numbers are not stored by ug.uy.
• The contact form stores the name, email, subject, and message you submit.

Links you create

• Destination URL, slug, optional title, description, and image, expiry, and the account that created the link.
• If you set a password, we store a salt and a PBKDF2-SHA256 hash. We do not store the password.
• Invisible links store a hidden path and a short label. The destination must be https.
• Branded hosts store the host name and the DNS records used to prove you control it.
• API keys store a prefix, scopes, a SHA-256 hash of the secret, and last-used time. The secret is shown once at creation.

Clicks and scans

When someone opens a short link or scans a QR code, the analytics record can include country, device class, browser, operating system, language, referrer host, UTM source, medium, and campaign, A/B variant, whether it was a click or a scan, the day, and a short daily visitor key.

The visitor key is an HMAC of the calendar day and the IP address. The raw IP address is not written into that analytics record. Cloudflare, which delivers redirects, can still see the connection IP, hostname, and country as part of running the network.

Retention of those analytics follows the plan: 30 days on Free, 365 days on Pro and Developer, 3 years on Agency. Enterprise is not capped in the plan catalog. Anonymous homepage links themselves expire after 30 days by default.

AI assists

Suggest slug and Suggest preview send the destination URL so a short path or Open Graph title and description can be proposed. Ask about this link sends your question and the aggregate counts already loaded for that link. Answers are limited to numbers present in that context.

Current public plans allow 30 of these assists per day. When the Cloudflare Workers AI endpoint is configured, the prompt is sent there. If it is unavailable, slug and preview use a local fallback that does not call that model. Do not put secrets in a destination URL or in an Ask question.

Teams

An organization stores its member ids and roles (owner, admin, editor, analyst). An invite stores the invited email, role, and a 14-day expiry. The invite can be accepted only by a signed-in account with that email.

Why we use this

To create and redirect links, show analytics to the link owner, run passwords and threat checks, bill the plan you chose, send service email, and refuse destinations that fail safety checks. Threat checks use Google Web Risk for malware, social engineering, and unwanted software when a key is configured.

Processors

• Google Firebase for the app, database, and authentication.
• Stripe for card payments.
• Cloudflare for DNS, certificates on branded hosts, redirect delivery, and the optional AI worker.
• Google Web Risk for destination threat checks.
• Resend for transactional email when SMTP credentials are configured.

Cookies

The site keeps you signed in and remembers cookie-consent choices. Analytics on the marketing pages is separate from per-link click analytics. You can block cookies in the browser; signed-in features need a session.

Retention and deletion

Account data is kept while the account exists. Deleting the account is intended to remove the account and its links, hosts, and related records, except where a record has to be kept for a legal reason such as a billing dispute. Analytics retention is the plan window above, not “indefinitely.”

If you are in the EEA or UK you can ask for access, correction, deletion, restriction, or a copy of the personal data we hold, or object to processing based on legitimate interests. Write to hello@ug.uy. We aim to answer within 30 days. We do not run a separate automated decision that produces legal effects about you. AI assists propose a slug, preview text, or a sentence about counts you already see.

Children

ug.uy is not directed at children under 16, and we do not knowingly collect their personal information.