Privacy design

This is an engineering/privacy document describing how the product is built. It is not a claim of legal compliance.

Data collected

• For manual certificate checks: the hostname you submit, processed in memory for the request and immediately discarded. Not logged, not stored.
• For monitors: the hostname, your alert threshold (days), and — for paid plans — the webhook URL you provide. Ownership is proven by a random capability token; only its SHA-256 hash is stored.
• Alert records and webhook delivery statuses (HTTP status codes and error classes only), retained for 30 and 7 days respectively.
• Minute-level aggregate counters (total checks, failures, alerts) used for service health.

Data never collected

• Names, email addresses, phone numbers, postal addresses
• Passwords or accounts (none exist)
• Card or banking data (processed exclusively by Stripe; never touches our servers)
• Cookies, analytics identifiers, device fingerprints, browsing history
• IP addresses in persistent storage or logs
• The content of certificates is public information; nothing else is fetched from your domain

Processing purpose and legal basis

Processing is limited to providing the certificate check and monitoring service you request. Because we deliberately avoid personal data, no user profiles, marketing or behavioral analysis are possible.

Retention and deletion

• Manual checks: 0 seconds (in-memory only).
• Monitors: kept until you delete them; deletion is immediate and cascades to alerts and delivery records.
• Alerts: 30 days. Webhook delivery records: 7 days. Aggregate counters: 90 days.
• Backups: the database is backed up daily with a 30-day rotation; deleted rows age out of backups within that window.

Processors

• Stripe (payments) — only if you purchase a paid plan; Stripe acts as merchant of record for checkout. We receive only subscription status and period end.
• Hosting: a single server operated by the factory. No third-party analytics, CDNs or trackers are used.

Cookies and local storage

No cookies are set. The management page may use your browser's local storage to remember a manage token on your device only if you explicitly choose to.

Security practices

• TLS-only endpoints with HSTS; strict security headers and a content security policy.
• Server-side scans can only reach public IP addresses over port 443 (SSRF protections).
• Webhook deliveries are HMAC-SHA256 signed; only HTTPS endpoints on public addresses are accepted.
• Rate limiting at the edge and in the application; secrets are stored hashed or as capability tokens.

Your choices

You can delete a monitor at any time from the manage page; this is the only stored record that belongs to you. There is no account, so there is nothing else to export or erase.