Privacy Policy

This policy explains what StatusSpy collects, why, and who we share it with. It covers two kinds of people: you, the account holder configuring Sites and Monitors, and visitors to a status page, changelog, or the public /check tool that a StatusSpy customer has published.

Account data: your email, username, and (once you're on a paid plan) billing information handled by Stripe - we don't store your card details ourselves.

Site data you configure: the URLs you add as Monitors, your Site's root domain and pages (for Site Health checks), Component names and statuses, incident text, changelog entries, custom CSS, logo/favicon URLs, and any API keys you generate (stored only as a one-way hash - see the API docs for how those work).

Data generated by monitoring: uptime check results, response times, SSL certificate status, and PageSpeed Insights reports for the URLs you've configured us to check.

Visitor-submitted data: if you run a status page, its visitors can voluntarily submit an email to subscribe to updates, or submit a "report a problem" message (optionally with their email, for a reply). We also keep a per-browser token (not tied to identity) to rate-limit repeated submissions on public forms, and the same pattern on the public /check tool's crowdsourced reports.

Usage data: if you (or a status page's owner) has enabled Plausible or Google Analytics, and a visitor has consented via the cookie banner, we collect standard analytics data (pages viewed, referrers, aggregate traffic). See "Cookies" below.

• To run the Service - checking your Monitors, rendering your status page, sending alerts, generating summaries.
• To send account emails (verification, password reset), alert notifications, and subscriber/incident update emails you've triggered.
• To bill you, via Stripe, for a paid plan.
• To improve and secure the Service, including enforcing plan limits and abuse protections (e.g. rate-limiting AI generation, live checks, and public form submissions).
• To respond to support requests submitted through the contact form.

We don't sell your data, or a status page visitor's data, to third parties.

Some features send content to Anthropic's Claude API to generate text: public status page summaries (built from your Site's current Component statuses and open incidents), incident-update drafts (built from monitor status, the incident's own history, and anything you've already started typing), and Site Health PageSpeed run summaries (built from PageSpeed scores and audit results). This processing happens per request, isn't used to train Anthropic's models under their API terms, and generation is capped by daily account-wide limits tied to your plan.

We use the following providers to run the Service - each only receives the data relevant to its job:

• Stripe - payment processing and subscription billing.
• Anthropic (Claude API) - AI-generated summaries and drafts, as described above.
• Google (PageSpeed Insights API) - Site Health performance checks against the pages you configure.
• Email delivery provider - transactional email (verification, alerts, subscriber/incident notifications).
• Plausible / Google Analytics (optional) - aggregate traffic analytics, only active where enabled and, for cookie-based tracking, only after visitor consent.

We use one essential cookie to keep you signed in - this one isn't optional, since the Service can't function without it, and it isn't used for tracking or advertising.

Everything else (analytics cookies, if Google Analytics is enabled) only loads after you accept it in the cookie consent banner. Public status pages and changelogs don't show this banner or set tracking cookies at all - they're built to carry zero app chrome for the site owner's own visitors.

We keep your account and Site data for as long as your account exists. Uptime check history is retained per your plan's history window (30 days to 1 year); older raw check data may be aggregated or trimmed. Deleting a Site removes its Monitors, Components, incidents, and related history. Deleting your account removes your Sites and personal data, except where we're required to retain billing records for legal or tax reasons.

You can access, correct, export, or delete most of your data directly from the app - editing Site settings, removing team members, revoking API keys, or deleting a Site or your account. For anything you can't do yourself (e.g. a visitor asking us to remove a subscriber email or problem report they submitted on someone else's status page), contact us and we'll help.

Passwords are hashed, API keys are stored only as a SHA-256 hash (never the raw key), and access to a Site's data is scoped by team role (Viewer/Editor/Admin). No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

The Service is intended for business and professional use and isn't directed at children. We don't knowingly collect data from anyone under 16.

We may update this policy as the Service changes. We'll update the "Last updated" date above when we do.