Privacy Policy
What we collect and how we use it.
Last updated: September 26, 2026
Overview
This Privacy Policy explains what we collect when you use Zugo, and how we use and share it. We collect what we need to run the Service. We also measure how people find us and which of our ads lead to sign-ups and purchases: for that we have our own analytics, and we work with Google, Meta and TikTok. Where you are decides whether their analytics and advertising cookies wait for your permission or run until you turn them off: section 10 explains the rule, and section 11 how to change your choice.
1. Who we are
The controller of your personal data is AFM Digital LLC, company number L25000541394, registered at 1100 Cleveland Street, Apt 1403, Clearwater, Florida 33755, United States. For any privacy question or request, write to support@zugo.dev.
2. What we collect
Account data: your email address and authentication data, managed through Supabase Auth. If you sign in with Google, we receive your name, email address, and profile picture from Google to create and secure your account, consistent with Google's API Services User Data Policy. Content: the prompts you submit and the builds you generate. Payment data: when you buy credits, payment is processed by Stripe; the processor receives your email address so it can issue the receipt. We receive confirmation and limited details (the amount, the plan, renewals and refunds) but do not store your full card number. Usage data: logs, credit balances and transactions, basic technical information, and what our own analytics records (section 6). How you reached us: see section 3. Abuse-prevention signals: to stop one person farming free credits from many accounts, we derive a salted, one-way hash of your IP address and of a lightweight device fingerprint at the moment you claim free credits. For this purpose we store only these hashes, never your raw IP or fingerprint, and use them solely for fraud prevention, not to track you across other sites. To enforce the referral program rule that you cannot invite yourself, we also keep the same kind of salted hash of your IP address when you open your referral link, join through someone's link or open checkout, and a one-way hash of the card fingerprint that Stripe returns for each payment, never the card number itself, and compare them only with accounts in the same referral.
3. How you reached us
With your account we keep a short record of how you came to Zugo: the campaign tags (utm) in the address you arrived at, the host name of the site that sent you, the page you landed on, and your country, worked out from your IP address. We keep the first and the latest of these. We also keep your cookie choice: what you allowed, whether you chose it or it was the default for your region, and when. Only while advertising is allowed do we add the ad click identifier from that address (such as gclid, fbclid or ttclid) and the IDs that the Meta and TikTok tags keep in cookies on our site; the ID from the Google Analytics cookie is added only while analytics is allowed. These IDs let an event we send from our server be matched to the same browser. When you sign up or start a checkout, we record the IP address and browser (user agent) of that request, and the page address, to match the sign-up or purchase to the ad that led to it; the IP address and browser are kept for no longer than 7 days.
4. How we use it
To provide and operate the Service; to process payments; to grant and meter credits and prevent abuse; to provide support; to maintain security; to understand how people find and use Zugo; to measure which of our ads lead to sign-ups and purchases, and to let advertising platforms show our ads to people likely to be interested, including people who have already visited us (section 9); and to comply with legal obligations. Where the GDPR or the UK GDPR applies, our legal bases are: the contract with you, for running the Service and taking payments; our legal obligations; our legitimate interests, for security, fraud prevention and our own analytics, including the record of how you reached us; and your consent, for analytics and advertising cookies and for sending your data to advertising platforms.
5. Who we share it with
Service providers ("processors") who handle data on our behalf: Supabase (database and authentication), Stripe (payments), AI providers (to generate your builds from your prompts), and Vercel (hosting, and a page-view counter without cookies). Advertising and analytics platforms: Google (Google Tag Manager, Google Analytics and Google Ads), Meta Platforms (the Meta pixel and the Conversions API, for ads on Facebook and Instagram) and TikTok (the TikTok pixel and the Events API) receive the data described in sections 7 and 8, and only as far as your choice allows (sections 10 and 11). They measure our ads for us, and they also use this data for their own purposes under their own terms and privacy policies, for example to improve their advertising systems; for that part they act as independent or joint controllers, not as our processors. We do not sell your personal data for money. But while advertising is on, passing data to Google, Meta and TikTok for advertising counts as "sharing" for cross-context behavioral advertising under California law, and the laws of some other US states may treat it as a "sale"; section 17 explains how to opt out. We may disclose data if required by law or to protect our rights and users.
6. Our own analytics
On zugo.dev we measure visits with our own analytics, Pulse, which sets no cookie and shares nothing with advertisers. It keeps a random session ID in your browser's session storage (zp_s, replaced after 30 minutes of inactivity) and records the pages you open; which of our buttons and links you click, by their name in our interface; where on the page you click, how far you scroll and, for a small share of visits, how the pointer moves; the campaign tags and ad click identifiers in the address you arrived at; the host name of the referring site; your country; a coarse device class; the language of our interface and of your browser; and whether your browser translated the page. To tell visitors apart within one day it uses a hash of your IP address and browser, salted with a value that changes every day; the IP address itself is never stored. After you sign in, your visits are linked to your account, which is how we see which campaign brought an account and what it did next. Pulse runs for every visitor, whatever you choose in "Cookie settings": it relies on our legitimate interest in understanding how Zugo is found and used, and you can object by writing to support@zugo.dev. We also use Vercel Web Analytics, our hosting provider's page-view counter, which sets no cookie either and recognises a visit only by a hash of the request that Vercel discards after 24 hours.
7. What Google, Meta and TikTok receive from your browser
Google Tag Manager, a Google service, loads the tags described here and sets no cookie of its own. Google Analytics 4 measures how the site is used; Google Ads, the Meta pixel and the TikTok pixel measure our ads and help target them. Through these tags the three companies receive some or all of: the pages you view and the steps you take (signing up or in, viewing plans, starting checkout, completing a purchase, your first successful build, publishing a project); the ad click identifier in the address you arrived at; the IDs kept in their cookies; an event ID that contains your account ID or the payment number; your IP address and browser details; and, when you sign up or pay while advertising is on, your email address, hashed with SHA-256 before it is sent.
8. What our server reports to them
We also report conversions from our server: to Meta (Conversions API), sign-ups, purchases and subscription renewals; to TikTok (Events API), sign-ups and purchases; to Google Analytics (Measurement Protocol), purchases, renewals and refunds (it receives sign-ups from your browser only). Each report carries an event ID, the time, the page address and, for a payment, the amount, currency and plan or credit pack. The event ID is not hashed: for a sign-up it contains your account ID, for a payment the payment number, so that the same event sent from your browser and from our server can be matched. Meta and TikTok also receive your email address and your account ID, both hashed with SHA-256, the IDs from their cookies, and, within 7 days of the sign-up or checkout, the IP address and browser recorded then; Google Analytics receives its own client ID. The same event sent from your browser and from our server carries one event ID, so the platform counts it once. A hash is not anonymous: a platform can match it to an account you have with it, and that is what it is for. We never send these companies your prompts or builds, your card details, or your email address in readable form.
9. Why, and on what basis
We use these platforms to learn which ads lead to sign-ups and purchases, to let the platforms decide who is shown our ads, and to show our ads again to people who visited or signed up (remarketing), or to leave out people who are already customers. In practice this means that third-party vendors, including Google, Meta and TikTok, use cookies and device identifiers to show our ads on other sites and apps based on your past visits to our site. Each company also uses the data under its own policy: how Google uses information from sites that use its services, the Meta Privacy Policy and the TikTok Privacy Policy. In the European Economic Area, the United Kingdom and Switzerland, and when we cannot tell where you are, we do this only with your consent. Elsewhere we rely on our legitimate interest in measuring and improving our advertising, and you can opt out at any time.
10. Where you are sets the default
When you open our site, we look up the country of your IP address to decide which rule applies to you; we do not store the IP address for this. In the European Economic Area (the EU countries, Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland, and whenever the country cannot be determined, no analytics or advertising cookie is set, no advertising tag runs, and our server reports nothing about you to Google, Meta or TikTok until you click "Accept". Until then the Google tag still loads, which shows Google your IP address and the page like any other request, but in Google's consent mode it sets no cookie and sends only signals without an identifier (such as the time, the page, your browser type and the fact that consent was not given). Everywhere else, analytics and advertising are on from your first visit, and a notice on the site offers to turn them off.
11. Changing your choice
Wherever you are, you can change your choice at any time with the "Cookie settings" link at the bottom of the site. Turning advertising off stops the advertising tags in this browser and stops us reporting your later sign-ups and payments to Meta and TikTok; turning analytics off does the same for Google Analytics. Your account follows your latest choice in a browser where you are signed in; a choice made while signed out reaches it the next time you sign in on that browser. Cookies already set stay in your browser until they expire or you clear them, and what was sent before you changed your mind stays with the platform under its own rules. You can also limit ads in each platform's own settings (Google's My Ad Center, the ad preferences in Meta's Accounts Center, the ad settings in TikTok) and through the industry pages aboutads.info/choices and youronlinechoices.eu.
12. Pages published through Zugo
A page you publish is served from our infrastructure, so we can count views on it for you. That view counter records the page path, the host name of the referring site (never the full URL or its query string), and a coarse device class (phone, tablet or desktop) read from the browser's user-agent. It sets no cookie, stores no raw IP address, and is not used to build a profile of any visitor or to follow them to other sites. It is on by default and a project owner can have it turned off for a project by asking us at support@zugo.dev. If you publish a page, you are the controller of your own visitors' data and it is your responsibility to give them whatever notice your jurisdiction requires.
13. Cookies & local storage
We use cookies and browser storage for what the Service needs to work (keeping you signed in, remembering your cookie choice), for your preferences (theme, language) and, depending on your choice, for the analytics and advertising described in section 7. Our Cookie Policy lists each cookie and storage entry and how long it lasts.
14. Retention
We keep your data while your account is active and as needed to provide the Service, comply with law, and resolve disputes. You can ask us to delete your account and associated personal data. Some data has its own clock. The record of how you reached us, your cookie choice, the advertising identifiers stored with your account and the log of conversions we report to advertising platforms (which event, when, the amount, plan and page address, and whether it was delivered) are kept while the account exists and deleted with it. The IP address and browser used to match a sign-up or purchase to an ad are kept for no longer than 7 days. Raw records of our own analytics are deleted after 13 months, and click and scroll positions after 3 months; deleting your account removes their link to it. Cookies in your browser last as listed in the Cookie Policy. Data already passed to Google, Meta or TikTok is kept under their own rules, and deleting your account here does not delete it there.
15. Security
We use technical and organisational measures to protect your data, including encryption in transit and access controls. No system is perfectly secure, but we work to keep your data safe.
16. Your rights
Depending on where you live (including under the GDPR and CCPA), you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing, including processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time in "Cookie settings"; this does not affect what was done before. To exercise these rights, contact us at support@zugo.dev. If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to the data protection authority where you live. We will not treat you differently for using any of these rights.
17. California and other US states
If you live in California, or in another US state with a similar law, you can opt out of the "sale" and "sharing" of your personal information and of targeted advertising. Turning advertising off in "Cookie settings" does this for your browser and for the reports we send about your account from then on. The information concerned is identifiers (cookie IDs, IP address, and your email address and account ID in hashed form), activity on our site (pages and events) and commercial information (purchases, their amounts and plans); it goes to Google, Meta and TikTok for advertising.
18. International transfers
We, our processors and the advertising platforms may process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers.
19. Children
The Service is not directed to children under 13, and we do not knowingly collect their data.
20. Changes & contact
We may update this policy and will revise the "last updated" date. Questions or requests: support@zugo.dev, or by post to AFM Digital LLC, 1100 Cleveland Street, Apt 1403, Clearwater, Florida 33755, United States.
Language
This document is published in English and in Russian. The English version is the controlling version: if the two differ in meaning, the English text governs. The Russian translation is provided so you can read what you are agreeing to, and we will correct any translation error you report to support@zugo.dev.