boomurl — Privacy Policy

This Privacy Policy explains how boomurl ("boomurl", "we", "us") handles information across boomurl.com (the app where you publish and manage sites and the HTTP/MCP API) and boomurl.site (the domain where published sites are served). boomurl is operated by Control Plane (controlplane.com). It works alongside our Terms of Use.

This policy does notgovern the content of the third-party websites that users publish on boomurl.site. Each published site is the responsibility of the person who published it; if a published site collects your information, that site's own practices apply.

Information you give us

• Email address. We email a one-time 6-digit code to verify you when you publish, sign in to the editor, mint an API key, delete a site, or connect a custom domain. Your email is also recorded as the owner of the sites you publish so that only you can manage them.
• Site content.The files you upload or paste (HTML, Markdown, images, and other static assets) and any edits you make. This content is published publicly — see “Published content is public” below.
• Custom domain details. If you connect a custom domain, the domain name you provide and the DNS records needed to verify and serve it.

Information we collect automatically

• IP address. We record the IP address associated with verification, publishing, and serving requests, and with code-send attempts. We use it to operate the service, enforce rate limits, and prevent and investigate abuse.
• Server and request logs. Standard logs such as timestamps, requested paths, status codes, user-agent, and referrer.
• Usage events. We record a small set of first-party, aggregate usage events on boomurl.com (for example, that a publish step was reached) to understand and improve the funnel. This analytics is privacy-friendly: it uses no cookies, no localStorage, and no cross-site identifiers.
• Abuse and security records. To protect the service we keep records of email code-send attempts (recipient, IP, and outcome), failed-verification counts, and any IPs an administrator has blocked.

• boomurl.com (the app). We do not use tracking or advertising cookies on the app. We set one functional cookie, boom_edit, only when you sign in to the inline editor; it is HttpOnly and holds your editor session.
• boomurl.site (served sites). Free published pages include third-party advertising, and those ad providers may set their own cookies or use similar technologies in your browser, governed by their privacy policies. Ad-free sites do not carry this advertising.

Publishing is, by design, a public act. A site you publish is served to anyone with its URL at boomurl.site/<name> (or your connected custom domain), and may be crawled and indexed by search engines. Do not publish anything you would not want to be public — including personal data, secrets, or credentials. Deleting a site removes it from our systems, but copies that others made or that search engines or third parties cached may persist beyond our control.

• Operate the service — verify you, publish and serve your sites, and let you manage them.
• Secure the service — rate limiting, abuse prevention, and investigating misuse.
• Maintain and improve the service, including aggregate, privacy-friendly usage analytics.
• Communicate with you about your verification codes and your sites.
• Enforce our Terms of Use and comply with legal obligations.

We use a small number of providers to run boomurl. They process information on our behalf for the purposes described here:

• Resend — delivers the verification/sign-in emails (receives your email address and the code).
• Control Plane / Amazon Web Services — hosting, compute, database, and object storage for the app and your published files.
• Cloudflare — content-delivery network and DNS in front of served sites (boomurl.site) and custom domains.
• Advertising provider(s) — serve ads on free published pages (operate in the visitor's browser under their own policies).

We do not sell your personal information. We share it only: with the service providers above; when you direct us to (for example, by publishing content publicly); to comply with law, legal process, or lawful requests, and to protect the rights, safety, and property of boomurl, our users, and the public; and in connection with a merger, acquisition, or sale of assets, in which case we will seek to require the recipient to honor this policy.

We keep your published sites until you (or, where our Terms allow, we) delete them. Account-adjacent and security records — verification records, IP addresses, code-send attempt logs, and server logs — are kept for as long as needed to operate and protect the service and to meet legal obligations, then deleted or de-identified. Published sites that auto-expire (such as instant previews) are removed when they expire. We retain a limited number of prior versions of an edited site to support rollback.

• Delete your site and its data. You can remove any site you own — and the files and metadata associated with it — at any time from boomurl.com/delete.
• Access, correction, deletion, and objection. To the extent applicable law (such as the GDPR or CCPA/CPRA) grants you these rights, you may request access to, correction of, or deletion of your personal information, and object to or restrict certain processing. Contact us using the details below and we will respond as required by law. We do not discriminate against you for exercising these rights.
• Advertising. Ads on free published pages are served by third parties; you can manage ad-related choices through your browser settings and industry opt-out tools.

We use TLS for data in transit, store API keys only as irreversible hashes (never in plain text), make verification codes short-lived and attempt-limited with constant-time comparison, and apply per-IP and per-recipient rate limits plus an IP blocklist to deter abuse. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

boomurl is operated from, and processes and stores information in, the United States. If you access the service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

boomurl is not directed to children. You must be at least 18 (or the age of majority where you live) to publish content. We do not knowingly collect personal information from children under 13; if you believe a child has provided us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective” date above and post the updated policy at this URL. Material changes will be reflected here; your continued use of the service after an update means you accept the revised policy.

Questions or privacy requests: privacy@boomurl.com. boomurl is operated by Control Plane (controlplane.com). For the fastest way to remove a site and its data, use boomurl.com/delete.