Privacy

Who is responsible

hostnag is operated by [Operator], [Registered address]. Contact: [Contact email].

What we collect and why

We collect only what running your monitors and your account requires:

• Your account email, name and an optional picture, for sign in and invites.
• Organization and group names.
• Monitor names, targets and settings, including any custom HTTP headers, which are stored in plaintext, not in the vault.
• Channel secrets, webhook URLs, tokens and keys, stored encrypted in a vault, never in plaintext.
• Check results and alert history.
• The first forwarded address of a Beacon call or a browser calling a report URL.
• Your billing name and invoices, held through Stripe; card numbers never touch hostnag.
• Any support email you send us.

Processors

The services that run hostnag on our behalf, each receiving only what its job needs:

• Supabase: database, sign in and functions, hosted in us-east-1.
• Vercel: the web app, and the check locations, US East, US West, Frankfurt and Tokyo.
• Stripe: billing.
• Resend: email.
• Twilio: SMS.

Cookies

hostnag sets one cookie: the sign in session cookie that keeps you signed in. There are no analytics or advertising cookies.

Public pages

A status page shows only what its owner chose to publish, never the underlying targets or error strings. A badge shows a single status word.

Retention

Check results are kept for 30, 90 or 365 days depending on your plan. Monthly reports are kept for 3 or 12 months; Free keeps none. A deleted organization or account is removed from the live database; backups roll off on our processors' own schedules.

Your rights

You can ask for access to, correction of, export of, or deletion of your data by writing to [Contact email]. Two factor sign in and a list of your active sessions are both available from your account settings.

Changes

We may update this policy. When we do, we post the change here with a new date at the top of this page.