Privacy Policy
Last updated: April 12, 2026
What Unphurl is
Unphurl is a URL intelligence API. It analyses URLs across seven dimensions (redirect behaviour, brand impersonation, domain intelligence, SSL/TLS, parked detection, URL structure, DNS enrichment) and returns structured signals with a risk score. It is available as a REST API, CLI tool, MCP server, and hosted MCP connector.
What we collect
Account information: When you sign up, we collect your email address, first name, and optionally your company name. We use your email to send a verification link and transactional notifications. We do not send marketing emails.
API usage data: We log which domains were checked, when, and by which account. This is used for billing, analytics, and to operate the reputation cache. We do not log full URLs with paths or query parameters in the cache. The cache stores hostnames only (e.g., "example.com", not "example.com/page?token=abc").
Payment information: Payments are processed by Stripe. We do not store credit card numbers, bank details, or other payment credentials. Stripe's privacy policy governs how they handle payment data.
Technical data: Standard HTTP request metadata (IP address, user agent) is processed by Cloudflare as part of normal request handling. We do not store IP addresses in our database.
What we do NOT collect
- Page content. We do not download, store, or analyse the content behind a URL.
- Personal browsing history. We only analyse URLs you explicitly submit.
- Advertising data. We do not use your data for ad targeting or sell it to third parties.
- Cookies. The API and MCP server do not use cookies. The website uses Google Analytics (GA4), which uses its own cookies for anonymous traffic analytics.
The reputation cache
When a URL is checked for the first time, the domain-level signals (age, registrar, SSL status, parked status, MX records) are cached so that subsequent checks by any user return faster results without re-running the pipeline. The cache stores:
- The hostname (not the full URL)
- Domain-level signals (not scores, those are computed per request with each user's profile weights)
- When the domain was first seen and last checked
- How many times the domain has been checked
Cache entries expire automatically based on risk level (6 hours to 48 hours depending on domain age and score). No personally identifiable information is stored in the cache.
How we use your data
- To operate the service (authenticate requests, track credit usage, deliver results)
- To improve the product (aggregate usage statistics, cache performance metrics)
- To communicate with you (verification emails, billing receipts via Stripe)
Data retention
Account data: Retained until you delete your account. Account deletion removes all associated data (check history, scoring profiles, purchase records).
Cache data: Domain signals expire automatically and are overwritten on subsequent checks. There is no permanent archive.
Analytics: Aggregate daily statistics (total URLs checked, pipeline runs, revenue) are retained indefinitely. These contain no personally identifiable information.
Third-party services
| Service | Purpose |
|---|---|
| Cloudflare | Hosting, CDN, DNS, database |
| Stripe | Payment processing |
| Resend | Transactional email |
| Google Analytics | Anonymous website traffic analytics |
Data location
All data is processed and stored on Cloudflare's global network.
Your rights
- Access your data via the API, CLI, or MCP tools
- Delete your account and all associated data via the API or by contacting us
- Export your check history via the API or CLI
Children
Unphurl is not directed at children under 13. We do not knowingly collect personal information from children.
Changes
We may update this policy as the product evolves. Material changes will be noted with an updated date at the top of this page.
Contact
Questions about this privacy policy: hi@unphurl.com