Privacy policy

Last updated October 28, 2026.

Umzug moves a small business's website off Squarespace, Wix or Webflow. To do that it reads your old site, keeps what you tell it, and makes and hosts your new one. This page says exactly what Umzug keeps, which other companies see some of it and why, and how to delete it. Umzug is a free, invite-only pilot.

What Umzug keeps

Your account. Your email address, when your account was made, when you last signed in, and whether you turned off the "it's ready" emails. Sign-in links and sign-in sessions are kept only as scrambled fingerprints, never the link or session itself. A link works for 15 minutes; a session lasts 30 days from the last time you used Umzug, or until you sign out.

Each site you move.

What Umzug reads from your old site: its pages and words, its photos and files, pictures of its pages, its colours and fonts, and its tools (a booking widget, say).
Your domain's settings as they were before anything changed (its DNS records, which include where your email is delivered), and which company your domain is registered with.
What you give Umzug: your answers in the conversation, your notes and the changes you ask for, your business details (hours, phone, address and email), and your photos. Where a phone photo records the place it was taken, Umzug removes that before keeping it (for JPEG photos, which is what phones send).
How you proved the site is yours: the address a code was sent to (the code itself is kept only as a fingerprint), or the DNS record you added.
What Umzug makes: the proposal, the designs, your real site, the checks it runs, and each round of changes, so any can be undone.
Running it: records of every piece of work done on it and what that AI work cost, when it was published and where, your domain's checks, and the results of the 30-day watch after your domain moves.
Every email Umzug sends you about your site, with its full text, so none is lost and none is sent twice.
The fonts and colours your new site's design uses, in a list across all sites, so the next business's design doesn't copy yours. Only the font names are ever passed on, never your business's name or colours.

To stop abuse. For about an hour after you ask for a sign-in link or a proof code, Umzug keeps the times you asked, filed under a fingerprint of your email address and of your network (IP) address, so nobody can ask for thousands.

How long. Everything above is kept until you delete the site or your account (see below). Umzug doesn't keep anything about you for any other reason. A deleted site can stay in Umzug's daily backups for up to 7 days, and then it's gone from them too.

In your browser. One cookie keeps you signed in (named kobold_session, or __Host-kobold_session on the real app), for 30 days. Your light or dark choice is remembered in your browser (kobold-theme). Umzug's own staff have one more cookie that remembers whether they're looking at test sites. That's all: no advertising cookies and no analytics cookies.

No tracking. Umzug doesn't use analytics, tracking pixels or advertising tools, and doesn't sell or share anything about you for advertising.

Who else sees some of it, and why

Umzug uses a few other companies to do its work. Each sees only what it needs.

Anthropic makes the Claude AI that reads your old site, designs your new one, writes it, and makes the changes you ask for. It sees your site's words, photos and pictures of its pages, your answers, notes and requests, and your business details. Anthropic's commercial terms say it doesn't train its AI on what Umzug sends it. [Matthew: check this against the terms Umzug accepts.]
Vercel hosts your new site once you publish it, under Umzug's account. It holds your site's words and photos, your domain name once you connect it, and your email address, so your site's contact form can send messages to you. Messages visitors send through your contact form pass through Vercel, and a copy appears for a short time in Vercel's logs. Like any web host, Vercel sees your visitors' network addresses.
Resend sends Umzug's emails: sign-in links, proof codes, "it's ready" emails and emails when something needs you. It sees your email address and what the email says. It also delivers the messages visitors send through your site's contact form to you, so it sees those messages and the visitor's email address.
Render is where Umzug itself runs and keeps its files, including everything listed above.
Google Fonts. If your site uses Google's free fonts, your browser loads them from Google when Umzug shows you your look and your proposal, and your new site's visitors load them from Google too. Umzug's server also asks Google whether a font is one of theirs (it sends only the font's name), and loads your site's fonts from Google when it makes your “we’ve moved” picture.
Cloudflare, Google Public DNS and Quad9 answer Umzug's questions about your domain's settings (the same public answers anyone on the internet can ask for), and so does your domain's own DNS provider. Umzug asks them when it checks your domain, your proof DNS record, and your domain after it moves.
rdap.org tells Umzug which company your domain is registered with (the public registration record).
Your old site and its platform. Umzug reads your old site the way a visitor's browser would, which also loads whatever your old site loads. It downloads your photos from your old platform's servers, so your new site doesn't depend on them.

Your new site's own tools. If your old site used tools of its own, such as Google Analytics, a Meta pixel, a booking widget, a Google map or a YouTube video, your new site keeps them, because they're yours. Umzug doesn't see what they collect.

Nobody else sees anything, and nothing is sold.

Deleting your data

A site. On your account page, or under "Yours to keep" on your real site, choose "Delete this site and its data". Before you do, you can download your whole site or move it to your own Vercel account. Deleting it:

takes your site offline if Umzug hosts it (Umzug deletes its copy on Vercel, with Vercel's logs of it). A site you've moved to your own Vercel account stays up there, untouched. If your domain still points at Umzug, it stops showing your site, and Umzug asks you to confirm that first.
deletes everything Umzug kept for it, straight away: the copy of your old site, your answers, notes and photos, the designs and your real site, the checks, the work records and the emails about it.
leaves your email, your domain's settings and your old site exactly as they are.

Your account. On your account page, choose "Delete my account". It deletes every one of your sites the same way, then your account, your sign-in sessions and links, your invite and your settings, and the emails Umzug sent you.

What's left afterwards. A short note that a site or an account was deleted, when, and by whom (you, or which of Umzug's staff), with what the AI work had cost. Nothing of what the site held. What Anthropic, Vercel and Resend keep afterwards is up to their own policies, and is limited to what they saw while doing Umzug's work.

Questions

Write to privacy@umzugit.com. [Matthew: confirm this address exists before customers see this page.]

If this policy changes in a way that matters, Umzug will email you before it does.