Privacy Policy

URLS4IRL

Effective Date: December 6, 2025

Table of contents

• 1. Introduction
• 2. Definitions
• 3. Information We Collect
• 4. How We Use Your Information
• 5. Retention of Your Personal Data
• 6. Transfer of Your Personal Data
• 7. Disclosure of Your Personal Data
• 8. Third-Party Disclosure
• 9. Security of Your Personal Data
• 10. Children's Privacy
• 11. Your Data Protection Rights
• 12. Service Providers
• 13. Links to Other Sites
• 14. Changes to This Privacy Policy
• 15. Contact Us / Data Controller

1. Introduction

This Privacy Policy explains how URLS4IRL (“we,” “us,” or “our”) collects, uses, stores, and protects personal information when you use our software-as-a-service platform (the “Service”), which allows users to save, organize, and share URLs within collaborative spaces (“UTubs”).

We take your privacy seriously and aim to be clear about what information we collect, why we collect it, and how you can control it. This policy applies to information collected through the Service and related features.

2. Definitions

For this Privacy Policy the following terms have the meanings set out below:

• Cookie: A small text file stored on your device to enable features, support functionality, or maintain session information.
• Company: URLS4IRL.
• Country: The jurisdiction in which URLS4IRL operates — the United States.
• Customer: The individual or entity that creates an account to use the Service.
• Device: Any internet-connected device (computer, tablet, phone) used to access the Service.
• Personal Data: Information that identifies or can reasonably identify an individual, alone or combined with other information.
• Service: The URLS4IRL platform, including tools that allow users to save, organize, tag, and collaboratively share URLs within UTubs.
• Third-party services: External services we may integrate with to provide functionality (for example, authentication providers such as Google, hosting, or infrastructure providers). URLS4IRL does not use third-party advertising or marketing partners.
• Website: https://urls.4irl.app (or any successor domain).
• You: The individual who accesses or uses the Service, whether for personal or organizational purposes.

3. Information We Collect

We collect only the information necessary to operate, secure, and improve the Service.

3.1 Personal Data

To create an account, we collect:

• Email address — used for authentication, account notices, and login features (including optional Google Sign-In).

If you sign in with Google, we only request the minimum OAuth scopes required for authentication (typically openid email profile). We receive the email address and — only if explicitly requested and used — the display name and profile image URL. We do not request phone numbers or physical addresses from Google.

We do not collect names, phone numbers, physical addresses, payment data, contact lists, or other identifying information unless you voluntarily provide them (for example, in a support request).

3.2 Usage Data

When you use the Service, we automatically collect technical and usage data for security and operational purposes. This may include:

• IP address (used for security and coarse geolocation only)
• Browser type and version
• Operating system
• Device type
• Referrer URL
• Pages or endpoints accessed and actions taken
• Timestamps of requests
• Basic error or crash information

Usage Data is stored in server logs and used for diagnostics, rate limiting, abuse prevention, and improving the Service.

3.3 Tracking Technologies and Cookies

We use cookies to provide essential functionality and limited in-house analytics.

• Essential Session Cookie — required for authentication and session management. Typically expires on logout or after 30 days of inactivity (server-side session expiry).
• Analytics Cookie (in-house) — used to support internal analytics. Typically retained for 365 days, aggregated and not tied to external tracking providers.

We do not use advertising cookies, cross-site tracking cookies, third-party tracking cookies, beacons, marketing pixels, or tracking tags.

You may disable cookies in your browser, but essential functionality (including login) may not work without them.

3.4 In-House Analytics

We process analytics in-house (no Google Analytics, Facebook Pixel, or similar). Collected analytics are intended to be privacy-respectful and aggregated whenever possible:

• Pages or features accessed
• Time spent on features
• General interaction patterns
• Aggregated usage statistics

Analytics data is not shared with third-party analytics providers and is used only to improve the Service.

3.5 Information We Do Not Collect

We do not collect the following:

• Physical addresses
• Phone numbers (unless you voluntarily provide one)
• Payment information
• Contact lists
• GPS or precise location data (we may infer a coarse region from IP)
• Biometric data
• Sensitive personal data
• Advertising identifiers

We do not sell personal data or share it with advertisers.

4. How We Use Your Information

We use the data we collect only for the purposes necessary to operate, secure, and improve the Service. This includes:

• Operating and maintaining the Service (authentication, session management).
• Providing core functionality (creating, storing, tagging, and sharing URLs within UTubs).
• Maintaining security, including fraud detection, rate limiting, and abuse prevention.
• Providing customer support and responding to inquiries.
• Improving and developing the Service (in-house analytics and product optimization).
• Notifying you about important changes to the Service or this policy.
• Complying with legal obligations.
• Processing additional purposes with your explicit consent.

We do not use your data for advertising, profiling, or cross-context behavioral tracking.

5. Retention of Your Personal Data

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law. Typical retention periods (subject to change):

• Account data (email): retained until you delete your account or we terminate it for cause.
• Server logs & Usage Data: retained for 90 days by default for operational and security purposes; may be retained up to 24 months if required to investigate abuse or comply with legal obligations.
• In-house analytics: aggregated analytics retained for 12 months (individual-level analytics are not retained in a way that identifies you unless required for security).
• We will delete or anonymize data when it is no longer required for the purpose it was collected.

If you request deletion of your account, we will remove your account data within a reasonable timeframe subject to legal or technical constraints; backups and logs may persist for a short time according to the retention schedule above.

6. Transfer of Your Personal Data

Your data is stored and processed in the United States. If you are located outside the U.S., by using the Service you consent to transfer of your data to the United States, where data protection laws may differ.

When transferring personal data, we rely on appropriate safeguards such as the providers’ Data Processing Addenda and Standard Contractual Clauses (SCCs) where applicable, and we require processors to implement reasonable security measures.

7. Disclosure of Your Personal Data

Business transactions

If URLS4IRL is involved in a merger, acquisition, or sale of assets, your personal data may be transferred. We will notify you of any material change in ownership and the relevant privacy practices.

Legal requirements

We may disclose personal data when required by law or in good faith belief that disclosure is necessary to:

• Comply with a legal obligation or court order
• Protect and defend the rights or property of URLS4IRL
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users or the public
• Limit our legal liability

8. Third-Party Disclosure

We use third-party cloud and infrastructure providers to host and operate the Service. Examples of providers we may use include:

• Cloudflare
• DigitalOcean
• Google Cloud Platform

These providers act as data processors and process data only to provide hosting, storage, and infrastructure services on our behalf. We contractually require processors to protect data and not to use it for their own purposes.

9. Security of Your Personal Data

We take commercially reasonable measures to protect your personal data, including:

• Encryption in transit (HTTPS) for data sent between your device and our servers.
• Access controls limiting production data access to authorized personnel.
• Regular security reviews and updates to our infrastructure.

Note: while we strive to protect your data, no system is completely secure. We cannot guarantee absolute security of information transmitted to or stored by us.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such data without parental consent, please contact us and we will take prompt steps to remove it.

11. Your Data Protection Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, delete, or restrict processing.

11.1 General access & deletion

• Access: You may request a copy of the personal information we hold about you in a structured, commonly used format.
• Deletion: You may request deletion of your personal information except where retention is required by law or for legitimate business purposes (for example fraud investigations).

To submit a request, contact us at [email protected]. We will verify your identity before fulfilling requests and will respond within 30 days where required by law.

11.2 CCPA / California residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA). In particular:

• You may request the categories of personal information we collect and the categories of third parties with whom we share it.
• You may request deletion of your personal information (subject to legal exceptions).
• You may opt out of any sale of personal information.

URLS4IRL does not sell or share personal information for cross-context behavioral advertising. Because we do not sell personal information, we do not provide a “Do Not Sell My Personal Information” web link. To exercise your rights, email [email protected]. We will respond to verified requests within 45 days as required by law.

12. Service Providers

We may engage third-party companies to perform services such as hosting, storage, email delivery, and security monitoring. These Service Providers have access to personal data only to perform tasks on our behalf and are contractually required to keep data confidential and secure. We do not use third-party analytics, advertising networks, or data brokers.

13. Links to Other Sites

The Service may contain links to third-party websites. We are not responsible for the privacy practices of other sites. Please review the privacy policy of any site you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated Effective Date. When appropriate, we will also notify you by email or by a prominent notice within the Service.

15. Contact Us / Data Controller

Data controller: URLS4IRL

Email (official contact): [email protected]

Phone: +1 (314) 485-9682

No physical mailing address: At this time URLS4IRL does not maintain a physical mailing address or P.O. Box. Email is our official method for privacy-related inquiries and data rights requests. If that changes, we will update this policy.

Last updated: December 6, 2025