Legal

Privacy Policy

Effective date: October 8, 2026

On this page

This policy explains what information Userland (“we”, “us”) collects, why, who we share it with, how long we keep it, and the choices you have. It covers our websites (userland.fun and docs.userland.fun), the console (console.userland.fun), the userland command-line tool, the API, the Userland connector that AI assistants such as ChatGPT and Claude use (mcp.userland.fun), and the apps we host for our customers. If you use an app that a business runs on Userland, see People who use our customers’ apps.

The short version

We collect what we need to run your account and your apps: your email address, username, and account details, what you publish, and security records of how your account is used.
Stripe handles payments. Your card details go to Stripe, not to us.
We measure how people find and use our websites and console with our own analytics service. We don’t use advertising cookies or ad tags.
When you come to Userland from one of our Google ads, or from Facebook, Instagram, or another Meta app, and then sign up, start using Userland, or buy a plan, our servers tell Google or Meta, so we can see which of our ads work. We do this only for people in the United States.
We don’t sell personal information for money. Some US state privacy laws may count what we tell Google and Meta as a “sale” or “sharing” of personal information, or as “targeted advertising”. Anyone can opt out with the “Your privacy choices” link on every page of our websites and the console, or with a Global Privacy Control signal, which we honor (see Your analytics choices).
When a business runs an app on Userland, we store that app’s information on the business’s behalf. The business decides what the app collects.
Userland doesn’t use your data, or your apps’ data, to train AI models.
If you connect an AI assistant, such as ChatGPT or Claude, we keep a record of the connection. What the assistant reads from Userland for you goes to the company that runs it, under that company’s terms (see When you connect Userland to an AI assistant).
To ask for a copy of your information, or to have it corrected or deleted, email support@userland.fun.

Who is responsible for your information

Userland is provided by David Jacob Wurtz, a sole proprietor. In this policy, “we” and “us” mean him.

Information we handle for our own purposes. He is responsible for the personal information Userland handles for its own purposes, such as running accounts, billing, support, security, the emails we send, and our analytics. In data protection law, that makes him the “controller” of that information.
Information in our customers’ apps. When a business runs an app on Userland, we handle the app’s information, including information about the people who use it, on that business’s behalf. The business decides what its app collects and why. See People who use our customers’ apps.

To contact us about privacy, or to make a privacy request, email support@userland.fun. Our postal address is 13215 SE Mill Plain Blvd Ste C8 #3028, Vancouver, WA 98684, United States.

Information we collect

Your account

Account details. Your email address, username, account name, and your role in each account you belong to.
Sign-in records. To sign in, you open a link we email you, which works for 15 minutes. The command-line tool signs in with a code you approve in the console, which also works for 15 minutes. We keep only a hashed (scrambled, one-way) copy of each link and code. With each sign-in request we record your email address, a coded copy of your IP address, and your browser’s user agent. The coded copy lets us recognize repeated requests from the same address. It can be matched back to the address, so we treat it as personal information. A user agent is a short description of your browser and operating system that browsers send to every website.
Checks that you’re a person. The console’s sign-in and sign-up form uses Cloudflare Turnstile to tell people from automated scripts. To run the check, Cloudflare processes signals from your browser, such as how it behaves and its IP address. Userland receives only whether the check passed. Cloudflare handles this under its own privacy policy.
Checks on your email address. When you sign up, we check your email address against a list of disposable email services, and we compare it with the addresses of other Free accounts, counting variants such as name+shop@example.com and name@example.com as the same mailbox, so that one mailbox has at most 2 Free accounts.
Where command-line sign-ins come from. When the command-line tool asks to sign in, we record the city, region, and country that its IP address points to. We show them on the approval page so you can tell whether the request is yours.
Sessions and API keys. A console sign-in lasts 30 days. For console sessions and API keys we keep only hashed copies, plus the first 12 and last 4 characters of each key so you can tell your keys apart. You see the full key once, when it’s created.
Old passwords. If you created your account when Userland still used passwords, we still hold a hashed copy of that old password. It can no longer be used to sign in.
Account security records. When you sign in, create or revoke an API key, connect or disconnect an AI assistant, publish, roll back, or unpublish an app, change an app’s secret keys or web addresses, or change your plan, we record what was done, when, which user did it and with which API key, console sign-in, or AI assistant connection, a coded copy of the IP address (as described above), and the user agent. We record the name of a secret key that was changed, never its value. Our support and admin tools add the same kind of record for most lookups and changes they make on your account. A few maintenance tasks, such as correcting an account’s plan, work on our database directly and don’t add a record.
On your computer. The command-line tool saves your API key, username, and selected account in ~/.userland/credentials.json, a file only your user on that computer can read. That file stays on your computer.

Your apps

When you or your coding agent publish and run apps, we store what makes them work: their code, files, settings, and past versions; the records and files your apps save; secret keys you set, which we encrypt; your apps’ web addresses and custom domains; your apps’ activity logs; and usage counts such as requests and storage. To confirm that you own a custom domain, we look up its public domain settings (DNS records).

When you or your agent upload an app in parts, we keep the parts as a draft until you publish it or delete it.
If you export an app’s data, we make a file with the app’s saved records, its sign-in list (never passwords), and its files, for you to download. If the files add up to more than 5 GB, the export lists a link to each file instead, and anyone who has a link can download that file until the export is deleted, or until the file itself is, by the app or with the rest of an unpublished app’s data.

When you connect Userland to an AI assistant

You can connect an AI assistant, such as ChatGPT or Claude, to Userland, so it can work in your account for you. Our Terms of Service explain what a connection can do.

The connection. When you approve an assistant, we keep a record of the connection: who approved it, the name the assistant gave itself, whether it has full access or can only look, the business it works in, when it was connected and last used, and, once it ends, when and why. We also keep the assistant’s sign-in details as it registered them with us: its name and the web addresses it sends you back to.
Staying signed in. The assistant stays connected with tokens we give it. We keep only hashed copies. A token that lets it act lasts an hour. The token it uses to get a new one lasts 90 days from when it was last used, and is replaced each time, so a connection the assistant doesn’t use for 90 days ends. If a replaced token is used again, we end the connection, because that can mean someone copied it. We also cancel any app invitations the connection made that nobody has used yet, and we email you.
Approving it. A request to connect lasts 30 minutes, and we keep it on our servers as How long we keep information describes. A cookie ties it to the browser that started it (see Cookies and browser storage). If you need to sign in on the way and you already have an account, the email we send has a link that approves that one request, on any device. The link works once, for up to 15 minutes, and we keep only a hashed copy of it. The email names the assistant and the website it sends you back to. Using the link doesn’t sign you in on that device.
Security records. When a connection is made or ended, or the business it works in changes, we record it with a coded copy of the IP address and the user agent, as for the account security records described above. What an assistant does in your account is recorded as done by you through that assistant: our security records name the connection and the assistant, and your apps’ activity logs say a chat assistant made the change. Requests the assistant makes reach us from its company’s servers, so those records don’t include your IP address or browser.
Emails. We email you when an assistant is connected, and when we end a connection to protect your account. When an assistant creates an API key for you, the new-key email names the assistant.
Secret values and new API keys. As this becomes available, when an assistant helps you set a secret key for an app, or creates an API key for you, it gives you a single-use Userland page where you type the secret or see the new key once. The value goes straight to us, never through the assistant.
What the assistant’s company receives. What you tell an assistant, and what it reads from Userland for you (for example your accounts, apps, versions, activity, visits, and the names of secret keys, never their values), goes to the company that runs it, such as OpenAI or Anthropic, and is handled under that company’s own terms and privacy policy. That company isn’t our service provider, and we don’t control what it does with that information.
No training. Userland doesn’t use your data, or your apps’ data, to train AI models, including what an assistant sends us or reads for you.
Disconnecting. You can disconnect an assistant at any time on the Chat assistants page in the console. API keys it created keep working until you revoke them.

How long we keep these records is in How long we keep information.

Payments

Stripe processes all payments. You enter your payment details on Stripe’s checkout page, and they go to Stripe, not to us. We never receive or store your card details.
We create your Stripe customer record with your username and your Userland account ID. When you start a checkout, we also send Stripe your user and account IDs, the plan you chose, any analytics choices we’ve recorded for you and your privacy region (the EEA, the UK, Switzerland, or elsewhere), and reference numbers that link the purchase to our analytics records.
When you start a checkout or open Stripe’s billing page, the address Stripe sends you back to has your account ID and, if you started in the console, the console page you started from, so you come back to it afterwards, on any device.
From Stripe we keep only reference numbers and the state of your subscription: the plan, its status, billing period dates, any scheduled cancellation date, and the latest invoice’s reference number. We also keep when your account’s first payment for a paid plan went through, and that invoice’s reference number, so the console can show when you can ask for that payment back (see Refunds in our Terms of Service).
Stripe keeps its own records under Stripe’s privacy policy.

Support requests

When you contact support from the console, the command-line tool, the API, or by email, your message goes to our support inbox. A request sent from the console, the command-line tool, or the API also includes your email address (so we can reply), your username, account, and plan, the app you chose if any, and that app’s most recent warnings and errors from its activity log. We record that you sent a request.

Emails we send

We email you sign-in links, alerts when a new API key is created, or a secret key is changed or an app goes back to an earlier version in the console, alerts when an AI assistant is connected or when we end a connection to protect your account, links to approve an assistant from another device, notices when an export of an app’s data is ready or couldn’t be made, notices when a payment fails or your plan changes, reminders about custom domains, notices when one of your custom domains starts working or is removed, reminders before your account’s free preview ends, support confirmations, and notices before a material change to our terms or a price increase takes effect. We keep a record of every email we try to send: who it was to and from, the subject, the kind of email, and whether it was sent, never the links in it. We don’t send newsletters or marketing email.

Our websites and console

See Analytics and Cookies and browser storage.

How we use information

To run Userland: sign you in, host and serve your apps, bill you, and answer support requests.
To keep Userland secure and prevent abuse, for example with limits on sign-in emails and other requests, the checks at sign-up, account security records, and investigating reports.
To understand how people find and use Userland, and to improve it.
To see which of our ads work, by telling Google and Meta about signups and purchases by people who came from them (see Advertising platforms).
To send you the emails described above.
To follow the law, and to enforce our Terms of Service and Acceptable Use Policy.

Legal bases in the EEA, the UK, and Switzerland

If you’re in the EEA, the UK, or Switzerland, data protection law requires a legal basis for each use of your information. Ours are:

Our contract with you, to run your account and apps: signing you in, hosting and serving your apps, billing, answering support requests, and the emails described above.
Our legitimate interests in keeping Userland secure and preventing abuse (limits on requests, the checks at sign-up, account security records, and investigating reports), and in understanding how people find and use Userland (page views and clicks counted without an ID, the page requests our servers count, search statistics, and analytics events tied to your account).
Your consent, for analytics IDs in your browser and for telling advertising platforms about your signups and purchases. We don’t ask for it yet, so in these regions we don’t create analytics IDs and we don’t tell advertising platforms anything about you.
Legal obligations, when the law requires us to keep or share information.

Analytics

We run our own analytics service at analytics.userland.fun, with its own database. It measures how people find Userland, which pages and features they use, and which visits lead to signups, first apps, and purchases. It isn’t Google Analytics or any other analytics company’s product.

What it records

On userland.fun, docs.userland.fun, and the console, it records:

the pages you view, and the buttons and links you click;
the page that sent you to us, without anything after a “?” in its address;
campaign tags in the link you arrived from, such as utm_source, and ad click identifiers, such as gclid from Google or fbclid from Facebook and Instagram (we keep ad click identifiers for up to 180 days after your visit: see How long we keep information);
the country you’re in, and whether that’s in the European Economic Area (EEA), the UK, Switzerland, or elsewhere, based on your IP address (only the country, nothing more precise);
the identifiers in Google Analytics or Meta cookies, if such cookies already exist for our websites in your browser. Our websites don’t load those companies’ tags, so normally there are none.

Our analytics service doesn’t keep your IP address in its records of your visits. While we share conversions with Meta, and while we test that without sending anything yet, our analytics service can keep an encrypted copy of your browser’s IP address, and its user agent, for up to 7 days, to send to Meta with a conversion (see Advertising platforms). It does this when you sign up, create an API key in the console, or start a checkout in your browser. It may keep them even if you didn’t come to us from Meta, or if the conversion is then sent without them, or not sent at all. It doesn’t keep them if you’ve turned sharing off, or if you’re in the EEA, the UK, or Switzerland.

A browser ID that links your visits

Unless you’re in a region where we need your agreement first (see Your analytics choices), our analytics service gives your browser a random ID in a cookie that lasts a year from your latest visit. userland.fun, docs.userland.fun, and the console share it, so we can follow a visit that starts on one and continues on another. We keep only a hashed copy of the ID. Your browser also keeps its own anonymous ID, and a visit ID that ends after 30 minutes without activity.

Links between our sites can carry an attribution code (ul_attribution) that works for 30 days. Our pages remove it from the address bar once they’ve read it.

Our own systems also record analytics events tied to your account, such as signing up, publishing your first app, and buying or changing a plan. When you sign up or sign in, including when you approve a command-line sign-in in the console, we connect that browser’s analytics history to your user and account. We also connect:

the browser you asked for the sign-in link in, if you open the link in another browser;
the visit on userland.fun or docs.userland.fun that you followed a link from into the console, if our analytics service couldn’t tell that it was the same browser. We do this only when the console opened within an hour of that page.

We don’t connect either of those if it’s already connected to someone else’s account. Later we also connect your Stripe subscription, API keys, and apps to the same record. This shows us, for example, which pages and campaigns lead to paying customers. It also means that once you sign up, your earlier visits in those browsers are tied to your account.

Page requests our servers count

Separately, the servers for userland.fun and docs.userland.fun count every page request in a basic form: which page, the website that referred you (its domain only), a general label for the kind of browser or automated agent, and whether the request worked. They don’t record IP addresses, full user agents, full web addresses, query strings, or cookies. These counts don’t use cookies, and they don’t depend on your analytics choices.

Search statistics

We import weekly totals from Google Search Console about how userland.fun and docs.userland.fun appear in Google search. They don’t identify anyone.

Advertising platforms

We advertise Userland on Google and on Facebook and Instagram (Meta). To see which of our ads work, our servers tell Google and Meta when someone who came to Userland from them signs up, creates their account’s first API key, publishes their account’s first app, starts a checkout, or buys a plan. We call these conversions.

Who. Only people in the United States (based on the country of their visits) who haven’t turned this off. Google hears only about people who clicked one of our Google ads in the 90 days before the conversion. Meta hears only about people who came to us from Facebook, Instagram, or another Meta app in the 7 days before the conversion: from one of our ads there, or from a link to Userland that someone shared there. We never send anything about visitors in the EEA, the UK, or Switzerland.
From when. We never send conversions from before we published this section on September 30, 2026, or ad clicks from visits we know were yours before then.
What Google receives: which conversion it was and when, the price and currency for checkouts and purchases, a reference number, Google’s own ad click identifier (gclid, gbraid, or wbraid), and a hashed (scrambled, one-way) copy of your email address.
What Meta receives: which conversion it was and when, the price and currency for checkouts and purchases, reference numbers, Meta’s ad click identifier if there is one (made from fbclid), a hashed copy of your email address, and a hashed copy of your Userland user ID. For conversions that happen in your browser (signing up and starting a checkout, for example), also your browser’s user agent, its IP address, the address of the page without anything after a “?”, and the identifier in a Meta cookie if one already exists for our websites in your browser (normally none does). For conversions that happen elsewhere (in the command-line tool, or when Stripe confirms a payment), none of those.
How. We send this from our servers. Our websites and console don’t load the Meta Pixel, the Google tag, or any other advertising tag, and don’t set advertising cookies.
What they do with it. Google and Meta use it to measure our ads and to choose who sees them. Under their own terms and privacy policies (Google, Meta), they may also use it to personalize the ads and content they show you, and to improve their own services. They may match a hashed email address to an account you have with them.
To stop it, use “Your privacy choices”, Global Privacy Control, or email us (see Your analytics choices).

We don’t send Google Analytics any information about you, and we don’t send advertising platforms anything about what’s in your apps or about the people who use them.

Your analytics choices

In the EEA, the UK, and Switzerland, we don’t create a browser ID or keep analytics IDs in your browser unless you’ve agreed to it. Our websites don’t currently ask for that agreement, so we don’t create them. Your page views and clicks are still counted, without any ID.
When we can’t tell where you are, our analytics service doesn’t create a browser ID unless you’ve agreed to it. When a page loads, it may still keep analytics IDs and how you arrived in your browser’s storage, and userland.fun and docs.userland.fun may send those IDs with a click you make before our analytics service answers. Once it answers, the page deletes them. If the page can’t reach our analytics service, they stay in your browser.
Everywhere else, analytics IDs are on by default. To stop them, block analytics.userland.fun in your browser or with a content blocker. Our websites and the console work the same without it. Clearing your cookies and site data removes the IDs, but new ones are created on your next visit unless you block analytics.userland.fun.
If you have a Userland account, you can email support@userland.fun to ask us to delete the analytics records linked to it. We’ll tell you what we can delete and when.
To stop us telling Google and Meta about your signups and purchases (see Advertising platforms), use the “Your privacy choices” link on any page of userland.fun, docs.userland.fun, or the console, at the bottom of the page or of its side menu. It applies to this browser on all our sites, and to your account on every device once you sign in from this browser. Once you turn it off, it stays off: the page doesn’t offer a way to turn it back on. Our own analytics keep working.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it the same way: we don’t tell advertising platforms about you.
For your whole account, on every device, email support@userland.fun from the address on your account and ask us to stop sharing with advertising platforms. Information already sent can’t be recalled from Google or Meta; we’ll send nothing more.
Our websites don’t respond to Do Not Track signals.

Cookies and browser storage

We don’t use advertising cookies. These are the cookies Userland sets, where, and how long each lasts:

__Host-ul_platform (console, 30 days): keeps you signed in to the console.
__Host-ul_signin (console, 15 minutes): ties a sign-in link to the browser that asked for it.
__Host-ul_signup (console, 15 minutes): holds your signup while you finish it.
__Host-ul_oauth_<id> (console, 30 minutes): ties a request to connect an AI assistant to the browser that started it.
ul_privacy_region (userland.fun, docs.userland.fun, and the console; 24 hours): records whether you’re in the EEA, the UK, Switzerland, or elsewhere, so the right analytics defaults apply.
__Host-ul_bid (analytics.userland.fun, 1 year from your latest visit): the analytics browser ID described above.
__Host-ul_consent (analytics.userland.fun, 1 year): remembers what you turned off, such as sharing with advertising platforms in “Your privacy choices” or through Global Privacy Control, so the choice applies on all our sites. It’s set only after such a choice is recorded.
__Host-ul_session (a customer’s app, 30 days): keeps people signed in to that app. It’s set only on the app’s own address.

Our websites also use your browser’s local storage. On userland.fun and docs.userland.fun, our analytics script keeps an anonymous ID, a visit ID, how you arrived (campaign tags and click identifiers), and any analytics and privacy choices. The console keeps how you arrived, reference numbers for purchases you started, any analytics and privacy choices, which account you last selected and its name, and which “Needs you” items you hid. When you ask for a sign-in link, it also keeps the email address you typed, so the page the link opens can say who you’re signing in as. It removes the address when you use the link or sign out, or the next time the console opens once the link has stopped working (after 15 minutes). While a console tab is open, it also keeps, in that tab only, what you’ve typed but not sent yet, such as a support message, and the page to bring you back to after you pay. Closing the tab removes these, and signing out removes what you typed.

We don’t sell personal information for money. We share it only in the ways this section describes. The service providers that run parts of Userland for us are:

Cloudflare hosts our websites, the console, the API, our analytics service, and our customers’ apps. It runs our databases and file storage, sends our emails and the emails our customers’ apps send through Userland, runs the Turnstile check on our sign-in form, and answers the domain lookups we use to confirm that you own a custom domain. Like any hosting network, it handles visitors’ IP addresses to deliver and protect traffic.
Stripe processes payments and manages subscriptions.
Google hosts our support inbox (Google Workspace) and provides the search statistics described above.

The advertising platforms we advertise on are:

Google LLC (Google Ads), and
Meta Platforms, Inc. (Facebook and Instagram ads).

They receive the conversion information described in Advertising platforms and use it under their own terms. Some US state privacy laws may count this as a “sale” or “sharing” of personal information, or as “targeted advertising”. You can stop it with “Your privacy choices”, Global Privacy Control, or an email to support@userland.fun.

When you connect an AI assistant, it receives what it reads from Userland for you, as described in When you connect Userland to an AI assistant. The company that runs it isn’t our service provider: you choose to connect it, and it handles that information under its own terms.

We may also share information when the law requires it, or when it’s needed to protect people, Userland, or our customers from harm, fraud, or abuse.

If you send us a copyright notice or counter-notice, we send a copy of it, including your name and contact details, to the other side, as our Copyright Policy describes. A notice goes to the owner of the app it’s about, and a counter-notice goes to the person who sent the notice.

How long we keep information

Your account

Account security records: 2 years, then deleted.
Records of emails we sent: 1 year, then deleted.
Sign-in links and command-line sign-in codes, with what we recorded when each was asked for (your email address, the coded copy of your IP address, your user agent, and where a command-line sign-in came from): deleted a day after the link or code expires.
Account details, console sessions, sign-up records, API key records, subscription records, and support emails don’t have an automatic deletion schedule. We keep them while your account is open, because we need them to run it, bill you, and keep it secure.

You can ask us to delete any of these (see Your choices and rights). We may keep a record when we need it to meet a legal obligation or to protect the security of Userland.

AI assistant connections

A connection’s record is kept while the connection works, and while any API key it created still works, because that record is what keeps such a key from acting like one you created in the console. It’s deleted a year after the connection ends, or once the last working API key it made is revoked and no app invitation it made is still waiting to be used, whichever is later.
A connection you approve that the assistant never finishes setting up is deleted, with its request to connect, within about an hour.
Hashed copies of its tokens are deleted within an hour after they expire, or after the connection ends. Of the tokens that have been replaced, we keep only the most recent one, to tell if it’s used again, and delete the others within an hour.
A request to connect that nobody answers is deleted within an hour after it ends, 30 minutes after it was made. One you turn down is deleted a day later. One you approve is kept while its connection works, and deleted within about a day after the connection ends.
An assistant’s sign-in details are deleted once no connection through it still works and it hasn’t been used for 30 days, or about a day after it registered if it was never used. We keep the details of an assistant we’ve blocked, so it stays blocked.
Security records of connections are kept like other account security records, for 2 years.

Your apps

An app’s code, files, settings, saved records, secret keys, and app users are kept while the app is published, and for 30 days after it’s unpublished (see below).
Activity log entries are kept for 1 day on Free, 7 days on Starter, 30 days on Business, and 90 days on Business Plus.
App analytics totals are kept for 7 days on Starter, 30 days on Business, and 90 days on Business Plus. Free doesn’t include app analytics.
Past versions: besides the live version, an app keeps 2 on Free, 10 on Starter, 50 on Business, and 200 on Business Plus. It keeps the most recent ones, with one exception: for an app with server code, we usually keep the version that was live just before the current one ready for a quick rollback, and while we do, that version is kept first. The rest are deleted, but never the live version.
While an account is restricted because a payment for its paid plan failed or its subscription is paused, its apps’ activity log entries, app analytics totals, and past versions are kept as its paid plan keeps them for 30 days from when the restriction starts. After that, or once the subscription ends, Free’s apply.
When an app deletes a saved record, we stop returning it straight away and remove it from our database 7 days later.
When an app deletes a file, the file is removed from storage. We keep a record of its name, size, type, and any details the app attached to it for 7 days, then delete that too.
When you delete a secret key, it’s removed.
App users’ sign-ins: each app user keeps at most their 20 newest, and a new one ends the oldest. We delete each sign-in’s record 61 days after it expires, even if the person signed out sooner.
Records of messages other services send to your apps, such as payment notices, are kept as long as your plan keeps activity log entries, then deleted. We keep what each message says, and remove the passwords and access codes sent along with it.
The information passed to an app’s background jobs is deleted once the job has finished and is older than your plan keeps activity log entries.
A draft of an app uploaded in parts is kept until you publish it or delete it. Parts of an upload that was never finished are deleted after 24 hours.
An export’s file is deleted 7 days after it’s ready. The record that it was made (who asked for it, when, and how many records, people, and files it held) is deleted 90 days after the file is.
When you unpublish an app, its activity log entries and app analytics totals keep being trimmed to your plan’s window, its versions are kept, and records of messages other services sent it are deleted within about 15 minutes. 30 days after it’s unpublished, we delete everything else the app held: its versions, saved records, files, settings, secret keys, app users and their sign-ins, invitations, drafts, activity log, and the information passed to its background jobs. An export of its data that can still be downloaded then is deleted when its 7 days are up. We keep a record of the app’s name and dates, its usage counts, its old web addresses, and any action we took on it, such as a suspension, and security records about it are kept for 2 years like other account security records. Its app analytics totals that are left are deleted 90 days after it’s unpublished. Publishing the app again within the 30 days stops this deletion.

Analytics

Page-request counts from our servers: 90 days.
Page views and clicks not tied to an account: after 180 days we remove the IDs that link them to a browser or a visit, and keep what happened, on which page, and when.
Visit summaries (the page you landed on, the referring website, campaign tags, ad click identifiers, your analytics choices, and your region and country): 180 days after a visit was last seen, we remove the browser and visit IDs, ad click identifiers, analytics choices, region, and country from its summary, and keep the landing page, referring website, and campaign tags with the page views and account records it belongs to. A summary nothing else refers to is deleted instead.
Links involving anonymous IDs: deleted 180 days after they’re made, once no other record still uses those IDs.
Events tied to an account: after 400 days we remove the browser, visit, and API key IDs and reference numbers from them, and keep what happened, when, and for which user and account. Signup, first-app, and billing events keep everything for 730 days first.
Links between your account and Stripe records or API keys: deleted 730 days after they’re made, once no newer record uses them.
Records of which visit led to a signup, a first app, or a purchase: after 730 days we stop using them, but we don’t delete them.
Conversion records prepared for advertising platforms: 90 days after one is sent or skipped, or after it fails, we remove what was sent and the platform’s reply. The hashed email address, hashed user ID, ad click identifier, and any Meta cookie identifier kept to send them: 30 days. The IP address (encrypted) and browser user agent kept to send them to Meta: 7 days.
Ad click identifiers and any Google or Meta cookie identifiers in the records of each page you arrived on: 120 days. (Visit summaries drop ad click identifiers 180 days after the visit was last seen, as described above.)
Browser IDs, visit records, the rest of the records of how you arrived (the referring page, landing page, and campaign tags), your privacy choices, the links between a browser and your account, and what’s left of each conversion record prepared for an advertising platform (which conversion it was, for which platform, when, for which user, browser, and visit, and the page and campaign tags it came from) don’t have an automatic deletion schedule. We keep them, and you can ask us to delete them.

Backups

Our database provider keeps a restore history for a limited time, so a deleted database record can stay in that history until it expires.

How we protect information

Our websites, console, API, and apps are served over HTTPS.
We keep only hashed copies of sign-in links and codes, console sessions, API keys (plus a few characters of each key), AI assistants’ tokens and approval links, and app sign-in sessions. App users’ passwords are stored only in a scrambled form made with a slow method designed for passwords, never as plain text.
Secret keys you set for your apps are encrypted before we store them, and the API returns only their names.
Card details never reach us. Stripe handles them.
Our support and admin tools record most lookups and changes they make. A few maintenance tasks work on our database directly and aren’t recorded that way.
If we confirm a security incident that affects an account’s data, including its apps’ data, we’ll email the affected account owners without undue delay, with what we know and what they should do.
No service can promise perfect security. If you find a security problem in Userland, email support@userland.fun.

Your choices and rights

See your information. The console shows your account, apps, API keys, connected AI assistants, and plan. You can download your apps’ versions, and owners and admins can export an app’s data (see our Terms of Service).
Change or remove it yourself. You can rename or revoke API keys, disconnect AI assistants, cancel your plan, unpublish apps, and delete your apps’ secret keys. We delete an unpublished app’s information 30 days after it’s unpublished, apart from the few records listed in How long we keep information. Your apps can delete their own files and records, and we remove deleted records from our database 7 days later (see How long we keep information). To change your email address or username, email us.
Ask us. You can ask for a copy of the personal information we hold about you, or ask us to correct it, delete it, stop using it for analytics, or stop sharing it with advertising platforms. Email support@userland.fun from the email address on your account. We’ll reply to tell you what we can do and when. We may ask you to confirm that the request is yours before we act on it.
If we say no. If we turn down all or part of a request, we’ll tell you why. You can ask us to look at it again by replying to that email, and we’ll answer within 45 days. If you still disagree, you can contact your state’s attorney general.
Depending on where you live, the law may give you rights over your information, and you may be able to complain to a data protection authority.

People who use our customers’ apps

Businesses use Userland to run their own apps. If you sign up for or use one of those apps:

The business that runs the app decides what it collects and how it uses it. Its own privacy notice applies, and questions about your information in the app should go to that business first.
Userland stores and serves the app’s information on that business’s behalf. That includes your sign-in email address, your password (stored only in scrambled form, never as plain text), your roles in the app, your sign-in sessions, any invitation sent to you, and anything the app saves or logs about you. A sign-in lasts 30 days, in a cookie on the app’s own address, and we keep only a hashed copy of it. You keep at most 20 sign-ins to an app: a new one ends your oldest. We delete a sign-in’s record 61 days after it expires. If the business unpublishes the app, we delete what the app held about you 30 days later. The business can share invitation links itself or ask Userland to email them. They work for 7 days, unless the business sets a different time, up to 30 days.
Emails we send for the app. As each of these becomes available, and when the app uses it, Userland emails you for the business: an invitation, a password reset link when you ask for one, sign-in links and address confirmations, and messages the app sends you. These come from an address on notify.userland.link, with the app’s name, and Cloudflare sends them. A reset link works once and for 30 minutes, and we store only a hashed copy of it. We record which app requested an email, what kind it was, when, and whether Cloudflare accepted it for sending or an attempt failed; acceptance does not confirm that it reached your inbox. These records are deleted after 30 days. Cloudflare blocks further sending after eligible bounces and spam complaints. A temporary block can expire; other blocks stay until removed. To ask about a block on your address, email support@userland.fun. Other emails from the app may come from an email provider the business chose.
Protecting your app sign-in. Password reset requests include coded copies of the email address and network address so we can limit repeated requests. We delete these request records after a day, and remove the saved reset-link hash once the link expires, is used, or is cancelled. When an app administrator changes someone’s roles, disables their sign-in, sends or cancels an invitation, or signs them out, we record which app user acted, who was affected, what changed, and when. We also record password changes and resets. We keep these app security records for 30 days, without passwords or usable links.
Userland doesn’t add advertising pixels or tracking scripts to customers’ apps. If the business’s plan includes app analytics, we count visits to the app by hour, page, and referring website. These counts include no IDs, cookies, or request contents, and email addresses, numbers, and IDs in page addresses are masked. They’re kept for up to 90 days, depending on the business’s plan. We also record the first visit to each app and to each new version, without any details about the visitor, to measure our own product.
If we confirm a security incident that affects the app’s data, we’ll tell the business that runs it, as described in How we protect information.
If the business can’t help, or you can’t reach it, email support@userland.fun with the app’s web address.

Children

Userland is built for businesses and isn’t meant for children. Our Terms of Service require everyone with a Userland account to be at least 18, or the age of majority where they live if that’s higher. We don’t ask for anyone’s age when they sign up. If you believe a child has given us personal information, email support@userland.fun.

Where information is processed

Userland runs on Cloudflare’s global network. Requests are handled in Cloudflare data centers, often near the visitor, and we haven’t limited our databases or file storage to a particular country or region. Stripe, Google, and Meta process information in their own locations, and so do the companies that run AI assistants you connect. So your information may be processed and stored in the United States and other countries, whose data protection laws may differ from where you live.

Changes to this policy

We’ll post any changes on this page and update the effective date at the top. Before we make a change of this size, such as sharing information with another advertising platform, we’ll update this page first.

On September 29, 2026, we added that we send copyright notices and counter-notices, with the sender’s contact details, to the other side (see Who we share information with), and that we email account owners about material changes to our terms and about price increases (see Emails we send).

On September 30, 2026, we added that a sign-in also connects the browser you asked for the sign-in link in, and the userland.fun or docs.userland.fun visit that brought you to the console (see When you sign up), and that the analytics browser ID cookie lasts a year from your latest visit rather than from your first. We also added that our analytics service records the country each visit comes from, and removes it with the region after 180 days (see What it records and How long we keep information). And we added “Your privacy choices”, which lets you tell us not to share information about you with advertising platforms, and that we treat a Global Privacy Control signal the same way (see Your analytics choices), and that we remove ad click identifiers from the records of each page you arrived on after 120 days (see How long we keep information).

Also on September 30, 2026, we added that we tell Google and Meta about signups and purchases by people in the United States who came to us from our Google ads, or from Facebook, Instagram, or another Meta app, from our servers and without ad cookies or tags (see Advertising platforms). We never send conversions from before this change, or ad clicks from visits we know were yours before it. “Your privacy choices”, Global Privacy Control, and an email to support@userland.fun stop it (see Your analytics choices). To send these conversions, our analytics service may keep hashed copies of your email address and Userland user ID for up to 30 days and, for Meta, an encrypted copy of your IP address and your browser’s user agent for up to 7 days, including while we test it without sending anything (see What it records and How long we keep information). We also added how to ask us to look again at a privacy request we turned down (see Your choices and rights).

On October 1, 2026, we added what the redesigned console keeps in your browser: the email address you type to ask for a sign-in link, what you’ve typed in a console tab but not sent yet, and which “Needs you” items you hid (see Cookies and browser storage).

On October 2, 2026, we added that our security records cover changes to an app’s secret keys and web addresses, and say whether a change was made with an API key or a console sign-in (see Your account).

Also on October 2, 2026, we added that we email a business’s owner when one of its apps’ secret keys is changed, or one of its apps goes back to an earlier version, in the console. A key’s email names the key, never its value (see Emails we send).

On October 3, 2026, we added that the address Stripe sends you back to after a checkout or its billing page has your account ID and the console page you started from (see Payments).

Also on October 3, 2026, we added that while an account is restricted because a payment for its paid plan failed or its subscription is paused, we keep its apps’ activity log entries, app analytics totals, and past versions as its paid plan keeps them for 30 days from when the restriction starts (see How long we keep information). This applies to restrictions that start after this change went live.

Also on October 3, 2026, we added that from Stripe we also keep when your account’s first payment for a paid plan went through, and that invoice’s reference number (see Payments).

On October 4, 2026, we added that we email a business’s owner when one of its custom domains starts working after we check it by ourselves, or when we remove one because its records weren’t found within 14 days or another business added the same domain. The email never says which business that was (see Emails we send).

On October 7, 2026, we added the checks at sign-up: Cloudflare Turnstile on the sign-in form, and the disposable-email and mailbox checks (see Your account). We added the emails Userland sends for our customers’ apps as each becomes available, from notify.userland.link, with send records kept for 30 days and a do-not-send list (see People who use our customers’ apps), and reminder emails before a free preview ends (see Emails we send). We also added that when you upload an app in parts we keep the draft until you publish or delete it and delete unfinished uploads after 24 hours, and that if you export an app’s data we delete the export file after 7 days (see Your apps and How long we keep information).

Also on October 7, 2026, we added When you connect Userland to an AI assistant: what we keep about each connection and its sign-in, the email that approves a connection from another device, the emails about connections, the single-use pages for secret values and new API keys as they become available, and what the assistant’s company receives. We added that Userland doesn’t use your data, or your apps’ data, to train AI models (see The short version). We added the cookie that ties a connection request to your browser (see Cookies and browser storage), and the emails about exports (see Emails we send). We also set how long we keep records that had no deletion schedule: account security records for 2 years, records of emails we sent for 1 year, and connection records for a year after a connection ends, or after the last working API key it made is revoked, whichever is later; and that we delete the record of an export 90 days after its file (see How long we keep information).

On October 8, 2026, we started deleting an unpublished app’s saved records, files, settings, secret keys, app users, past versions, and the rest of what it held 30 days after it’s unpublished, and removing saved records an app deletes from our database 7 days after the delete. Before, we said both were kept (see How long we keep information, Your choices and rights, and People who use our customers’ apps).

Also on October 8, 2026, we made what we say about how long we keep other records match what Userland does: we delete records of messages other services send to your apps, and the information passed to background jobs, after your plan’s activity log window; records of deleted files after 7 days; app users’ sign-ins 61 days after they expire, with each app user keeping at most 20; sign-in links and command-line sign-in codes a day after they expire; and AI assistant connection tokens, requests to connect, connections that were never set up, assistants’ sign-in details, and connection records on the schedules in How long we keep information. We also added that a connection the assistant doesn’t use for 90 days ends, and that when a replaced token is used again, we cancel the app invitations that connection made that nobody has used yet (see When you connect Userland to an AI assistant), and that a link to a file in an export stops working once the file is deleted (see Your apps).

Also on October 8, 2026, we added invitations sent by Userland for an app, records used to limit repeated password reset requests, and the app security history kept for 30 days. We also clarified that an email accepted for sending may not reach the inbox, and that some delivery blocks expire automatically.

Contact

Email support@userland.fun with any questions about this policy or your information, or to make a privacy request. You can also write to David Jacob Wurtz, Attn: Userland, 13215 SE Mill Plain Blvd Ste C8 #3028, Vancouver, WA 98684, United States.