DRAFT. This policy is a placeholder for review and is not legal advice. It hasn't been reviewed by a lawyer.

Privacy Policy (draft)

What we store

• Email address from signup. We use it to link you to your key, prevent duplicate keys, and contact you about the service. We don't sell it or send marketing.
• API key. We store only a SHA-256 hash and a short prefix. We can't see or recover your full key. It is shown to you once, when you sign up.
• Pro notification: if you click "Notify me about Pro" on your dashboard, we store your key's account email, the click time and where you clicked, to send one email if Pro launches. Undo removes you from that list; revoking your key deletes the entry.
• Interest list: if you leave your email to hear about updates, we store only that email, where on the site you signed up (e.g. "landing") and the time. We use it only to email you about unfurlr, never share or sell it, and delete it on request. Your IP address is used briefly to rate-limit these requests and is not stored with the entry.
• Signup IP address and time. We use these only to limit abusive signups.
• Usage counts per key per month (the number of requests). We don't keep a full per-request log.
• Recent calls: the last 20 URLs requested with your key (scheme, host and path only; query strings are dropped) and their status, so you can see them on your dashboard. Older entries are deleted automatically, and all of them are deleted when your key is revoked; ask us to delete them any time.
• Cached results. We cache the metadata returned for a URL, along with the URL, for up to 24 hours. Cached entries are shared between users and aren't linked to your key.
• Server logs from our host or web server may briefly record IP addresses and request lines. If you put a publishable pk_ key in the ?key= query parameter, it may appear in these logs (secret keys are refused in URLs).

Embedded content

oEmbed HTML (for example a video player) comes from the third-party provider. If you display it, you must render it inside a sandboxed iframe (<iframe sandbox>), not directly in your page.

Retention

• Cached metadata: expires after 24 hours. Expired rows are overwritten or removed.
• Signup IP records: kept 30 days (target; automatic cleanup is TBD).
• Email address, key hash, and usage counts: kept while your key is active. Deleted within 30 days of a deletion request.

Sharing

We share data only with our hosting provider, which processes it on our behalf, or when the law requires it.

Your choices

To get a copy of your data or have it deleted, email smaran+unfurlr@mail.grokbot.com.

Hosting (planned): the API runs on Render (US West, Oregon). Data is stored in Turso (libSQL) in Oregon, USA (AWS us-west-2). Both act as our processors.