The short version
Upfling uses cookies and browser storage for three things without asking: keeping you signed in, stopping bots submitting our forms, and remembering whether you picked light or dark mode. A live chat widget on the dashboard also sets its own cookies (see below).
We also use analytics to measure how the service is used. Whether your consent is sought before cookies are set depends on where you are. You can run analytics with cookies, without them, or not at all. See below.
We also use conversion tracking from Google and Meta to measure advertising performance. These integrations set their own cookies unconditionally. See below.
What we actually set
Authentication (Clerk)
When you sign in, our authentication provider Clerk sets session cookies on upfling.host. They identify your browser as signed in so you are not asked for your password on every page. Without them, the dashboard cannot work. They are cleared when you sign out and expire on their own after a period of inactivity.
Strictly necessary. No consent required.
Bot protection (Cloudflare Turnstile)
The upload form and the abuse reporting form run a Cloudflare Turnstile challenge. Turnstile sets short-lived storage on the pages carrying the widget to work out whether the visitor is a person. It is a privacy- preserving alternative to a CAPTCHA: it does not track you across sites and it is not used for advertising.
Strictly necessary. No consent required.
Live chat (tawk.to)
A live chat widget provided by tawk.to loads on every page at upfling.host. It does not load on sites hosted with us. It sets cookies on your device (__tawkuuid, TawkConnectionTime, and session identifiers) to identify your browser across chat sessions and track connection state.
These cookies are set unconditionally, for every visitor, regardless of consent state or region. The widget is loaded to offer help, and the operator has decided it should always be available. tawk.to does not offer a cookieless mode. You cannot prevent its cookies from being set while the chat widget is present.
The Privacy Policy describes what data tawk.to processes.
Analytics
We use a product analytics provider to measure how the service is used and where users encounter errors, so that we can improve it. Our provider and the categories of data it receives are listed in the Privacy Policy. Processing takes place within the European Economic Area.
Analytics operates in one of three states, which you control:
- With cookies. Pages viewed, interactions with the interface, and a reconstruction of the session are recorded, and your activity can be recognised across visits. Information entered into forms is excluded.
- Without cookies. Nothing is stored on or read from your device, no session reconstruction takes place, and you are not recognised across visits. Visits are counted using an identifier derived on our provider's servers, which changes regularly and is not linked to your account.
- Off. No analytics code is loaded and no information is sent.
Where the law requires your consent before information is stored on your device (including the United Kingdom and the EEA), we obtain it first, and until you agree analytics operates without cookies. Where consent is not required, cookies are set by default. Which applies is determined by your location. In every case you can select any of the three states below, your selection is honoured, and the service functions identically.
Your IP address is used to derive an approximate location and is not retained.
Analyse
Conversion tracking (Google, Meta)
A Google Ads tag and a Facebook Pixel load on every page to measure whether advertising campaigns lead to sign-ups. Both fire a page-view event on load and a conversion event when a site is published.
The Facebook Pixel sets a first-party cookie (_fbp) on every visit, and a second (_fbc) when you arrive from a Facebook or Instagram ad. Both cookies identify your browser so Meta can attribute conversions to the ad that brought you here. The Google tag may set _gcl_au for the same purpose.
Page URLs, IP addresses, and browser information are sent to Google and to Meta when these tags fire. The Privacy Policy lists both as sub-processors and links their data processing agreements.
These cookies are set unconditionally, for every visitor, regardless of consent state or region. This matches the live chat widget. If you block scripts from connect.facebook.net or googletagmanager.com, the tags will not load and no cookies will be set, but the service will still work normally.
What we do not set
No social media embeds that phone home. No fingerprinting. We do not sell or share what we collect, and it is not used to build a profile of you for anyone else's benefit.
The Privacy Policy lists every company that receives any data, and what each one gets.
How we decide what to ask about
Under the Privacy and Electronic Communications Regulations, consent is needed before storing anything on your device unless that storage is strictly necessary to provide a service you asked for.
Sign-in, bot protection and your theme preference meet that exemption: you cannot stay signed in without a session cookie, we cannot keep bots off a public form without a bot check, and we cannot remember your theme without storing your theme. None of those are optional to the thing you came here to do, so we do not pretend to offer a choice we would not honour.
Analytics cookies do not meet that exemption. Where the requirement applies, consent is requested before they are set: accepting and refusing are equally prominent, no option is pre-selected, and taking no action is treated as a refusal. Where it does not apply, the Analytics section above sets out the position and the controls.
Those regulations govern what is stored on your device. Analytics without cookies stores nothing, so that requirement is not engaged; it is carried out in our legitimate interest in understanding how the service performs, using aggregate measurements that are not linked to you. You may object to it, and the "off" control in the Analytics section gives effect to that objection.
You may change your selection at any time, in any direction, and it will be respected regardless of where you are.
Cookies on sites hosted with us
Upfling sets no cookies on the sites we host for our customers. When someone visits example.upfling.site, we serve the files and nothing else. On the free plan we add a small visible badge to the page; it sets no cookies and loads no scripts.
If a hosted site's own HTML or JavaScript sets cookies (an embedded video, a third-party widget, an analytics snippet the site owner added), that is the site owner's doing, and the site owner is the data controller for it, not us. Questions about a particular site go to whoever publishes it.
If you publish a site with Upfling and your site sets cookies, working out what you need to tell your own visitors is your responsibility.
Controlling storage in your browser
Every major browser lets you view, block and delete cookies and site data from its settings, usually under "Privacy". Blocking cookies for upfling.host will sign you out and prevent you from signing back in. The dashboard cannot function without them.
Questions about anything on this page go to privacy@upfling.host.
Questions about this document? Email legal@upfling.host.