Privacy Policy

1. Introduction

RedirX ("we," "our," or "us") is operated by Dylon Shattuck, an individual trading as RedirX, who is responsible for the personal information described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information through redirx.dev, app.redirx.dev, and our agent tools (the "Service").

2. Information We Collect

We collect the following types of information:

• Account Information — Your email address and password, or the basic profile your Google or GitHub account shares when you sign in with it, managed through Supabase Auth. When you connect an AI agent, we issue and store access tokens or API keys for it; you can revoke them.
• Payment Information — Billing details processed securely through Stripe. We do not store your full credit card number on our servers.
• Project Data — URL lists and redirect mappings you upload or generate within the Service.
• Matching inputs — The URL-first workflow sends URL text (including the host and any query string) and confirmed redirect examples to third-party AI model providers, which propose redirect matches and build embeddings for candidate retrieval. We switch between model providers as their quality changes; the providers in use are listed in section 5. It does not fetch page bodies. Older site-audit and content-matching features, where still available, fetch the public pages you point them at, sometimes from Internet Archive copies, and send page text to an AI model provider. Inputs, proposals, review history and model-response caches are stored with your project; confirmed examples are not shared across customer accounts.
• Usage Analytics — We use PostHog to record how the Service is used: pages viewed, links and buttons clicked, features used, and page performance measurements. This data is not anonymous. It is tied to a persistent identifier stored in your browser, and may be associated with your account when you sign in. Analytics identity cookies can be shared between the marketing site and application. Analytics runs by default on this marketing site; section 8 explains how to opt out. Our server also counts requests to machine-readable files and tools (such as llms.txt, skill.md and the sitemap checker) and records server errors, with the requesting browser or agent's user agent and referring page. When the request comes from a browser running our analytics, those records can be linked to the same identifier. The separately deployed application has its own collection behavior.
• FAQ questions and answers — When you ask the FAQ assistant a question, it is sent through OpenRouter to Google to generate an AI answer. Unless you have opted out of analytics (see section 8), sanitized questions and answers are sent to PostHog for review to improve answers, along with answer status and helpfulness feedback. Identifiable details are filtered on a best-effort basis; this does not guarantee anonymity. Don’t include private information in your questions. FAQ text is excluded from browser autocapture and session recordings. To enforce rate and spending limits even when analytics is off, our FAQ service derives a daily keyed identifier from your IP address and stores request identifiers and usage counters in Supabase. The raw IP is not sent to that guard database.
• Session Recordings — PostHog records your interactions with our pages and replays them for us as video-like sessions. This covers mouse movement, clicks, scrolling, and navigation. On this website recordings run by default unless you opt out, form inputs are masked, console recording is disabled, and FAQ requests are excluded from network recording. Public text displayed on the page may appear in a recording. Avoid placing personal or secret information in URLs or questions. In the application, analytics and recordings run while you use it, are linked to your account (including your email address) after you sign in, and also capture browser console messages.
• Heatmaps — Aggregate click and scroll-depth data showing which parts of a page visitors interact with and how far down the page they read.
• Error Diagnostics — When something breaks, we capture the error message, its stack trace, and the page and browser it occurred on, so that we can fix it.
• Device and Location Data — Your IP address, browser, and device type may be processed by our hosting and service providers to deliver requests and prevent abuse. When analytics runs on this website, PostHog receives your IP address with each event; this website turns off PostHog's IP-based location lookup for its own events. In the application, PostHog receives your IP address with each event and uses it to estimate your approximate location (country, region and city). Infrastructure request logs also process IP addresses.
• Experiment Assignment — Which version of a page you were shown when we are testing alternatives, recorded against your identifier so we can compare how each version performs.
• Cookies — Essential cookies for authentication sessions (Supabase) and an analytics cookie (PostHog) that identifies your browser across visits. The analytics cookie can be set on the redirx.dev domain and its subdomains.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process URL inventories, propose matches, apply confirmed examples, and export approved redirects
• Process payments and manage subscriptions
• Send transactional emails related to your account and projects
• Analyze usage patterns to improve and optimize the Service
• Review sanitized FAQ questions, answers, and feedback to improve answer quality
• Review session recordings and heatmaps to understand where the Service is confusing or broken
• Run experiments (A/B tests) that show different versions of a page to different visitors, and measure which performs better
• Diagnose and fix errors and performance problems
• Respond to support requests and communications
• Enforce our Terms of Service and protect against misuse

4. Legal Bases and Customer Data

Where GDPR or similar law applies, we rely on performance of our agreement to provide accounts and requested migrations; legal obligations for required billing records; and legitimate interests in securing the Service, preventing abuse, responding to support, and understanding and improving the website and the Service through analytics, session recordings, heatmaps and experiments. You can object to that processing at any time; section 8 explains how to opt out.

Only supply URLs and examples you are authorized to use. URL paths and query strings can contain personal information: remove secrets, access tokens and unnecessary personal data before uploading. We do not offer data-processing agreements, and we have not entered into data-processing agreements with the providers listed below. Do not submit personal data whose processing would require one.

5. Third-Party Services

We rely on the following third-party services to operate RedirX. Each has its own privacy policy describing their practices. Providers receive the information needed for their role. Your chosen AI client also processes the information you share with it under its own terms and privacy notice:

• Supabase — Authentication and database
• Stripe — Payment processing
• PostHog — Product analytics and review of sanitized FAQ questions, answers, and feedback
• OpenRouter — Routes FAQ questions to the answer-generation provider
• Google — Generates FAQ answers
• Render — Backend hosting and operational request processing
• Resend — Delivery of account and service emails
• AI model providers — Redirect-match proposals and embeddings from URL text and confirmed redirect examples. We change providers as models improve; currently TypeSafe and OpenAI, either or both of which may process a given migration
• Vercel — Hosting and infrastructure
• Google and GitHub — Sign-in, if you choose to use them; Google Search Console, if you connect it
• Internet Archive — Archived copies of public pages, used only by the older content-matching features

6. Data Retention

• Account data is retained for as long as your account remains active.
• Project data (URL lists and redirect mappings) is retained for as long as the project exists in your account.
• Matching data includes URL inventories, confirmed examples, proposals and per-run caches retained with your project.
• Payment records are retained as required by applicable tax and financial regulations.
• Session recordings are deleted automatically 30 days after they are captured.
• Analytics events, including sanitized FAQ questions and answers, feedback, heatmap and error data, are retained in PostHog under the standard retention period for our plan. Contact us to request deletion of analytics linked to you.

We retain information for the purposes described above, considering whether your account or project is active, support needs, security, disputes and legal recordkeeping duties. Deletion requests may require identity verification. Records that must be kept by law and limited backup copies may remain after active data is deleted. Third-party processing and backup retention follow the relevant provider arrangements.

7. Data Security

We implement reasonable technical and organizational safeguards to protect your data. All data in transit is encrypted via HTTPS/TLS. Authentication is managed through Supabase with industry-standard security practices. Payment data is handled by Stripe, which is PCI-DSS compliant. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location and the applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your account and associated data from Account → Your data in the application. Deletion cancels any subscription immediately without a partial refund, revokes your API keys and agent access, and removes your account and project data. We keep Stripe payment records required for tax and accounting, and a minimal deletion record (your account ID and Stripe customer and subscription IDs) so the deletion can be completed and is not reversed
• Export a copy of your account data as a ZIP of JSON files from Account → Your data, or export approved redirect maps from any migration
• Object to or restrict certain processing, and complain to your local data-protection authority
• Opt out of analytics, session recording, and heatmaps. On this website, turn on Global Privacy Control or Do Not Track in your browser: our analytics then stops capturing events and recordings for that browser, and FAQ questions are not sent to PostHog. Blocking cookies or scripts for redirx.dev in your browser also works. This stops future collection here; it does not delete past data or change the application's settings. Contact us to opt out in the application, for account-wide requests, or for deletion of existing records.

To exercise any of these rights, contact us at Dylon@RedirX.dev.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.

10. International Data Transfers

Our providers may process information in the United States and other countries, whose laws may differ from those where you live. We rely on each provider's own published terms and privacy practices for that processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Where required, we will provide additional notice of material changes or seek fresh consent before using information for a new purpose.

12. Contact

If you have questions about this Privacy Policy, contact us at:

Dylon Shattuck
Dylon@RedirX.dev