Campaign URL Privacy

Treat a campaign link as public text

A campaign URL can be copied, forwarded, screenshotted, logged by its destination, or saved in browser history. Use labels that you would be comfortable publishing next to the campaign itself. Email addresses, private phone numbers, access tokens, and confidential customer details do not belong in UTM values.

A harmless-looking campaign name can also disclose a private launch or client relationship. Replace those names with approved public labels before distribution. A privacy pattern detector cannot understand business confidentiality.

Identify a placement rather than a person

If you need to compare two email links, use header_button and article_link. Both values describe the creative and can be shared by many recipients. Do not use a recipient’s email as utm_content.

Encoding is not anonymization. A value containing %40 may decode to an email address. The validator inspects decoded query values for a limited set of obvious patterns, but it can miss names, unusual formats, and identifiers whose meaning only you know.

Avoid: utm_content=reader%40example.com
Use:   utm_content=article_link
Avoid: utm_campaign=private_client_acquisition
Use:   utm_campaign=approved_public_launch_label

Know which boundary local processing protects

UTMCraft computes results in your browser instead of sending form inputs to a processing API. That does not make every action private: opening a generated URL sends a request to its destination, sharing a link exposes it to the recipient, and exported files can be forwarded.

Local history, presets, taxonomy, and preferences can remain on the device. On a shared computer, clear workspace data when appropriate and do not export confidential campaigns. Browser extensions and device access are outside the tool’s control.

Use synthetic examples when asking for help

Replace the domain, product identifiers, and personal values with example.com and invented labels. Keep the parameter structure and encoding that reproduce the issue. This gives support enough information to diagnose a parsing problem without receiving a real customer link.

If sensitive data has already been published, removing it from a new link does not erase old emails or logs. Follow your organization’s incident process and review the systems that received it. A URL cleaner cannot perform that cleanup for you.