Privacy

Package URLs is operated by Cofactor, LLC. Stripe is the payment processor. Package URLs has its own Stripe account, and each product has its own Stripe account.

Effective October 13, 2026. The business address is 4301 S Flamingo Rd, Ste 106 PMB 610, Davie, FL 33330. Support email: support@cofactor.consulting.

Cofactor, LLC is the controller of personal data for Package URLs. To use the rights below, or to ask a question about this notice, write to support@cofactor.consulting or send post to 4301 S Flamingo Rd, Ste 106 PMB 610, Davie, FL 33330.

Data we collect

• Account email, whether that email is verified, and the Clerk user id for sign-in.
• Hostnames you add, the forge root URL, the language (Go, PHP, Rust, Swift, Ruby, or Elixir), and the DNS verification token for that hostname.
• Request log for a route: time, method, host, path, status, duration, user agent, and whether the lookup failed. IP addresses are not stored. Query strings are not stored. Request bodies are not stored. The route keeps its newest 10,000 requests.
• Hourly request counts for a route, used as the allowance meter.
• Subscription record: Stripe customer id, Stripe subscription id, status, current period end, and whether cancellation is set for the end of the period. We do not store your full card number.
• Contact form: the email address and message you submit. The visitor IP is used only to limit how often the form can be sent. That limit is kept in memory on the server and is not written to the database.

Why

We use this data to run the account and the hostnames, to bill a paid plan, to show you the request log, to answer support mail, and to limit abuse of the contact form. For the GDPR, the account, the hostnames, and billing are processed to perform the contract. Request logs, the contact-form limit, and security of the service are processed for our legitimate interest in operating and protecting the service.

Stripe and other processors

Stripe is the payment processor. Package URLs has its own Stripe account, and each product has its own Stripe account. Card numbers and the billing portal are handled by Stripe. Stripe's privacy notice is atstripe.com/privacy.

Clerk provides sign-in. Resend delivers the contact form and other account email when mail is configured. Cloudflare hosts the site and answers customer hostnames. Railway hosts the API and the database. These providers process the data they need to do that work.

The service may process data in the United States and in other countries where these providers operate. Write to support@cofactor.consulting to ask where a copy of your data is held.

How long

Account data and routes stay until you delete the account, or until an unverified account with no live paid plan is removed. That removal warns after seven days and deletes the account seven days after the warning. Request logs roll off after the newest 10,000 rows. Hourly request counts are removed when the route is removed. Contact-form rate-limit entries are dropped when the server process restarts, and they expire after the limit window.

Sharing

We do not sell personal information. We do not share it for cross-context behavioral advertising. We share it with the processors above, and when the law requires it.

California

If the CCPA applies to you, you can ask to know, correct, or delete personal information, and you can opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. We will not discriminate against you for using these rights. Categories we collect are identifiers (your email), commercial information (the plan and the Stripe ids), and internet activity (request logs and request counts). Send the request to support@cofactor.consulting. We will check that it comes from the address on the account, or from someone you have authorized.

GDPR

If the GDPR applies to you, you can ask to access, correct, delete, or restrict your personal data, to object to processing based on legitimate interests, and to receive a portable copy. You can also complain to a supervisory authority. Send the request to support@cofactor.consulting.

Cookies and local storage

Clerk sets the cookies that keep you signed in. The light or dark theme is stored in this browser's local storage under the key packageurls-theme. That choice is not an account record.

Children

Package URLs is not directed at children.

Changes

We may update this notice. The effective date at the top changes when we do. See also Terms andRefunds and cancellation. Disputes about this notice follow the governing law in the terms: Florida.