Privacy Policy

Last updated: August 2026

Two different things

This policy covers two things that are easy to confuse, and they are not governed by the same rules.

The marketing site — www.ultrv.com, the pages you are reading right now — is a public website with a small amount of analytics on it. Details below.

The product — your account at app.ultrv.com and the blogs it publishes — carries no analytics scripts, no tracking pixels, and no third-party scripts of any kind. Your readers are not measured by anyone but you, and even then only in aggregate.

Analytics on this marketing site

www.ultrv.com usesPlausible Analytics, a cookieless analytics service. It sets no cookies, stores no personal data, assigns no persistent identifier, and cannot follow you to other sites. What it records is aggregate: page views, referring site, country, browser, and device type. We use it to see which pages are worth keeping.

It is one script, loaded from plausible.io, and it is the only third-party request this site makes. If you block it, nothing on the site stops working.

Analytics on published blogs

Blogs published on ULTRV load no analytics script at all. The visitor statistics you see in your dashboard are counted on our servers as requests arrive: visitors are identified by an anonymized hash and no IP addresses are stored. Your readers are not given a cookie, an identifier, or a profile.

One exception, and it is yours: ULTRV lets you inject your own code into your blog's <head> or before </body>. If you add a third-party analytics tag or pixel there, it runs on your blog and that processing is yours to disclose to your readers, not ours.

What we collect

Account data. Your email address and a hashed password. If you enable two-factor authentication, the associated secret and recovery codes.
Content. Everything you write and upload — posts, pages, images, settings, drafts included.
Server logs. Standard web-server records: IP address, user agent, requested URL, timestamp.
Blog statistics. Aggregate counts for your blog, derived from an anonymized hash rather than stored IPs.
Import credentials. If you import from a live WordPress or Ghost site, the credentials you supply are stored only to run the import and clear automatically after 24 hours.
LLM snapshot access logs. If your blog serves /llms.txt, accesses are logged with anonymized IP addresses. You can switch the snapshots off entirely in Feeds settings.

Why we're allowed to hold it

Account data and content are processed because we cannot provide the service you signed up for without them. Server logs and aggregate blog statistics are processed on a legitimate interest in keeping the platform secure, debuggable, and useful to the people writing on it. We do not process your data for advertising, profiling, or automated decision-making, because we do none of those things.

Cookies

On app.ultrv.com: a session cookie to keep you signed in, and a CSRF token. Both are strictly necessary and neither tracks you. On www.ultrv.com: no cookies at all — the analytics described above are cookieless. There are no advertising, retargeting, or cross-site cookies anywhere on ULTRV.

How long we keep it

Content and account data are kept for as long as your account exists. When you delete your account, the account and its blogs are removed from the live service immediately; residual copies persist in encrypted backups until those backups age out.

Two windows are fixed and documented: stored import credentials clear after 24 hours, and blog statistics never contain an IP address to expire in the first place.

Exact retention periods for server logs and backups are not yet documented here. If you need them for a compliance review, ask at privacy@ultrv.com and we will tell you.

Who else touches your data

We do not sell your data, rent it, share it with data brokers, or hand it to advertisers. There is no ad-tech in the stack, so there is nothing to sell it to.

A small number of sub-processors are involved in running the service. The one that touches this website is:

Plausible Analytics — aggregate, cookieless traffic statistics for www.ultrv.com only. It never runs on app.ultrv.com or on a published blog.

Hosting, backups, and transactional email necessarily involve providers too. The full list is not yet published here; email privacy@ultrv.com and we will name them. We will also disclose data if a valid legal order requires it, and will tell you when we are permitted to.

Your rights

Wherever you live, you can get at your data. If you are in the EU, EEA, or UK, the GDPR gives you the rights to access, correct, delete, and port your data, to restrict or object to processing, and to complain to your national data protection authority. If you are in California, the CCPA gives you the rights to know what is collected, to have it deleted, to opt out of its sale — nothing is sold — and not to be treated worse for asking.

Two of those you can exercise yourself, without asking anyone:

Export. From your blog settings, export the whole blog as a ZIP: HTML for every post and page, all images, your feeds, and a manifest. It is free, it has always been free, and there is no premium tier that unlocks it.
Delete. From account settings, delete your account and everything attached to it.

For anything else — a copy of your server-log entries, a correction, a restriction request — emailprivacy@ultrv.com. We answer within 30 days, which is the legal limit rather than a target; in practice it is faster.

Security

Passwords are hashed. Every blog is served over HTTPS with SSL provisioned automatically. Two-factor authentication is available on every account and we suggest turning it on. Data is stored on secured servers and we take reasonable measures to protect it — no operator can honestly promise more than that.

Changes to this policy

When this policy changes materially, we will update the date at the top and email registered users. Editorial fixes get the date change only.

Contact

Questions about privacy? Email us at privacy@ultrv.com. General questions go to hello@ultrv.com. The terms of service cover the rest of the relationship.