Privacy Policy

Account data. When you sign up we store your email address and a securely hashed password in our self-hosted authentication system (Supabase Auth, running on our own servers — not the hosted Supabase platform). If you belong to an organisation, we store your membership and role.

Monitor configuration. The endpoints, hostnames, ports, request settings, intervals and status page content you create in order to be monitored.

Check results. The outcome of each check we run on your monitors — timestamps, response times, status codes, and error details — which power your dashboards and status pages.

Alert channel configuration. The destinations you choose to be notified on, including email addresses, phone numbers (for SMS alerts), and webhook URLs or tokens for Telegram, Slack and Discord.

Billing data. If you subscribe to a paid plan, payment is handled by Stripe. We store your Stripe customer and subscription identifiers and plan tier; we never see or store full card numbers.

We use first-party cookies only: to keep you signed in and secure the application, to remember display preferences such as language and currency, and — if you arrive through a referral link — to record the referring code so the referral can be credited when you sign up. That referral cookie stores only the referral code, expires after 90 days, and is deleted once your account is created. Our website analytics sets no cookies at all and records no personal data, so there is nothing to consent to. We use no advertising or cross-site tracking cookies, and we set no cookies that track you across other sites.

All of these are first-party and none are used for advertising or to follow you across other sites, so we do not show a cookie banner. You can clear or block them at any time in your browser settings — blocking the sign-in cookie will prevent you from logging in, and blocking the others only means we forget the preference.

We run our own infrastructure wherever we reasonably can: the database, authentication and mail server are self-hosted on servers we control, so your account and monitoring data are not handed to a third-party platform. The processors below are the exceptions, and data reaches them only for the functions described:

• Stripe — subscription billing and payment processing, only if you buy a paid plan. Card details are entered directly with Stripe and never reach our servers.
• LabsMobile — SMS alert delivery, only when you configure an SMS alert channel. They receive the destination phone number and the alert text.
• Telegram, Slack, Discord, Microsoft Teams, PagerDuty and any custom webhook endpoint you configure — alert delivery, only for the channels you set up yourself. They receive the alert content, which includes the monitor name and the URL or host being checked.
• Vercel — hosting for this website, and, if you point a custom domain at a status page, the domain name is registered with them so the certificate can be issued.
• Sentry — error monitoring. Diagnostic data may incidentally include an email address or hostname when it appears in an error, so we keep sampling off and send no analytics or session recordings.
• Vercel Web Analytics — aggregate visitor statistics for our public pages. It sets no cookies and does not track you across sites: visits are counted using a hash that is discarded daily rather than a stored identifier. We receive only aggregate counts such as page, referrer, country and device type.

The database, authentication and application servers are located in Switzerland. Monitoring probes run in Zurich (Switzerland), New York (United States) and Singapore, and you choose which of them check your monitors — a probe receives only the target URL or host and returns the result, and processes no personal data beyond that. Where a processor above operates outside Switzerland or the EEA, transfers are covered by the appropriate safeguards, such as EU Standard Contractual Clauses.

Check result logs are retained according to your plan tier: 30 days on the free tier, 90 days, 365 days, or 730 days on higher tiers. Older check logs are automatically deleted. Account, monitor and billing data are retained for as long as your account is active and for a short period afterwards as required for legal and accounting obligations.

Under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the GDPR, you have the right to access, rectify, export and erase your personal data, and to restrict or object to certain processing. You can delete your account at any time from Settings; account deletion removes your monitors, check logs and alert configuration. To request a copy of your data, or to exercise any other right, contact us at the address below. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU, your local data protection authority.

For any privacy question or to exercise your rights, contact us at privacy@hypermonitors.com.