1. Who we are
Ferry is a deep linking and link attribution service operated by Chaotic Byte, and provided through ferrylink.io. In this policy, "Ferry", "we", and "us" mean Chaotic Byte.
You can reach us about privacy at hello@ferrylink.io.
Ferry is a business-to-business service. Our direct customers are companies and developers who use Ferry to build and measure links for their own apps.
2. What this policy covers
This policy applies to:
- the marketing site at
ferrylink.io; - the Ferry dashboard at
app.ferrylink.io; - the Ferry API at
api.ferrylink.io, including the MCP server; -
the redirect service that serves Ferry links on
feryl.ioand on custom hostnames our customers connect; and - the Ferry SDKs our customers embed in their apps.
It does not cover our customers' own apps, websites, or privacy practices. If you opened a Ferry link and want to know why, see section 5.
3. Our role: controller and processor
Ferry handles two different kinds of personal information, in two different roles.
We are the controller for our own business records
For account, authentication, workspace, billing, support, security, and product-improvement data about the people who sign up for and use Ferry, we decide why and how the data is used. We are the controller, and this policy is our notice to you.
We are a processor for our customers' app-user data
When a customer runs links through Ferry, their app users' data is processed on their instructions. The customer decides what to put in a link payload, which events to report, and what identifiers to send. They are the controller for that data; we are their processor (a "service provider" under California law). We do not use it for our own purposes, we do not sell it, and we do not combine it across customers to build profiles.
If you are an app user with a question about that data, contact the company whose app or link you used. We will support them in responding.
4. Information we collect
Account and authentication
When you create an account we store your name, email address, and whether your address is verified. If you sign up with email and password we store a hash of your password, never the password itself. If you sign in with Google we store the Google account identifier and the tokens Google issues, so we can keep you signed in.
Each session record stores a session token, its expiry, and the IP address and user agent of the device that signed in. We use these to keep you signed in and to investigate suspicious account activity.
Workspaces and team members
We store your workspace name, who belongs to it, and each member's role (owner, admin, or member). When you invite someone we store the email address you invited, the role, an invitation token, and its expiry, and we send them an invitation email.
Billing
Payments run through Stripe. Stripe hosts the checkout and billing portal pages, so your card details never reach Ferry's servers. We store the Stripe customer and subscription identifiers, your plan, billing interval, subscription status, current period end, and whether the subscription is set to cancel. Invoices, payment methods, billing addresses, and tax data are held by Stripe under their own privacy policy.
What you configure in Ferry
We store the projects, domains, and links you create: app bundle identifiers and package names, app store and fallback URLs, hostnames and their validation records, link slugs, campaign fields, expiry dates, social preview metadata, and the data payload you attach to each link. Link payloads are yours and we store them as you supply them, so please do not put personal information in a payload unless you have a lawful reason to.
Marketing website analytics
We use Umami on ferrylink.io to understand page visits, referral sources, campaign
parameters, browser and device categories, country, scroll depth, which major page sections are
reached, and a small number of named actions such as opening documentation, copying an integration
example, contacting us, or clicking through to start a trial.
Umami does not set cookies or use browser storage. It uses the request IP address and user agent to create an anonymous session hash and infer coarse location, but does not store the IP address. We do not identify visitors, track them across websites, or send account IDs, customer attribution identifiers, form values, link payloads, or transaction details to Umami. The tracker respects your browser's Do Not Track setting.
We run Umami ourselves on our own infrastructure at webanalytics.chaoticbyte.com,
so marketing traffic is not shared with a third-party analytics vendor.
Product analytics in the dashboard
When product analytics are enabled we use PostHog to record which dashboard pages you visit and a small number of named actions, such as creating a project or signing up. Analytics are associated with your user ID so we can understand how the dashboard is used. We do not use broad autocapture, so we are not recording every click and keystroke, and we reset the analytics identity when you sign out. PostHog processes this data in the United States.
PostHog measures how the dashboard is used, nothing else. It runs only on
app.ferrylink.io, and it never receives app-user data: no installation or
customer identifiers, no attribution or transaction records, and nothing from link opens.
The data described in section 5 is never sent to it.
Support
If you email us we keep the message and our reply so we can answer you and refer back to the conversation.
5. Data about people who open links
This section explains what happens when someone opens a Ferry link. We process this data for our customers, as their processor.
Every link open
We record that a valid link was opened, along with:
- the time of the open and which link, project, and workspace it belongs to;
- the device platform (iOS, Android, or desktop);
- where the open was sent (app store, play store, web fallback, or straight into an installed app);
- the approximate country, region, and city, derived by our network provider from the IP address;
- the referring website's hostname only, never the full referring URL;
- the campaign and UTM source and medium attached to the link; and
- a traffic-quality classification used for billing, described in our Terms of Service.
We do not store raw IP addresses in link analytics. Where we need a stable way to recognise repeated traffic, we store a salted one-way digest instead, so the record cannot be turned back into an IP address.
Deferred deep link matching, and the one place we hold a raw IP
Deferred deep linking means that if someone opens a link, installs the app, and then opens the app, we can connect that first app open back to the link. To do that we briefly keep a record containing the IP address of the device, plus device signals collected by the interstitial page: screen width and height, device pixel ratio, browser language, time zone, and a device model class and OS version derived from the user agent.
This is the only place Ferry stores a raw IP address of an app user. It is kept for the matching window, which is 24 hours by default, and an automated job then deletes it. It is used only to match an install back to a link, never for advertising or profiling.
On iOS, the interstitial page copies a link token to the clipboard when the visitor taps through to the App Store, so the app can read it after installation. Nothing is written to browser storage and the interstitial sets no cookies.
Identifiers our customers send us
Customers can send an installation identifier and their own customer identifier through the SDK or API. We never store these raw. Before anything is written to a permanent table we convert them into a keyed one-way digest (HMAC-SHA256) that is scoped to a single project, so the same identifier cannot be linked across projects or across customers.
These digests are pseudonymous, not anonymous. Our customer can still connect them back to a person using their own records, so we continue to treat them as personal data and protect them accordingly.
Product events
Customers can report logins, signups, and purchases so they can measure which links drive results. Purchase events carry a transaction identifier, a product identifier, an amount, and a currency. Customers should send opaque identifiers only, and our API is designed on that basis.
Summary for app developers
If you integrate Ferry, you need this to complete Apple's App Privacy details and Google Play's Data Safety form. The table below is what Ferry receives from your app and why.
| Collected | Purpose | How it is stored |
|---|---|---|
| Platform and OS version | Route the link correctly and gate fingerprint matching by platform | Stored with the link open |
| Device model class | Deferred match scoring | Deleted with the matching record |
| Screen size and pixel ratio | Deferred match scoring | Deleted with the matching record |
| Language and time zone | Deferred match scoring | Deleted with the matching record |
| IP address | Deferred match scoring and approximate location lookup | Held only for the 24-hour match window, then deleted. Never stored on analytics records; only the derived country, region, and city are kept. |
| App bundle ID or package name | Identify which project and app the open belongs to | Project configuration |
| Link open and match events | Attribution and your reporting | Stored for the life of your workspace |
| Installation identifier (only if you send one) | Connect a first app open back to the originating link | Stored only as a project-scoped HMAC digest, never raw |
| Your customer identifier (only if you send one) | Connect signups and purchases to the link that drove them | Stored only as a project-scoped HMAC digest, never raw |
| Purchase amount, currency, transaction and product ID (only if you send them) | Revenue attribution | Stored for the life of your workspace |
Ferry does not collect advertising identifiers (IDFA or GAID), does not ask for the App Tracking Transparency permission, does not read contacts, photos, precise location, or the clipboard from inside your app, and does not operate an advertising network. The last four rows are sent only if you choose to send them, and you are responsible for having a lawful basis and any consent your users are entitled to before you do.
6. Where the information comes from
- From you, when you create an account, configure Ferry, or contact us.
- From your devices and browsers, when you use the dashboard or when someone opens a Ferry link.
- From our customers and their apps, when their SDK or server reports an install match or a product event.
- From our service providers, such as Stripe (subscription status), Google (your basic profile if you sign in with Google), and Cloudflare (approximate country, region, city, and bot signals derived from the request).
7. Why we use it, and our legal bases
Where the GDPR or UK GDPR applies to us as controller, we rely on the legal bases below.
| Purpose | Information used | Legal basis |
|---|---|---|
| Provide the service, resolve links, and run your workspace | Account, workspace, project, domain, and link data | Performance of our contract with you |
| Authenticate you and keep you signed in | Credentials, session records including IP and user agent | Performance of our contract with you |
| Take payment and manage subscriptions | Billing and subscription records | Performance of our contract; legal obligation for tax records |
| Send service and workspace invitation emails | Name, email address, invitation records | Performance of our contract; legitimate interest in team collaboration |
| Keep the service secure, prevent abuse, and classify traffic quality | Session records, salted source digests, bot and rate signals | Legitimate interest in protecting the service and billing accurately |
| Understand and improve how the dashboard is used | Dashboard product analytics | Legitimate interest in improving our product |
| Understand marketing performance and improve the website | Anonymous website analytics and named interaction events | Legitimate interest in improving our website and customer acquisition |
| Comply with law and handle legal claims | Whatever is relevant to the obligation or claim | Legal obligation; legitimate interest in defending claims |
For app-user data we process as a processor, our customer determines the purpose and legal basis. Our processing is governed by our agreement with them.
Where we rely on legitimate interests, we have considered the effect on you. You can object to that processing; see section 13.
10. International transfers
Ferry is operated as a global service. Cloudflare serves links from data centres worldwide, our API and database run on a private server
hosted with the provider named in section 9, and Stripe, Google, and
PostHog operate internationally. This means your information, and app-user data we process for
our customers, may be transferred to and stored in countries other than your own. Our
marketing analytics are self-hosted and are not transferred to an analytics vendor.
Where we transfer personal data out of the European Economic Area or the United Kingdom, we
rely on the European Commission's Standard Contractual Clauses and the UK International Data
Transfer Addendum, as incorporated into our agreements with the providers listed above, or on
an applicable adequacy decision.
11. How long we keep it
We keep information for as long as we need it for the purpose we collected it, and we are
specific about that below rather than promising a period we cannot honour.
Data Retention Raw IP and device signals held for deferred matching 24 hours, then deleted automatically by a scheduled job that
runs hourly.
Account, workspace, project, domain, and link records For as long as your account is open, and until you ask us to delete them. Sign-in sessions Until the session expires or you sign out. Link opens, matches, installs, product events, and analytics
For the life of the workspace, so historical reporting stays accurate. We do not
currently apply an automatic expiry to this data, and we will delete it on request.
Anonymous marketing website analytics
Until it is deleted from the Umami analytics service. We review this data as part of
deciding whether it remains useful for improving the website.
Billing and subscription records
For as long as required by the tax and accounting law that applies to us, even after
you close your account.
Support email For as long as needed to handle the matter and any follow-up. Backups
Deleted data can persist in encrypted backups until those backups age out of their
normal rotation.
Deletion is handled by our team, not a self-service button. Email
hello@ferrylink.io from your account address and we will
delete your account and workspace data. We act on these requests without undue delay and will
confirm when it is done.
12. Security
We take security seriously and design for it. In particular:
-
traffic is served over HTTPS, and our API is reachable only through an encrypted tunnel;
- passwords are stored hashed, never in plain text;
-
secret API keys are separated from public keys, so the key shipped inside an app cannot
reach your control-plane data;
-
installation and customer identifiers are converted to keyed one-way digests before they
reach any permanent table, and the service refuses to start in production without the key
that makes those digests strong;
- every query is scoped to a single workspace, so customer data stays separated; and
- payment card data never touches our systems.
No service can promise perfect security, and we do not. If we become aware of a breach
affecting your personal information, we will notify you and any regulator as the law requires.
13. Your rights
Depending on where you live, you may have the right to access the personal information we hold
about you, to correct it, to delete it, to restrict or object to how we use it, to receive it
in a portable format, and to withdraw consent where we relied on it. You also have the right
to complain to your data protection authority.
To exercise any of these, email hello@ferrylink.io from
the address on your account. We may need to verify your identity before we act, and we will not
charge you or treat you differently for making a request.
If your request concerns data we hold on behalf of one of our customers, for example because
you used an app that runs on Ferry, please contact that company directly. They control that
data. If you contact us instead, we will forward your request to them where we can identify
them.
14. California privacy disclosures
This section applies to California residents under the California Consumer Privacy Act as
amended by the CPRA.
In the last 12 months we have collected the categories of personal information described in
section 4 and section 5:
identifiers, commercial information, internet and network activity, approximate location
derived from IP address at country, region, and city level, and professional information. We
collect them from the sources in section 6, for the purposes in
section 7, and we disclose them to the service providers in
section 9 for business purposes only. Our retention criteria are in
section 11.
Ferry does not sell personal information, and does not share it for cross-context
behavioural advertising.
We run no advertising business, no ad network integrations, and no ad pixels. We have not sold
or shared personal information in the last 12 months, including the personal information of minors
under 16.
We do not use or disclose sensitive personal information for purposes beyond those permitted
without a right to limit. California residents may request to know, delete, or correct their
personal information, and may not be discriminated against for exercising those rights. Use
the contact details in section 13. You may use an authorised agent,
and we will ask for proof of their authority.
When we act as a service provider to our customers, we process personal information only to
perform the services under our contract with them, and we are prohibited from retaining,
using, or disclosing it for any other purpose.
15. Children's privacy
Ferry is a business tool. It is not directed at children, and you must be at least 18 to create a Ferry account. We do not knowingly collect personal information from children in
order to provide our own service. If you believe a child has given us personal information, email
hello@ferrylink.io and we will delete it.
Our customers are responsible for the audience of their own apps and links, and for any
consent required before sending us data about their users.
16. Changes to this policy
We will update this policy when our practices change. The version number and last-updated date
at the top of this page always reflect the current text. If we make a material change we will
tell account holders by email or in the dashboard before it takes effect.
17. Contact us
Privacy questions and requests: hello@ferrylink.io
Everything else: hello@ferrylink.io
Chaotic Byte
ferrylink.io
See also our Terms of Service.