Privacy policy

What we collect

• Your account. Your email address, and a password if you sign up with one (stored hashed — we never see it). If you sign in with Google or GitHub, we receive your name, email, and avatar from them instead.
• Your monitored apps. The URLs you add, their check settings, and everything our checks observe about them: response times, status codes, TLS certificate details, security headers, and incident history.
• Alerts we send you. A log of the notification emails we sent and whether they were delivered.
• Payments. If you subscribe to a paid plan, Stripe processes the payment. We never see or store card numbers — only your plan and subscription status.

What we don't do

• No advertising, no ad trackers, no analytics cookies. The only cookies we set are the ones that keep you signed in.
• We never sell or share your data with anyone, except the infrastructure providers below who run the service for us.
• Our checks only look at what your site shows any visitor. We don't log in to your apps or read their private data.

Where your data lives

The service runs on a small set of infrastructure providers, each processing data only on our instructions:

• Supabase — database and authentication (US)
• Vercel — web application hosting
• Fly.io — check workers in the US, Europe, and Asia
• Resend — alert email delivery
• Stripe — payment processing, for paid plans
• Cloudflare — DNS and domain services

How long we keep it

As long as you have an account. Delete your account and we delete your data — monitored apps, check history, incidents, and alert logs — from the live database. Backups age out on a rolling basis shortly after.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, at any time. Email [email protected] and we'll handle it — no forms, no runaround.

Changes

If this policy changes in a way that matters, we'll email account holders before the change takes effect and update the date at the top of this page.