Uplink is a software studio run by one person (Noah Abrams). This policy covers every Uplink app, netmap and Uplink Cockpit today and more as they ship, plus the shared account, licensing, and support behind them. It says exactly what data Uplink touches, why, and how to turn things off. There is no long legalese version hiding behind it, this is the policy. Sections that name a specific app describe that app; new apps add their own sections here as they arrive.
01 Account and licensing
What is stored: your email address, an optional name and handle, a password if you set one (stored only as a hash), your license keys, device IDs (an identifier for each computer you activate) and activation records (which machine activated, when). Why: it is how licensing works, issuing keys, counting seats, and letting you deactivate an old laptop yourself from the account portal. One account holds your licenses across every Uplink app. It lives on the Uplink license server and is not shared beyond the services that run the apps (the vendors in section 10). Uplink emails your address about your licenses, your shared and published shows, and your purchases, and sends occasional product updates and check-ins, each with an unsubscribe link.
02 What the apps report (telemetry)
When an app checks in with the license server (periodically, when online), it includes the app version and platform so we know which builds are in the field. If an app crashes, it sends a crash report: the stack trace, app version, platform and install ID (the device ID in section 01). A stack trace can include details from the show you had open at the time (a device name or address, for example); that context is what makes a crash fixable. Telemetry is on by default and the switch to turn it off is in each app under Settings, Privacy. License check-ins are part of how paid licenses function and stay on while a license is active.
Feedback. A report you send with an app's Feedback button carries what you type, the context the dialog lists (app version, platform, license tier and recent crash ids, for example), your license and install ID, and a screenshot only if you attach one. netmap attaches your current show file only if you tick the box for it. Reports are kept on the Uplink license server, and the operator is emailed the text and context with your account email.
03 netmap: your device library and the community library
Device definitions you create in netmap's library (make, model, rack units, ports, power, optional faceplate image) sync to us, the raw material the community equipment library grows from. Synced items are visible to the operator only; no other user sees them through library sync. The copy of your equipment library in a cloud backup is separate; section 05 says who can read it. Nothing is published unless you click Submit to netmap library, every submission is reviewed by a person first, handle credit is optional, and you can turn syncing off entirely in Settings.
04 netmap: published shows
Publishing only happens when you hit Publish. It puts a read-only copy of the paperwork you selected at a public link, optionally gated behind a PIN you set. Links expire after 14 days by default and you can extend them from the app. We count views and last-opened time and show those numbers back to you. You can take a published show down at any time.
Zone links publish one extra page per zone of a show, each holding only that zone's part of the paperwork; they follow the show's own link, PIN rules and expiry. Anything else the crew enters on a published page, such as pull-sheet check-offs, problem flags and guest sign-ups, is stored with that published show, shown back to you, and deleted with it. Rig notes work a little differently, as the next two paragraphs say. If you link a Google document to a published show, its crew page frames that document, which loads from Google under Google's own terms and privacy notice.
Rig notes (netmap). If you switch rig notes on for a published show, the crew can post notes from its pages, including To-Dos and questions for the design team, reply to them and confirm To-Dos. Nobody needs an account or a password for that; if a zone page has a PIN for its paperwork, that PIN is all they enter. The first time, a crew member types a name and can pick a role, and the phone remembers both. What they enter is stored with the show: that name and role, their notes and replies, each Got it and Done they mark on a To-Do, and any photos they add to a note, a reply or a Done. Each post also records the IP address it came from and a random id for the phone, used to stop abuse and to know which phone asked a question; both are blanked after 7 days. Photos are shrunk on the phone before they are sent, and the camera location and other metadata are stripped from them. A show holds up to 1 GB of photos.
Who sees rig notes. A show keeps one list of rig notes for its show page and all its zone links. A zone page shows the notes sent to that zone and the notes for the whole show. The show page, its control room wall and the Rig notes window in your netmap app see every note, and the punch list you export from the app can include them all. Anyone who can open a page, with its PIN if it has one, can read the notes on it, with their replies, confirms, names and photos. Rig notes written on a show page before 16 October 2026, when a show page and its zone pages began sharing one list, stay on that show page and never appear on a zone page. Notes written on a zone page before then now also show on the show page, its wall and in the app. The design team and network admins post to any zone with a design PIN you set in the app; it is sent to our server once and stored there only as a hash, never in the show file. Rig notes keep a show open while the crew is using them: a show with rig-note activity in the last 24 hours extends its own link 7 days at a time, up to 60 days after it was first published, and you get an email 3 days and again 1 day before it stops. Section 11 says how long rig notes are kept.
Working together (netmap). When you share a show from your account page, the person you share it with gets an email with the link, and their account appears on the show's access list until you remove it. While a shared show is open, netmap shows everyone in it who else is there (name, colour and which machine), and keeps a change history — who changed what, and when — with the show's cloud backup. Browser editing sessions are recorded as start and end times, their length and which show was open, so seats and usage can be counted.
05 netmap: cloud backups
Off by default. If you switch on cloud backup (Settings, Autosave & backup), each show you save is copied to your account, along with your equipment library and defaults, faceplate photos included. The last 20 versions of each show are kept, and the last 5 of the equipment library (it is much larger), 500 MB per account. Each kept version records when it was saved, which computer saved it (its network name, or the name you give it in Settings), the operator name if one is set, and which account saved it. Backups are readable by you and the operator. People you share a show with can open and change that show, and their saves land in your backups. While the share is live they can also read your equipment library, and a browser session they open on that show saves its library changes into it. Backups are never published and never read for any purpose beyond storing them and giving them back. Deleting a backup from the app or your account page removes it and its retained versions; switching cloud backup off stops uploads and leaves what is already there until you delete it.
Editing in the browser (netmap, beta). Opening a cloud-backed show at your account page runs netmap itself on our servers: the show is copied out of the account that owns it into a private, single-tenant workspace for that session, edited there, and saved back to that account about once a minute. The workspace is deleted when the session ends — Done, a take-over from elsewhere, or 30 idle minutes. What the session saved or sent stays, as it would from the desktop app: its backups and change history, any show published or library item submitted from it, and any feedback or crash report it sent. Each is kept as this policy describes for that kind of data, and the session itself is recorded as listed in section 11. A browser session is readable by the people working in it and the operator, on the same terms as cloud backup above. The session sets one cookie, npbs, which identifies that session to its own workspace and expires with it.
06 The websites
uplink.show and netmap.show load no trackers. Each runs a beta signup form, uplink.show for Uplink Cockpit and netmap.show for netmap (name, email, and whatever you type in the optional fields, used to contact you about that beta and to send occasional Uplink product updates, each with an unsubscribe link). Signups are kept on Uplink's own signup list and with our email provider. netmap.show loads Cloudflare's cookieless Web Analytics script. When you open a checkout on uplink.show, the page loads Paddle's checkout from Paddle, which runs under Paddle's own terms and privacy notice. A published crew page frames any Google document its owner linked to it (section 04), and that document loads from Google. Beyond that the sites load no third-party scripts.
07 Text messages (SMS)
Some Uplink apps send operational SMS alerts to phone numbers you enter yourself, and can accept SMS commands from numbers on an allow-list you control. What is sent: equipment and show-status alerts, for example a network switch going unreachable, a DMX universe conflict, or a confirmation that an operator-initiated command ran. What is never sent: your show files, paperwork, network configuration, or credentials. Who receives them: only numbers on a recipient list you control. The app will not message a number that is not on that list, and there is no marketing or promotional messaging of any kind.
The Uplink SMS relay (Uplink Cockpit). Unless you set up carrier credentials of your own, an activated Uplink Cockpit sends its alerts through the Uplink SMS relay, on Uplink's own carrier account. The relay texts a one-time code to each number you add, and sends alerts to that number only after the code has been entered back into Uplink Cockpit. Numbers you add for the relay, verified or not, and the label you give each one, are kept with your license on the Uplink license server until you remove them. For each message the relay sends or refuses, verification codes included, Uplink keeps, for up to 90 days: the time, which module sent it, the number of segments, whether the carrier accepted it or why the relay refused it, the carrier's message id, the message text, and the recipient's number in masked form. Twilio, which carries relayed messages, keeps its own records of them under its own retention. With carrier credentials of your own, your messages never reach Uplink's servers.
How a number opts in. A number receives messages only after a person enters it into the app's recipient settings, and it stops receiving them the moment it is deleted there or the recipient replies STOP. Message frequency varies with what the rig is doing. Message and data rates may apply. Reply STOP to opt out at any time; reply HELP for help. The full messaging-program disclosure, including the complete opt-in workflow, is at uplink.show/sms.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes, and are never sold or rented. Mobile phone numbers collected for SMS are passed only to our messaging carrier, Twilio, for the sole purpose of delivering the messages that were asked for.
08 Payments
Purchases made at checkout run through Paddle.com, our merchant of record. Paddle is the seller for the transaction and handles cards, tax, invoices and refunds. Uplink receives your email, what you bought, and the subscription's status and renewal dates. Uplink never sees your card number. An order invoiced directly is billed by Uplink itself, which keeps the billing details for it.
09 Your data, your exports
Your files are local on your machine, export them, back them up, or walk away with them at any time. In the released netmap app, PDF and spreadsheet exports are made on Uplink's render server: the app sends it the show (without its private show notes), your title blocks and your license token, and the server sends the finished file back without keeping a copy. Want your account data deleted? Email legal@uplink.show and it is gone (your licenses go with it).
10 Who actually touches the data
Uplink runs on a small, boring stack, and these vendors process data only to run the service: Railway (application hosting, US), Cloudflare (DNS, edge network, site hosting, cookieless web analytics, and the file storage that holds cloud backups, show files and app downloads — which travel through netmap.show on their way), Resend (transactional email), Twilio (text messages sent through the Uplink SMS relay), and our mailbox provider (where email you send to Uplink arrives, along with the operator's own notifications, such as copies of feedback reports). Purchases made at checkout also go to Paddle.com, which as merchant of record handles them under its own privacy notice. That is the whole list. Uplink does not sell or rent data to anyone, ever.
11 How long things are kept
- Account and license records: while your account exists, plus a short wind-down after deletion requests.
- Payment notifications from Paddle (checkout purchases): the newest 5,000 are kept; older ones are deleted as new ones arrive.
- Crash reports: a rolling window; old reports are automatically overwritten by new ones.
- SMS relay log (Uplink Cockpit, if you use the relay): up to 90 days.
- Numbers added for the SMS relay: until you remove them from your license's recipient list.
- Cloud backups (if you turn them on): the last 20 versions of each show and the last 5 of your equipment library, replaced as new saves arrive, until you delete them.
- Browser session workspaces (netmap, beta): deleted when the session ends — you press Done, you take the session over from elsewhere, or 30 idle minutes pass. Your work lives on in the backups of the account that owns the show, not in the workspace.
- Change history of a shared show: kept with that show's cloud backup, and deleted with it.
- Browser session records (times, length, which show): while your account exists.
- "Open right now" markers: which of your machines has a show open, so your other machines can say so. Each entry disappears about three minutes after that machine stops checking in.
- Published shows: until you delete them. An expired link stops opening but can still be extended or re-published.
- Rig notes on a published show (netmap: crew names and roles, notes, replies, confirms and photos): deleted with the show, or 30 days after its link expires, whichever comes first. The IP address and the phone's random id saved with each post are blanked after 7 days. Taking down one zone link keeps that zone's notes on the show unless you tick Also delete this zone's rig notes. A photo that is picked but never posted is deleted after about a day.
- Library sync reports: kept while they are useful for growing the catalog; never published.
- Feedback reports: a rolling window; the oldest reports, with any screenshot or show file attached, are deleted automatically as new ones arrive. The copy emailed to the operator is kept in the operator's mailbox.
- Beta signups: until you ask off the list or the beta ends.
- Backup copies of the license server: up to 30 days; something deleted above can remain in a nightly copy for that long.
12 Security
Everything moves over TLS. Admin surfaces sit behind two-factor access controls plus passwords. License checks are signed cryptographically. One person (the operator) has access to production data. If a breach ever affects your data, you will hear about it directly and promptly.
13 Cookies and local storage
The sites run no third-party trackers and set no analytics cookies. netmap.show loads Cloudflare's cookieless Web Analytics, no cookies, no fingerprinting, no cross-site tracking. A browser editing session (netmap, beta) sets one npbs cookie, which identifies that session to its own workspace and expires with it. The account portal keeps your sign-in token in your browser's local storage; PIN-protected publish links set one cookie, kept for 30 days, so you do not retype the PIN per page; it is also how a control room wall remembers the show PIN. Unlocking rig notes with a show's design PIN sets one more cookie, which keeps the design team unlocked on that show for 12 hours. The account portal, crew pages and browser editing sessions also keep settings and page state in your browser's storage. A browser editing session also keeps your presets there, with any edits that did not reach the server. A crew page keeps the name and contact details you enter on it, the role you pick for rig notes, the name you use on the design team if you unlock it, a random id for the phone, and the small tokens that let you change or undo what you added. That is the complete list for the sites themselves; a Paddle checkout and a linked Google document follow their providers' own privacy notices.
14 Where data lives and who Uplink is for
Uplink's servers are hosted in the United States; using Uplink means your account data is processed there. Uplink apps are professional tools for working crew and designers; they are not directed at children, and you should not use them if you are under 16.
15 If the law comes knocking
Data gets disclosed only if legally required, and if that ever happens you will be told unless the law forbids it.
16 Changes and contact
This policy will evolve with the beta. Changes get posted here with a fresh date at the top; material changes get flagged. Questions, complaints, deletion requests: legal@uplink.show.