Privacy Policy

Last updated: 2026-08-11

This Privacy Policy explains how the uptimepage service ("we", "us") collects and processes personal data. It is intended to satisfy our obligations under the EU General Data Protection Regulation (GDPR) and similar laws.

1. Data Controller

Artem Senenko, Nicosia, Cyprus, is the data controller for personal data processed via the Service. The controller is a natural person; no company is currently registered.

Contact: hello@uptimepage.dev

For data-subject requests: hello@uptimepage.dev (see §10)

We do not have a designated Data Protection Officer as we do not meet the thresholds under GDPR Article 37.

2. What Data We Collect

We collect data in three ways:

You provide:

• Email address (via GitHub or Google OAuth, or magic-link sign-in)
• Display name (via GitHub or Google OAuth)
• Organisation names, slugs, branding (display name, about text, logo)
• Target configurations (URLs, intervals, headers, optional credentials)
• Status-page customisation (incident narration, maintenance windows)

We generate automatically:

• Session identifiers (random)
• API tokens (you create; we store hashed)
• Check results (technical metrics: status codes, latencies, error codes)
• Login attempts (success/failure, method, hashed IP, hashed user agent)
• Audit events (organisation membership changes, target changes)
• MCP write actions (which tool ran, what it acted on, and whether it succeeded or was refused)

We collect via your browser:

• Session cookie (_sm_session) — necessary for authentication
• IP address (hashed before storage; never stored raw)

Analytics (public marketing and sign-in pages only): We run self-hosted, cookieless analytics (Umami) on our own EU infrastructure. It records aggregate page views, referrer, browser, operating system, device type, and coarse location (country and region). Visits are grouped by a hash of your IP address and user agent mixed with a secret value that rotates every month, so within one month repeat visits from the same network and browser count as one returning visitor. It sets no cookies, never stores your raw IP, cannot tell us who you are, and cannot follow you to other websites. The data stays on our infrastructure and is never sent to a third party.

On the sign-in page this also records which sign-in method you chose (GitHub, Google, or email link) and whether signing in succeeded, so we can tell how many people who set out to sign in actually got in. Once you are signed in, no page of the product is tracked: there is no analytics on your dashboard, monitors, incidents, or settings.

We do not use third-party analytics services that export your data (no Google Analytics, no Mixpanel, no tracking pixels).

3. Why We Process This Data

Browser flow monitors: when a flow monitor you configured fails, we keep what the page showed at that moment — the URL the browser ended on, the page title, its visible text, and anything the page logged to the browser console. Because the flow signs in, that text can come from a page behind your own login. It is stored to explain the failure and for nothing else, it is never put into an alert or notification, and any value the flow typed from a secret variable is removed before it is stored. It is deleted on a shorter clock than the run itself.

Heartbeat monitors: if your job POSTs a body to its ping URL, we keep the first few kilobytes of it as that run's output, so a failure can be read without going back to the machine that ran it. Whatever the job prints is what we store, so do not print secrets to it. It is never put into an alert or notification, and it is deleted on a shorter clock than the ping itself.

MCP connector: when you connect an AI assistant to our MCP server, it reads your monitoring because you asked it to, and every action that would change something is recorded, whether it succeeded, was refused, or you declined it. The record names the tool, identifies what it acted on, and states the outcome, so it can include a monitor's name and address, the tags and group a retune moved it to, and the names of the channels it alerts. A refused action is recorded too, which means a monitor name your assistant proposed can be kept even though you declined it. What you write for customers is not kept here: an incident's public title and description, the updates you post, and any note on acknowledging or resolving are not part of this record. Read-only calls are not recorded at all. We never receive or store your conversation with the assistant, only the tool calls it makes. The client you connect is one you chose and someone else operates, so the answers it asks for reach whoever runs it; that is your instruction to it, not a transfer we make (see §6).

We do not engage in automated decision-making with significant effects on you (no profiling, no scoring).

4. How Long We Keep It

Deleted accounts are recoverable for 30 days, after which data is permanently purged.

5. Who We Share It With

We use these third-party processors:

We do not sell or rent your data. We do not share it for marketing.

We may disclose data:

• To comply with legal obligations (court orders, valid law-enforcement requests)
• To protect rights, property, or safety
• With your explicit consent

6. International Transfers

Data is primarily stored in Finland (Hetzner data centre, Helsinki). Resend, GitHub, and Google are based in the United States; transfers to them are protected by Standard Contractual Clauses adopted by the European Commission.

An AI assistant you connect over MCP (see §3) reads your monitoring wherever that assistant runs, which may be outside the EU. You choose that client and its operator, and it retrieves only what it asks for on your instruction, so we do not treat it as a processor acting for us. If that matters to you, the connector is optional and revoking it in Settings stops it.

Monitoring checks can run from probe regions outside the EU. Those probes receive the check configuration they need to run (URL, headers, resolved credentials) and produce technical results (status codes, latencies, error text) that are sent back to our EU infrastructure; long-term storage stays in Finland.

7. Security

Technical measures include:

• TLS 1.2+ for all connections
• Encrypted credentials at rest (AES-256-GCM for target authentication secrets)
• Hashed passwords and tokens (Argon2id)
• Session cookies marked HttpOnly, Secure, SameSite=Lax
• IP addresses hashed before storage
• Application errors logged without request bodies
• Daily automated security patches via Docker image rebuilds

We will notify affected users without undue delay if we become aware of a personal-data breach affecting your data, and we will notify the competent supervisory authority within 72 hours where required.

8. Your Rights

Under GDPR, you have the right to:

• Access your personal data (Article 15) — see §10
• Rectify inaccurate data (Article 16) — update via /settings
• Erase your data (Article 17) — see §10 ("right to be forgotten")
• Restrict processing (Article 18) — contact us
• Data portability (Article 20) — see §10
• Object to processing based on legitimate interest (Article 21) — contact us
• Withdraw consent (Article 7(3)) — applies only if we relied on consent for processing
• Lodge a complaint with your local supervisory authority. Our supervisory authority is the Office of the Commissioner for Personal Data Protection, Cyprus (https://www.dataprotection.gov.cy/)

9. Cookies

We use one cookie: _sm_session, which holds your session identifier. This is strictly necessary for the Service to function and does not require consent.

We do not use analytics, advertising, or third-party tracking cookies.

See our Cookie Policy for details.

10. Data Subject Requests

Two channels — use whichever is convenient:

Self-service (recommended):

• Export: Visit /settings/account → "Export My Data". You receive a JSON file with the data associated with your account. Activity logs (sign-ins, audit events, MCP write actions) cover the last 90 days; ask us by email if you need the full retained history.
• Deletion: Visit /settings/account → "Delete My Account". The account is immediately suspended and permanently purged after 30 days.

Email: Send a request to hello@uptimepage.dev. We will:

• Acknowledge receipt within 7 days
• Verify your identity (typically: email match with account email)
• Fulfil your request within 30 days

You can use the email channel if you are locked out of your account, if you are acting on behalf of someone else (e.g., deceased user), or if you have requirements beyond what the self-service tools provide.

11. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16. If you become aware that a child has provided us with personal data without parental consent, please contact us so we can delete it.

12. Changes

We may update this Policy. Material changes will be announced via email 30 days in advance.

13. Contact

hello@uptimepage.dev