Privacy policy

1. Data we collect

Account data

• Your email address and username, so you can sign in and we can reach you about your account.
• Your password, stored only as a salted Argon2id hash. We never store or transmit the password itself.
• If you enable two-factor authentication, a TOTP secret and one-time recovery codes, so you can complete sign-in.
• Account state such as whether your email is verified and the time of your last sign-in.

Authentication and security data

• For each active session, the IP address and user agent of the device, so you can review and revoke sessions and so we can detect abuse.
• An audit log of actions taken in your organisations — who did what, when, and from which IP address.
• API keys are stored only as hashes together with a non-secret prefix and their scopes.

Service data

• The monitors you configure (target URLs, hosts, ports, schedules, tags) and the check results they produce (status, response times, error summaries).
• Your organisation details, team members and roles, and any pending invitations (including the invited email address).
• Content you publish, such as status page settings and incident or maintenance updates.
• Notification channels you add (for example a webhook URL or a chat-service token) so alerts can be delivered.

We do not ask for special-category data and we do not run advertising or cross-site tracking. See the Cookie policy for the one cookie we set.

2. Why we use it, and our legal bases

• To provide the service (account, monitoring, alerts, status pages) — performance of our contract with you.
• To keep the service secure and available (fraud and abuse prevention, rate limiting, access control, audit logging) — our legitimate interests and, where relevant, your own security.
• To communicate with you about your account, security events and material service changes — contract and legitimate interests. Marketing email, if ever sent, is opt-in and can be withdrawn at any time.
• To comply with the law where we are required to retain or disclose information.

3. How long we keep it

• Account data is kept while your account is open. After you delete your account we remove it, except for records we must keep for legal or security reasons.
• Check results are retained for a bounded window per plan and then pruned automatically; historical data is aggregated as it ages.
• Sessions expire automatically and are deleted on sign-out, on password change, or once they lapse.
• Audit and security logs are kept for a limited period for security and accountability.

4. Who we share it with

We do not sell personal data. We share it only with service providers who process it on our instructions, and only as needed to run the product:

• Hosting and infrastructure — the servers that run the API, database, workers and web frontend. [Provider(s)]
• Email delivery — to send account, security and alert emails. [Provider(s)]

Third-party notification channels you configure (for example Slack, Discord or a webhook you control) receive the alert content you have chosen to send them; that transfer is initiated by you. We may also disclose data where the law requires it or to protect the rights and safety of our users.

5. International transfers

Where data is processed outside your region, we rely on appropriate safeguards such as standard contractual clauses. [Add your transfer mechanism and regions.]

6. Security

We protect data with measures that include encryption in transit, hashed credentials, scoped access controls, rate limiting and audit logging. An optional second factor is available on every account. No system is perfectly secure, but we work to keep these protections current and to notify you of material incidents as required.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can do much of this from the dashboard, and you can reach us at [email protected] for the rest. You also have the right to complain to your local data protection authority.

8. Children

Monitrx is a business tool and is not intended for children. We do not knowingly collect data from anyone under 16.

9. Changes and contact

We will update the date at the top of this page when this policy changes materially. Questions and requests can be sent to [email protected]. See also our Terms of service and Cookie policy.