Privacy Policy

1. Introduction

RedirX ("we," "our," or "us") is operated by Dylon Shattuck. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the RedirX web application at redirx.dev (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect the following types of information:

• Account Information — Email address and password, managed through Supabase Auth, when you create an account.
• Payment Information — Billing details processed securely through Stripe. We do not store your full credit card number on our servers.
• Project Data — URL lists and redirect mappings you upload or generate within the Service.
• Jev matching inputs — The URL-first workflow sends URL text and confirmed redirect examples to TypeSafe Jev, and URL path text to OpenAI for candidate retrieval. It does not fetch page bodies. Inputs, proposals, review history and model-response caches are stored with your project; confirmed examples are not shared across customer accounts.
• Usage Analytics — We use PostHog to record how the Service is used: pages viewed, links and buttons clicked, features used, and page performance measurements. This data is not anonymous. It is tied to a persistent identifier stored in your browser, and to your account once you sign in, so activity can be followed across visits and between our marketing site and the application.
• Session Recordings — PostHog records your interactions with our pages and replays them for us as video-like sessions. This covers mouse movement, clicks, scrolling, and navigation, along with browser console messages and the timing of network requests. Text you type into form fields is masked and is not captured; text displayed on the page is.
• Heatmaps — Aggregate click and scroll-depth data showing which parts of a page visitors interact with and how far down the page they read.
• Error Diagnostics — When something breaks, we capture the error message, its stack trace, and the page and browser it occurred on, so that we can fix it.
• Device and Location Data — Your IP address, browser, and device type. We do not anonymize IP addresses. PostHog uses your IP address to derive an approximate location, typically country and region, and it is retained alongside your event history.
• Experiment Assignment — Which version of a page you were shown when we are testing alternatives, recorded against your identifier so we can compare how each version performs.
• Cookies — Essential cookies for authentication sessions (Supabase) and an analytics cookie (PostHog) that identifies your browser across visits. The analytics cookie is set on the redirx.dev domain and its subdomains, so the same visitor is recognized on both redirx.dev and app.redirx.dev.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your redirect matching projects (Quick Match and Deep Match)
• Process payments and manage subscriptions
• Send transactional emails related to your account and projects
• Analyze usage patterns to improve and optimize the Service
• Review session recordings and heatmaps to understand where the Service is confusing or broken
• Run experiments (A/B tests) that show different versions of a page to different visitors, and measure which performs better
• Diagnose and fix errors and performance problems
• Respond to support requests and communications
• Enforce our Terms of Service and protect against misuse

4. Third-Party Services

We rely on the following third-party services to operate RedirX. Each has its own privacy policy governing how they handle your data:

• Supabase — Authentication and database
• Stripe — Payment processing
• PostHog — Product analytics
• TypeSafe — Jev decisions from URL text and confirmed redirect examples
• OpenAI — URL-path embeddings for candidate retrieval
• Vercel — Hosting and infrastructure

5. Data Retention

• Account data is retained for as long as your account remains active.
• Project data (URL lists and redirect mappings) is retained for as long as the project exists in your account.
• Matching data includes URL inventories, confirmed examples, proposals and per-run caches retained with your project.
• Payment records are retained as required by applicable tax and financial regulations.
• Session recordings are deleted automatically 30 days after they are captured.
• Analytics events, including heatmap and error data, are retained in PostHog under the standard retention period for our plan.

6. Data Security

We implement reasonable technical and organizational safeguards to protect your data. All data in transit is encrypted via HTTPS/TLS. Authentication is managed through Supabase with industry-standard security practices. Payment data is handled by Stripe, which is PCI-DSS compliant. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your account and associated data
• Export your project data
• Opt out of analytics, session recording, and heatmaps. Email us and we will disable collection for your account and delete any recordings already captured.

To exercise any of these rights, contact us at support@redirx.dev.

8. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.

9. International Data Transfers

Your information may be transferred to and processed in the United States, where our service infrastructure and third-party providers are located. By using the Service, you consent to the transfer of your data to the United States.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy, contact us at:

Dylon Shattuck
support@redirx.dev