Privacy Policy

Effective September 26, 2026; updated October 8, 2026. Winter Watermelon operates RedirectAtlas. Contact hello@wwatermelon.com.

Maps and monitoring

The free map audit processes your CSV locally in the browser. If you choose Monitor these redirects after an audit, the fixed map is kept in this browser until you open live checks; it reaches our servers only when you create the project. Saved live-check projects send and store your project name, source and expected destination URLs on our servers. We request these public URLs to observe HTTP status and redirects. We do not save destination page bodies. Do not submit credentials, private links or personal data. Each source and destination hostname needs DNS verification.

Saved projects remain until you delete them. Reports are retained for up to 30 days, with a maximum of 30 reports per project; older reports are removed. Delete a project to remove its maps and reports. Download any records you need before deletion.

ChatGPT connection

If you connect RedirectAtlas to ChatGPT, the CSV and source website you explicitly share for an audit are sent by your assistant to our server and the findings and corrected CSV text are returned to it. This is separate from the browser-local map checker. We do not persist maps or audit results in application storage, log their raw contents or capture analytics in the connection. Cloudflare hosts the endpoint and processes the request and connection details in transit; its infrastructure and security processing still apply. Your assistant provider handles your conversation, inputs and returned results under its own policies and settings. Do not share credentials, private access links or personal data in a map. The connection does not fetch the URLs in your CSV, access your accounts or change your website.

Accounts and providers

We store your email, account identifier, hashed login/session tokens and billing references where applicable. One-use login links expire in 15 minutes and sessions in 30 days. Resend sends requested sign-in emails and, for projects with alerts on, alert emails to your sign-in address. Alert emails contain the project name, result counts and links to your private report and to turn alerts off, not your monitored URLs. Cloudflare hosts the service, stores its state, resolves verification DNS and processes connection details such as IP addresses. Short-lived application rate limits use hashed IP addresses. If you purchase an Agency plan or a one-time Migration Pass, Stripe processes payment in hosted checkout; we do not receive full card details. A Migration Pass purchase stores the project name you enter, the purchase date and the resulting entitlement (an extended row limit and a 30-day monitoring window for that project); it does not create any additional account beyond your existing sign-in.

Partner referrals

If you enter a partner code at Migration Pass or Agency checkout, we send PromoteKit your account email and Stripe customer reference to associate eligible purchases and refunds with the referring partner. We retain that first association for referral administration; a later code cannot replace it. For an eligible subscription, this can include renewal payments during the program’s qualifying period. Partner codes do not reduce your price, and we do not use affiliate cookies or browser tracking scripts. Leaving the field blank does not create a new referral; a previous association can remain with your account. Contact hello@wwatermelon.com about your referral data.

Analytics

When product analytics are allowed, we also use Google Analytics, based in the United States, to measure visits and named product actions. It uses first-party browser and session cookies, processes connection information such as IP addresses to provide the service, and receives fixed page routes, approved campaign labels and the referring site hostname. We do not send form contents, uploaded files, email addresses or private workspace addresses. Advertising signals and personalization are disabled. The same regional consent, browser privacy signals and turn-off control apply to both analytics services; turning analytics off stops Google collection and removes its cookies. Google analytics event data is retained for up to 14 months. Anonymous totals are not sent to Google.

Outside the European Economic Area, the UK and Switzerland, product analytics (PostHog, hosted in the United States) are on by default to help us improve RedirectAtlas. Turn them off below at any time. Global Privacy Control and Do Not Track are honored automatically — even if you previously allowed analytics in this browser — with no need to visit this page.

In the EEA, UK, Switzerland, and whenever we cannot tell your region, we ask first: no PostHog capture happens before you allow it. Without your permission we keep only anonymous daily totals — page visits, with no identifier, IP address, user agent or referring page — in Cloudflare D1 storage located in the EU, kept for up to 90 days and never sent to PostHog. “Turn off analytics” below stops both PostHog and these anonymous totals immediately, including in other open tabs of this site, and removes your stored identifier and saved attribution so turning analytics back on starts fresh with a new identifier.

When analytics are on, PostHog receives limited usage events, an opaque identifier, controlled page names, counts, sanitized acquisition labels, an SDK session ID, coarse browser, operating-system and device categories, an approximate country from the service edge (or an explicit unknown), and a referring website hostname when available. Event IP is masked and not used for precise geolocation. Redirect URLs, CSV contents, email addresses and authentication links are excluded. Session recording is off and not currently offered as an opt-in. There is no fingerprinting and no advertising use; the purpose is product improvement only, never a sale of personal data.

For signed-in accounts, we save your effective analytics choice and use the same opaque identifier for permitted browser and billing events; we never identify you by email. With consent, billing events can include payment amounts, plan, currency and cancellation status, never card details or receipts. Withdrawing consent stops queued billing events. If saving your account preference fails, this page asks you to retry. Essential cookies support sign-in; local storage remembers your analytics preference.

Your choices

Signing in does not subscribe you to marketing. We do not sell personal data. Request account access, correction or deletion by emailing us; verification and applicable recordkeeping requirements may apply. Providers can process data in the United States and other locations where they operate, and backups can retain deleted data for a limited period. We update this policy when handling changes.