Privacy Policy

Overview

This Privacy Policy describes how Furl, Inc. ("Furl", "we", "us", or "our") collects, uses, stores, and shares information when you use our edge routing platform, dashboard, API, and related services (collectively, the "Service").

Furl acts in two distinct roles depending on the data in question:

• Data Controller: For account data, billing data, and configuration data belonging to you as a customer, Furl determines the purpose and means of processing.
• Data Processor: For traffic passing through your configured domains — including any personal data belonging to your end users — Furl processes data on your behalf, under your instructions as the data controller.

This distinction is important, especially for customers operating under GDPR. If you need a Data Processing Agreement (DPA) for your compliance requirements, please contact us at privacy@usefurl.com.

What We Collect

When you register, we collect your name and email address. Furl supports Google OAuth and email OTP authentication. We do not store local account passwords. If you sign up via Google OAuth, we receive your name, email, and Google profile picture from Google's API — we do not receive or store your Google password.

All routing rules, domain records, redirect configurations, route definitions (including subfolder-style paths), A/B test parameters, team member information, API keys (stored as SHA-256 hashes — never plaintext), and webhook settings you create in the dashboard are stored as configuration data.

Payment is processed by Polar. Furl does not store full card numbers, CVV codes, or bank account details. We store Polar customer IDs and subscription identifiers to manage your plan. Polar's privacy policy governs how Polar handles your payment information.

When you use the dashboard, we may log your IP address, browser type, operating system, pages visited within the dashboard, and session timestamps. This data is used for security, debugging, and improving the product.

If you email us, submit a support request, or complete a feedback form, we retain that correspondence to handle your inquiry and improve the service.

How We Use Data

We use the information we collect for the following purposes:

• Providing the Service: Storing your route config in our database, syncing it to our edge network (Cloudflare KV), and using it to route incoming HTTP requests to your configured origins.
• Authentication & Security: Verifying your identity when you sign in, detecting suspicious activity, and protecting your account from unauthorized access.
• Billing & Subscriptions: Processing payments, managing plan changes, sending invoices, and enforcing plan limits (e.g. request volume caps).
• Notifications: Sending transactional emails such as email verification, domain verification confirmation, A/B test winner alerts, team invitations, and billing receipts. We do not send marketing emails unless you have explicitly opted in.
• Product improvement: Analyzing aggregated, anonymized usage patterns to understand which features are most used and where customers encounter friction. Individual customer data is not used for this purpose.
• Legal compliance: Maintaining records as required by applicable law, responding to lawful requests from authorities, and enforcing our Terms of Service.

We do not use your data to train machine learning models, build advertising profiles, or sell to data brokers — ever.

Proxied Traffic

When your end users visit your domain, their HTTP requests pass through Furl's proxy worker running on Cloudflare's global network. It's important to understand what Furl does and does not do with this traffic.

What Furl's proxy does with each request:

• Reads the request URL, method, and headers to determine routing.
• Forwards the request to your configured origin server, rewriting the Host header.
• Passes X-Forwarded-Host and X-Real-IP headers to your origin so it knows the original request context.
• Optionally rewrites HTML link attributes (href, action) for route path consistency — this is a string-level find-and-replace and does not interpret or store page content.
• Records an anonymized analytics event (see Section 5) in Cloudflare Analytics Engine.
• Returns your origin's response to the end user.

As the operator of the domains proxied through Furl, you are responsible for informing your end users about data collection practices applicable to your own domains, including your own privacy policy and any cookies or tracking set by your origin platforms.

Edge Analytics

Furl provides traffic analytics for your domains as a core product feature. These analytics are collected at the network edge — no JavaScript snippet or cookie is required on your visitors' browsers.

For each request through your proxy, we record the following data points in Cloudflare Analytics Engine:

• Page path: The URL path of the request (e.g. /blog/my-post). Query strings may be included if UTM parameters are present.
• Matched route: Which of your configured route rules handled the request (e.g. /blog route path).
• Traffic source: Parsed from Referer header or utm_source/utm_medium query parameters.
• Country: Country-level geolocation only, derived from Cloudflare's CF-IPCountry header. City or region-level data is not collected.
• Device type: Desktop, mobile, or tablet, derived from User-Agent string.
• Anonymized visitor hash: A daily-rotating hash of IP address + User-Agent, used to estimate unique visitors. This hash is not reversible to a real IP address and resets every 24 hours, preventing cross-session tracking.
• Referrer domain: The hostname portion of the Referer header only (not the full URL).

Aggregated, anonymous analytics data across all customers may be used by Furl to monitor platform capacity, detect abuse patterns, and report on overall network health. This aggregate data does not include any information identifiable to individual customers or their visitors.

Storage & Infrastructure

Furl is built entirely on Cloudflare's infrastructure. Your data is stored in the following services:

• Cloudflare D1 (SQLite): Account data, team and user records, routing configuration (routes, redirects, domains, A/B tests), API key hashes, webhook configurations, and audit logs.
• Cloudflare KV (key-value store): Cached route configuration for ultra-low-latency access during request handling. KV data is derived from D1 and is regenerated on every configuration change.
• Cloudflare R2 (object storage): Static files you upload to be served from paths on your domain (e.g. robots.txt overrides, domain verification files, favicons).
• Cloudflare Analytics Engine: Time-series analytics events as described in Section 5. Data is stored in Cloudflare's analytics infrastructure and queried via their SQL API.

Cloudflare is a SOC 2 Type II certified provider. Cloudflare's data processing practices and infrastructure security are governed by Cloudflare's Privacy Policy and their Data Processing Addendum, to which Furl is bound as a customer.

Payment data is stored and processed by Polar. Email delivery is handled by Resend. Neither provider receives access to your routing configuration or analytics data.

Data Sharing

Furl does not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Service providers: Cloudflare (infrastructure), Polar (billing), Resend (transactional email). Each provider receives only the data necessary to perform their service and is bound by data processing agreements.
• Team members: Configuration data and analytics for a domain workspace are visible to all authenticated members of your Furl team, according to their role permissions. You control who is in your team.
• Legal requirements: We may disclose information if required to do so by law, court order, or a governmental authority with lawful jurisdiction, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Furl, our customers, or the public.
• Business transfers: If Furl is acquired, merges with another company, or transfers substantially all of its assets, your data may be transferred as part of that transaction. We will notify you via email and provide an opportunity to delete your account before such a transfer takes effect.

Webhooks you configure may send event data (e.g. domain verified, A/B test winner declared) to URLs you specify. You are responsible for the privacy practices of any endpoint that receives webhook payloads from Furl.

Retention & Deletion

We retain your data for as long as your account is active or as needed to provide the service. Specific retention periods:

• Account & config data: Retained for the lifetime of your account. Upon account deletion, configuration data is deleted immediately from active databases. Audit logs are retained for 90 days after deletion for fraud prevention purposes, then permanently deleted.
• Analytics data: Retained for 12 months from the date of collection. Data older than 12 months is automatically purged from Cloudflare Analytics Engine. You may request earlier deletion at any time.
• Billing records: Retained for 7 years as required by tax and accounting regulations, even after account deletion. Only metadata (amounts, dates, plan names) is retained — not payment card details.
• Support communications: Retained for 3 years to provide context for ongoing support relationships, then deleted.
• Static files (R2): Deleted immediately when you remove them from the dashboard, or upon account deletion.

To delete your account and all associated data, go to Settings → Danger Zone in the dashboard. You may also submit a deletion request to privacy@usefurl.com and we will complete it within 30 days.

Your Rights

Depending on your location, you may have the following rights regarding your personal data. Furl honors these rights for all customers, regardless of jurisdiction.

To exercise any of these rights, email privacy@usefurl.com with your request. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

If you are located in the EU/EEA and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local supervisory authority.

California residents have additional rights under CCPA, including the right to know what personal information is collected, the right to opt out of sale (we don't sell data, so this right is inherently satisfied), and the right to non-discrimination for exercising privacy rights.

Cookies

The Furl dashboard uses the following cookies:

• Session cookie: An HttpOnly, Secure, SameSite=Lax cookie set by Better Auth upon sign-in. It contains your encrypted session identifier and expires after 30 days or when you sign out. This cookie is strictly necessary and cannot be disabled.
• Preference cookies: If you set UI preferences (such as theme or timezone), these may be stored in localStorage or a non-essential cookie. These are functional cookies that persist your settings between sessions.

The Furl proxy does not set any cookies on your end users' browsers for Furl's own purposes, with one exception: if you activate an A/B test, Furl sets a cookie named furl_ab_{testId} on your visitors' browsers to maintain a consistent variant assignment (sticky sessions). This cookie:

• Contains only the variant assignment (the letter "a" or "b") and the test ID.
• Expires after 30 days.
• Is Secure and SameSite=Lax.
• Does not contain any personal identifier or tracking value.
• Is set on your domain, not a Furl domain.

If you use A/B testing, you should disclose this cookie in your own privacy policy and cookie notice.

Children's Privacy

Furl is a business-to-business service intended for adults operating websites and digital products. We do not knowingly collect personal information from individuals under the age of 16.

If you believe we have inadvertently collected information from a child under 16, please contact us immediately at privacy@usefurl.com and we will delete it promptly.

International Transfers

Furl is incorporated in the United States. Cloudflare, our primary infrastructure provider, operates a global network. Data stored in Cloudflare D1 is distributed across Cloudflare's infrastructure in accordance with Cloudflare's data localization policies.

If you are accessing the service from the European Economic Area (EEA), United Kingdom, or Switzerland, please be aware that your personal data may be transferred to and processed in the United States or other countries that may not offer the same level of data protection as your home country.

Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers. If you require a Data Processing Agreement incorporating SCCs for your GDPR compliance obligations, please email privacy@usefurl.com.

Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes — such as collecting new categories of data, sharing data with new third parties, or changing how long we retain data — we will notify you by email at least 14 days before the change takes effect.

For minor, non-material changes (such as clarifications or corrections), we will update the effective date at the top of this page. We recommend reviewing this page occasionally.

The most current version of this policy always governs our data practices.

Contact

For privacy questions, data subject requests, DPA inquiries, or to report a concern, please reach out: