Updated 11 September 2026

Privacy

A clear view of your data.

Who operates ALREADY UP

Publishing data

We store uploaded files in private Google Cloud Storage and keep publishing records in Firestore: site and deployment identifiers, file paths, sizes, checksums, timestamps and publication state. Your browser sends file bytes directly to storage; the control API receives the manifest and publication requests.

A live link makes published content publicly accessible. Do not upload sensitive personal information or secrets. No account is required to publish.

Optional sign-in and keeping a site

When sign-in is available, Google Identity Platform handles Google and email-link authentication. We store your provider user ID, verified email, display name, account timestamps and site ownership in Firestore. An essential, secure HttpOnly session cookie remembers sign-in for up to five days. Signing out clears it and requests revocation of your other sessions.

A separate essential HttpOnly cookie proves which browser published a temporary site. We store a hash of that capability, not the raw cookie. It lasts up to seven days and can be renewed when you publish. Your browser may remember a recent site ID and a pending Keep action so you can return after email sign-in. These functional records are separate from analytics consent. Losing the ownership cookie can prevent saving an anonymous site.

Keeping a site saves it to your account for management without changing its public link. Kept sites remain subject to service limits and abuse removal. Authentication emails and session tokens are not product analytics properties. Account data uses Google Cloud services; PostHog EU processing is a separate analytics configuration.

Optional AI domain help

When AI help is enabled and you send a question, Anthropic processes your question, the previous exchange in this panel, the domain setup stage and a reviewed DNS-provider guide. Exact verification values, authentication credentials and uploaded website files are not included by the application. Do not enter passwords or API keys. Anthropic’s own data-processing and retention terms apply.

We keep the conversation in the current open panel and clear it on account change. Our operational logs contain model, stage, provider, timing and token counts, not conversation text. Account-level request counters enforce usage limits. Standard domain setup remains available without AI. DNS-provider detection sends the public domain name to Google Public DNS; it does not change DNS records.

Expiry and removal

Published links do not expire automatically. Unsaved links are not automatically added to an account and do not have saved-site backups. Existing expired links are not restored by this policy change. Manual deletion and safety or abuse removal still apply; deletion does not mean every stored copy is removed immediately. Publishing metadata, abuse records and operational logs can outlast a live link. Keep your original files.

Abuse prevention and operations

We use network-derived, keyed identifiers to enforce anonymous limits and help prevent abuse. These are separate from analytics identifiers. Google Cloud processes request information to serve traffic and protect the service. Infrastructure logs may include network and request metadata, such as IP addresses, request paths, status codes and timing.

Application logs use structured operational information such as error categories and durations. Product analytics is separate from operational monitoring. Reports you email us include your contact details and the information you choose to provide; we use those details to investigate and reply.

The application loads fonts from Google Fonts. Its servers receive request information when your browser fetches those fonts.

Product analytics, with your choice

We use PostHog EU (Frankfurt) for product analytics. Browser analytics remain off until you explicitly choose Accept analytics. Publishing works if you decline. Before consent, we do not initialize PostHog in your browser or create a persistent analytics identity. We store your consent choice only to remember it.

After consent, PostHog uses a random anonymous identifier stored in your browser’s localStorage. We send only explicit ALREADY UP events: homepage visits and returns, folder or HTML selection, publish attempts, file counts and total bytes, upload timings, error categories, and Copy link or Open site actions. These information pages do not send product analytics events.

Separately, our server records committed publications and quota denials using opaque publication or attempt IDs, input type, counts and timing. These events do not depend on browser consent, include no browser cookie or session identifier, and do not create person profiles.

What analytics does not collect

Product analytics properties exclude uploaded HTML, code or other content, filenames, customer file paths, signed URLs and query strings, raw IP addresses, network quota identifiers, form values, beta or invite codes, cookies and secrets. Network connections necessarily expose a source address to the receiving service; IP geolocation is disabled in our analytics configuration.

Autocapture is off. Session Replay is off. We inject no PostHog tracking into customer-hosted *.alreadyup.page content. Open site events record clicks in ALREADY UP, not visits to customer pages. Publishers may include their own scripts in their sites.

Your analytics choice

Withdrawal stops future browser capture and clears pending events in open ALREADY UP tabs. Events already sent are not erased by withdrawal. Server publication events continue independently.

Questions about data

Contact ukukudu@gmail.com about your data or a privacy concern. Include enough information to identify the relevant publication, without sending secrets.