What is kept
- Account: your e-mail address, a hash of your password (never the password itself) and your second factor, sealed. A password chosen at sign-up counts as yours once you confirm the address in the browser you signed up in, reset the password, or sign in with it after confirming. If none of that happened before you first sign in with an email link, the password is removed and every other session is signed out, because someone else may have signed up with your address. You get an email about it, and you can choose a new password afterwards.
- Sessions: the device summary and the last activity of each sign-in. Ended sessions are removed after 90 days.
- Your organisation: members and roles, sites, checks, results, incidents and alert addresses. An alert address you add for a client is personal data of someone who may not be your customer.
- Support: the messages you send in the app or through the contact form, with the address you give for the reply. Your choice about the optional monthly-report e-mail is kept too.
- Billing: invoices. Card details never reach the app.
- Security and abuse control: a log of sensitive actions, and counters kept under one-way hashes.
What your browser stores
The app sets one cookie, __Host-sid, that keeps you signed in. Only while you sign in with Google, GitHub or an email link, or confirm a new account, it also sets a short-lived cookie that ties that step to your browser (__Host-oas, __Host-ml, __Host-su, __Host-pnd or __Host-psu, from 5 minutes to 24 hours, gone when the step is done). The website sets no cookie and loads nothing from other sites. The free site check keeps nothing about the address you enter. The cookie notice lists the small items the app also keeps in your browser’s local storage.
How long, and what is undecided
Deleted accounts are removed after 14 days, ended sessions after 90 days, used e-mail links after 30 days and exports after 24 hours or one download. Not decided yet: how long the security log is kept, how long a closed support request is kept, how long an organisation’s data is kept after its subscription ends, and how long billing records must be kept. Hosting, the payment provider and the e-mail provider are not chosen yet; the final notice will name each one.
You can export or delete your data yourself. The privacy notice has the full text.