Outbound click records
A Buy link first passes through an uglyHD URL at /go/<product>. The click row records the product, source, condition, observed cost per TB, whether a tracked affiliate destination was used, a bot/not-bot flag worked out from the request’s user-agent string at the moment it arrived, a provenance label (same-origin / cross-site-user / unverified) derived from the browser’s Fetch Metadata request headers, and the time of the click. The provenance header values themselves are never stored.
That record stores no IP address, user-agent string, cookie, session identifier or other person-level identifier. None is needed to count the traffic sent to a merchant.
Price-alert email
Price alerts are not switched on right now: there is no sign-up form on the site, and nothing described in this section is collected until there is. What follows is what will apply when they are.
Price alerts use double opt-in: typing an address into a sign-up form does not subscribe it. uglyHD stores the address (trimmed and in lower case), when it was added, the signup source and when a confirmation email was last sent to it, and emails it one confirmation link. Only the one-way hash of that link is stored, never the link itself; it works once and expires after 48 hours, and an address that is never confirmed is deleted about a week after its link expires. Nothing else is sent to an address that has not confirmed. So that one inbox cannot be flooded with confirmation emails, uglyHD also keeps a keyed one-way hash of the mailbox (not a readable address) with the number of confirmation emails sent to it in the last day; those counts are swept after two weeks.
When you open the link and press its button, uglyHD records when you confirmed and stores each alert preference: whether it follows a category or drive, the target, the requested drop threshold, when the preference was created and, after a successful alert, when it was last notified. Every email, the confirmation included, has an unsubscribe link (and the mail-client unsubscribe button works too) and the postal address of Ugly Pumpkins LLC. Unsubscribing records when you did, deletes your alert preferences and keeps only the address, the signup source, the mailbox hash and the timestamps, so that we know not to email you again. An address that has unsubscribed is sent no more alerts, and neither it nor its dot and +tag variants is sent a confirmation email if someone types it into a form. Each confirmed address is mailed only until it unsubscribes, and every email has its own unsubscribe link. To start alerts again, write to us or use a different address. To avoid sending a digest twice, uglyHD also keeps a short record of each one (the address, the day and the alert preferences it covered) for up to two weeks.
Confirmation and alert email is delivered through Resend, which receives the email address and message needed to deliver it. The limit on sign-ups per network address is kept in the memory of the server process that answers the request and is not written to the database or logs. The overall limits on confirmation emails count each email sent as a timestamp with no address or email, which the daily clean-up removes once it is more than a day old. Contact uglyHD to request correction or complete deletion of a subscriber address.
Analytics, cookies and local preferences
uglyHD keeps a first-party count of page views: for each page and each day, how many times it was viewed, the referring site’s hostname (or that no referrer was sent), and a bot/not-bot flag worked out from the request’s user-agent string at the moment it arrived. This counter sets no cookie, no IP address is stored, no user-agent string is stored, and no identifier links these counts back to a particular visitor or browser — there is nothing in this data that could be used to reconstruct one person’s visits. The site loads no third-party analytics or advertising scripts.
Separately, the drive table uses browser sessionStorage to remember the selected table view and whether its display banner was dismissed for the current browser tab. Those values stay in the browser and contain no identity or browsing history.
Hosting and Cloudflare
The public uglyHD website, including its price-alert sign-up and unsubscribe forms and the Buy links at /go/<product>, is served by Cloudflare, Inc., which acts as a processor for uglyHD. Like any web host, Cloudflare receives the technical details of each request: your IP address, your browser’s user-agent string and the address you asked for, and it handles them under its own privacy policy. uglyHD does not store an IP address or a user-agent string against an email address, a click or a page view, and writes neither to its database or logs.
Price alerts are not switched on right now, so this paragraph describes where sign-ups will be kept once they are. Price-alert sign-ups are kept in Cloudflare’s D1 database, in addition to uglyHD’s own server: the address (trimmed and in lower case), when it was added, the signup source, the drive or category you asked to follow, when a confirmation email was last sent, when you confirmed or unsubscribed, the one-way hash of the confirmation link and the keyed one-way hash of the mailbox, plus the per-mailbox count of confirmation emails described above. An address that has not confirmed is kept only at Cloudflare, is not passed to uglyHD’s own server, and is deleted about a week after its link expires. When you confirm, or unsubscribe, uglyHD’s own server receives a copy of that change; the alert you asked for is handed to it when you confirm, it keeps your alert preferences, and the pending copy at Cloudflare is cleared. An unsubscribed address stays in D1 with the timestamps described above, as the record that it must not be emailed again.
Click records, page-view counts and the confirmations and opt-outs above are not written straight to uglyHD’s own server. Each is first placed in a queue in D1 and deleted from it once uglyHD’s server has received it, which normally takes minutes; if the server is unreachable the entries wait in the queue until it is back. A queued click holds only what is described under outbound click records above (the product, source, condition, cost per TB, whether a tracked destination was used, the bot/not-bot flag, the provenance label and the time), a queued page view holds only the day, the page, the referring site’s hostname and the bot/not-bot flag, and a queued confirmation or opt-out holds the address, its signup source, timestamps and mailbox hash and, for a confirmation, the alert you asked for. The queue holds no IP address and no user-agent string.
None of the sign-up records or queue entries above is returned by any page or public data feed of the site. They are read and changed only by uglyHD’s own code and by uglyHD’s server and operators through their Cloudflare account. D1 also keeps automatic point-in-time backups of the database (7 days on Cloudflare’s free plan, which uglyHD uses), so an entry that has been removed or deleted can remain in a backup for up to that long, after which it is gone. A request to correct or delete a subscriber address covers the copy in D1 as well as the one on uglyHD’s own server.
Links to merchants
A Buy click is redirected to the current merchant URL or, where a programme is configured, that programme’s affiliate tracking URL. uglyHD does not load a third-party ad network on the page. Once you leave uglyHD, the merchant or affiliate network applies its own privacy policy. See the affiliate disclosure for how those links work.