Urloo — Privacy Policy
Last updated: 30 October 2026
Urloo is a personal content vault that lets you save links, organise them into
collections, and share collections with others. This policy explains what we
collect, why, and the choices you have.
Information we collect
- Email address — used to sign you in and to send
account-related messages. There are no passwords: you sign in with a one-time
code sent to your email, or with Google.
- If you sign in with Google — after Google verifies your
account, we receive your email address and your name. We use your name as your
display name if you haven't set one. We don't receive your Google password and
get no other access to your Google account.
- Content you save — the links (URLs), titles, descriptions,
thumbnails, notes, tags, and collections you create in the app.
- Profile details you choose to add — display name, bio, and
an optional profile photo.
- A PIN, if you set one, to lock secured collections and the
app. It's a privacy screen rather than a password, and it can be emailed back to
you if you forget it.
- Purchases — if you buy a Plus Pack, Google Play handles the
payment. We receive the purchase token and which pack you bought, so we can
confirm the purchase with Google and add the packs to your account. We never see
your card or payment details.
- Reports — if you report a link, a collection, or a curator, we
record the report, what you reported, and your account so the Urloo team can
review it and follow up.
- Server logs — our server records the IP address, time, and
address of each request, kept for 15 days for security and troubleshooting.
We do not collect your location or contacts, and we do not use third-party
analytics. The Android app shows ads to free accounts through Google AdMob, which
uses your device's advertising ID — see Advertising.
Reminder notifications are scheduled on your device; nothing about them is sent
to us.
How we use your information
- To authenticate you and keep you signed in.
- To store, display, and organise the content you save.
- To fetch link previews (title, description, thumbnail) for the links you add.
- To share collections you choose to make public or invite others to.
- To verify purchases and apply the packs you bought.
- To review reported links and keep public collections safe.
What others can see
Collections you make public can be viewed by anyone, including people who don't
have an Urloo account, together with your display name, profile photo, and bio. If
you haven't set a display name, the part of your email address before the
@ is shown instead — set a display name in your profile to avoid this.
Members of a circle can see each other's display names. Your notes, private
collections, and email address are never shown to other people.
Service providers
- Email delivery — your email address is passed to our email
provider (Brevo) solely to deliver sign-in codes and other account messages.
- Google Sign-In — if you choose it, Google verifies your
identity and shares your name and email address with us.
- Google Play — processes Plus Pack payments and lets us verify
them.
- Google Safe Browsing — links in public collections
may be checked against Google Safe Browsing to protect users from unsafe sites.
- Google AdMob — shows ads to free accounts in the Android app
(see Advertising).
We do not sell your personal information. We never give advertisers your email
address, your saved links, or your collections.
Advertising
Free accounts in the Android app see a small number of ads from Google AdMob: ads
in the Stash and Explore feeds, labelled Sponsored, and occasionally a
full-screen ad after you close a link.
- What Google receives — Google's ads software in the app uses
your device's advertising ID, your IP address (which indicates your approximate
location), and general information about your device, and records which ads are
shown and tapped. Google uses this to show and measure ads and to prevent fraud;
depending on your choices, ads may be personalised.
How Google uses
information from apps that use its services.
- Your choices — where the law requires it (for example in the
EEA, the UK, and Switzerland), Google's consent form asks you before any ad is
requested, and you can change your answer later in Profile → Privacy
choices. You can also reset or delete your advertising ID in your device's
settings.
- No ads with a Plus Pack — any Plus Pack removes all ads. The web
app never shows ads.
Where your data is stored
Your data is stored on our private server and transmitted over encrypted (HTTPS)
connections. We keep backups on that server for up to 30 days to protect against
data loss.
Data retention & deletion
You can delete your account at any time:
Deleting your account immediately and permanently removes your saved links,
collections, and profile data from our live systems, including links you added to
other people's circles. Copies remaining in backups are removed as those backups
expire, within 30 days. You may also delete individual links or collections at any
time.
Children
Urloo is not directed to children under 13, and we do not knowingly collect
personal information from them.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected by
updating the date above.
Contact
Questions about this policy or your data? Email
support@urloo.aalveli.com.