The short rule
Share only the public URL family for the thing you want someone else to open. Do not share management URLs, edit URLs, owner-scoped internal URLs, or secret-code URLs. Public URLs are for Facebook posts, Google indexing, email, QR labels, screenshots, and printed materials.
A public URL exists only when the item itself is public. A private note, private team page, private trackable, or internal management screen should never be copied as the public address.
Public URL families
| Surface | What people should share | Who can access it | Where the browser can land |
|---|---|---|---|
| Profile page | /Profile/{userName} |
Anyone when the profile page is public. Shared team viewers when the profile is limited to team members. Only the owner when the profile is private. | /Profile/{userName} |
| Team page | /team/{teamSlug} |
Anyone when the team page is public. Signed-in current team members when the team page is private. | /{lang}/team/{teamSlug} |
| Note page | /Note/{noteId} |
Anyone when the note is public. Authorized viewers only when the note is private. | /{lang}/Note/{noteId} |
| Trackable page | /trackable/{publicCode} |
Anyone when the trackable itself is public. Secret and scan-only codes are possession credentials and should not be shared as public links. | /{lang}/trackables/{publicCode} |
| Trackable group page | /trackable-group/{publicCode} |
Anyone when the trackable group page is public. Signed-in current team members when a team-owned group page is private. Only the owner when a personal group page is private. | /{lang}/trackable-group/{publicCode} |
Profile pages are already language-neutral, so their share URL and rendered page stay on
/Profile/{userName}. Team, note, and trackable share URLs stay bare when copied and can then
localize into a visitor-specific page shell after the person opens them. Trackable-group share URLs also stay
bare and then land on a localized public group page.
Category URLs
Categories do not have their own separate public URL family. Personal categories live on the profile page at
/Profile/{userName}, and team categories live on the team page at /team/{teamSlug}.
That keeps category sharing easy to explain: share the page that owns the hierarchy.
Category management happens on workspace pages instead: /{lang}/notes for a personal workspace and
/{lang}/team/{teamSlug}/workspace/Categories for a team workspace. Those workspace URLs are signed-in
management routes, not public-share URLs.
Why trackables use two public URLs
Trackables are the only public page family that separates the share URL from the rendered public page URL. The short share URL
stays as /trackable/{code} because that one route can safely accept three different kinds of codes: the public code,
the short secret code, and the long private scan token.
If the code is public, the browser is redirected into the viewer's language-specific public page at
/{lang}/trackables/{publicCode}. If the code is secret or scan-only, the browser goes into the possession flow
instead. That is why the short share URL is what people should copy, print, and email, while the localized rendered page is
what search engines and visitors may end up viewing after redirect.
Why trackable groups use one public URL family
Trackable groups do not need a secret-code resolver, so the share URL and the localized rendered page stay in the same family:
/trackable-group/{publicCode} localizes into /{lang}/trackable-group/{publicCode}.
That means the group CTA can always teach one clean share format while the browser still lands on the viewer's language shell.
What should never be shared
- Internal workspace URLs such as
/en-US/accountor/en-US/team/{teamSlug}/workspaceare management routes, not public-share URLs. - Secret-code URLs and QR-only URLs are possession credentials, not public links.
- Management routes such as edit pages, team settings, activation pages, and internal dashboards are never public-share URLs.
Why this matters
People remember URL patterns. If the site teaches one simple family and then quietly routes people through internal one-off paths, they will copy the wrong thing into social posts, emails, labels, and support conversations. A clean public URL system reduces that confusion and makes the product easier to explain.
Clear public URL families also make it easier to decide what is safe to share and what should stay private. When the public address is obvious, people are less likely to copy a management page, a private page, or a credential-based access URL by mistake.