Outbound click records
A Buy link first passes through an uglyHD URL at /go/<product>. The click row records the product, source, condition, observed cost per TB, whether a tracked affiliate destination was used, a bot/not-bot flag worked out from the request’s user-agent string at the moment it arrived, a provenance label (same-origin / cross-site-user / unverified) derived from the browser’s Fetch Metadata request headers, and the time of the click. The provenance header values themselves are never stored.
That record stores no IP address, user-agent string, cookie, session identifier or other person-level identifier. None is needed to count the traffic sent to a merchant.
Price-alert email
Price alerts use double opt-in: typing an address into a sign-up form does not subscribe it. uglyHD stores the address (trimmed and in lower case), when it was added, the signup source and when a confirmation email was last sent to it, and emails it one confirmation link. Only the one-way hash of that link is stored, never the link itself; it works once and expires after 48 hours, and an address that is never confirmed is deleted about a week after its link expires. Nothing else is sent to an address that has not confirmed. So that one inbox cannot be flooded with confirmation emails, uglyHD also keeps a keyed one-way hash of the mailbox (not a readable address) with the number of confirmation emails sent to it in the last day; those counts are swept after two weeks.
When you open the link and press its button, uglyHD records when you confirmed and stores each alert preference: whether it follows a category or drive, the target, the requested drop threshold, when the preference was created and, after a successful alert, when it was last notified. Every email, the confirmation included, has an unsubscribe link (and the mail-client unsubscribe button works too) and the postal address of Ugly Pumpkins LLC. Unsubscribing records when you did, deletes your alert preferences and keeps only the address, the signup source, the mailbox hash and the timestamps, so that we know not to email you again. An address that has unsubscribed is sent no more alerts, and neither it nor its dot and +tag variants is sent a confirmation email if someone types it into a form. Each confirmed address is mailed only until it unsubscribes, and every email has its own unsubscribe link. To start alerts again, write to us or use a different address. To avoid sending a digest twice, uglyHD also keeps a short record of each one (the address, the day and the alert preferences it covered) for up to two weeks.
Confirmation and alert email is delivered through Resend, which receives the email address and message needed to deliver it. The limits on sign-ups per network address and overall are kept in server memory and are not written to the database or logs. Contact uglyHD to request correction or complete deletion of a subscriber address.
Analytics, cookies and local preferences
uglyHD keeps a first-party count of page views: for each page and each day, how many times it was viewed, the referring site’s hostname (or that no referrer was sent), and a bot/not-bot flag worked out from the request’s user-agent string at the moment it arrived. This counter sets no cookie, no IP address is stored, no user-agent string is stored, and no identifier links these counts back to a particular visitor or browser — there is nothing in this data that could be used to reconstruct one person’s visits. The site loads no third-party analytics or advertising scripts.
Separately, the drive table uses browser sessionStorage to remember the selected table view and whether its display banner was dismissed for the current browser tab. Those values stay in the browser and contain no identity or browsing history.
Links to merchants
A Buy click is redirected to the current merchant URL or, where a programme is configured, that programme’s affiliate tracking URL. uglyHD does not load a third-party ad network on the page. Once you leave uglyHD, the merchant or affiliate network applies its own privacy policy. See the affiliate disclosure for how those links work.