URLGatePrivacy
What URLGate records, who can see it, and how long it is kept.
Who is responsible
URLGate is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], which decides how the data described here is used. Contact: hello@urlgate.xyz.
Wallet addresses
Your wallet address is your URLGate account. We store it when you sign in, create a link (as its creator and payout wallet), pay for a link or for Premium, redeem a code, or earn points. Wallet addresses and the payments between them are public on the blockchain anyway; we never ask for or see your private keys or seed phrase.
- The public leaderboard shows shortened wallet addresses and points only. You can hide your wallet from it in your dashboard; points keep accruing.
- A link's creator sees the paying wallets of their own links' sales. Buyers' wallets are not shown to anyone else.
- To keep points fair we look up where wallets were funded from on the public blockchain (see Points).
Activity (audit) log
Every security- or payment-relevant event is written to an append-only audit log: link created, edited, paused or removed; a payment prompt (HTTP 402) shown; a payment made or failed; a link re-opened; sign-in and sign-out; abuse reports; every administrator action; points adjustments; membership purchases, grants and premium-code redemptions (including rejected code attempts).
For each event we store:
- Your full IP address (as reported by Cloudflare). If you connect over IPv6 and Cloudflare also assigns your connection an IPv4 equivalent (its "Pseudo IPv4" feature), we store both addresses. We also store the country derived from your IP, your browser's user-agent string and the referring page (if your browser sends one).
- The wallet address involved (yours, if you are signed in or paying), the link, and event details such as amounts and on-chain transaction hashes.
Who can see it
- Link owners see entries for their own links only, with IP addresses truncated (IPv4 to /24, IPv6 to /48), the browser family instead of the full user-agent, and referrers reduced to the host name. Moderation entries (reports, takedowns) show only the event, its reason and any public note: never who reported or moderated.
- URLGate administrators (role-based, signed in with their wallet) see full entries, including full IP addresses (both IPv4 and IPv6 where stored), to investigate fraud, abuse and payment problems. Their own access and actions are logged too.
Payments and receipts
Payments settle on public blockchains. Transaction hashes, payer and recipient addresses and amounts are public on-chain and are shown on your receipt. A receipt link (/r/…) is a long random id: anyone who has it can view the receipt (never the destination URL).
Sign-in, cookies and local storage
Signing in is a free wallet signature (Sign-In with Ethereum). We store a session record (wallet, time, kind) so you can review and revoke sessions from your dashboard.
ug_session: your sign-in session. httpOnly (page scripts can't read it), SameSite=Lax, sent only over HTTPS, expires after 7 days or when you sign out. Agents use a bearer token instead, valid for 24 hours.ug_admin: only for URLGate administrators signed in to the admin console (SameSite=Strict).- Local storage in your browser keeps display choices: light / dark mode and the colour scheme. They stay in your browser, except that a colour scheme you choose under Dashboard → Settings is saved to your wallet's account (so it follows you to other devices).
That's all: no advertising, analytics or tracking cookies, and no third-party scripts.
Points
Points are computed from a public, hash-chained activity log. To keep points fair we look for linked wallets (for example wallets funded from the same source) and may withhold points; administrators can review and adjust points, and every adjustment is logged with a reason.
Link reports
When you report a link we store the link, the reason and details you give, and, to stop abuse of the form: your IP address, plus your email and wallet address if you enter them (both optional), and your wallet if you are signed in.
Exception: suspected child sexual abuse material. When a link is reported or flagged as child sexual abuse or exploitation, the law requires us to preserve the records about it: the link, every report about it as submitted (including the reporter's IP address, email and wallet while they are still stored), its payments and its logs are kept, and cannot be changed or deleted, for at least one year (18 U.S.C. 2258A(h)), and apparent violations are reported to NCMEC. This also applies when a review later finds the report was mistaken.
The link's owner sees that their link was reported and why, never who reported it.
Sanctions screening
When you sign in, create a link, pay, or have points confirmed, your wallet address is compared with a copy of the U.S. Treasury OFAC Specially Designated Nationals (SDN) list that URLGate downloads once a day and keeps on its own servers. The address is not sent to anyone for this check. If it matches a listed digital currency address, the action is refused, the wallet's pending points are frozen and the match (wallet, time, which check, the SDN entry) is kept for review by an administrator, together with an audit-log entry.
Operational alerts
To react quickly to outages, abuse and payment problems, URLGate sends short alerts to its operators' private Telegram chat (for example "payment failed", "rate limit reached", "a link was reported", "admin signed in from a new network"). Alerts never contain secrets, session tokens, full IP addresses (at most the /24 or /48 network) or full wallet addresses (shortened, e.g. 0x1234…abcd). Alert history is kept in the admin console for 30 days, except alerts about suspected child sexual abuse material, which are kept with the preserved records. Those alerts never contain the link's destination.
Payment compatibility checks
When an app or AI agent runs the free payment compatibility check (payment_compat_check, which only verifies a test payment and never charges anything), we record the time, the result, the network, the paying wallet address if one was signed, the app's self-declared name and version (MCP clients), whether it came over MCP or the REST API, the user-agent string, and the IP address(es) and country exactly as for the audit log. Administrators see these records in the admin console; a daily summary without IP addresses or full wallet addresses goes to the operators' alert chat. These records are never counted as sales, payments, points or analytics.
How long we keep data
| Data | Kept for |
|---|---|
| Audit log, including full IP addresses | Indefinitely (append-only, see above) |
| Reporter IP address, email and contact wallet | 30 days at most, then deleted (a keyed hash of the IP is kept) |
| Reports (link, reason, details) | Kept as moderation records |
| Links, payments, receipts, memberships, points | Kept; not deleted automatically (payments are permanent on chain in any case) |
| Session records | Kept so you can review them; a session stops working after 7 days (24 hours for agents) or when revoked |
| Sign-in nonces | Deleted after 24 hours |
| Operational alerts | 30 days after they are closed |
| Payment compatibility checks: IP address and user agent | 90 days, then deleted (the rest of the record is kept) |
| Saved colour scheme | Until you change or reset it |
Your rights and contact
Depending on where you live (and the law of [JURISDICTION]), you may have the right to ask what data we hold about you, to correct it, to have it deleted or restricted, to object to how it is used, and to complain to a data-protection authority. Write to hello@urlgate.xyz; we'll ask you to prove control of the wallet concerned by signing a message.
Some data can't be deleted: anything recorded on a public blockchain, and append-only audit-log entries we must keep to investigate fraud and abuse and to meet legal obligations.
What we don't do
- No third-party analytics, ads or trackers on URLGate pages.
- We never reveal a link's destination to anyone who hasn't paid for it (or been granted access by its creator).