Data and providers
Watching your deliveries means other companies are involved in it. Here is every one of them, what each is for, and what actually reaches it.
Each of these handles something of yours in the course of doing its job.
| Who | What they do for us | What reaches them |
|---|---|---|
| Supabase | The database, the sign-in, and the vault the connection credentials sit in. | Everything the product holds. Your account and the address you sign in with, your monitors and their schedules, your connections and the credential each one uses, the record of what arrived and what we told you about it. Supabase also sends the sign-in link and any invitation, so an address reaches it the moment somebody asks for a link - from their own browser, before there is an account. |
| Postmark | Sends the alerts that go to an address, and receives mail sent to a watched one. | Going out: who the alert is addressed to, and all of it - the monitor, what was expected, when it was due, and the file name and size where there is one. Coming in: the whole message, body and attachments included, because Postmark is the mail server the watched address points at. It handles the message before any part of it reaches us. |
| Stripe | Subscriptions, if you take one. | From us: an identifier for your account, and which plan you picked. Card and billing details are entered on Stripe’s own pages - nothing in our code asks for them, and nothing in it receives them. Stripe tells us back which plan is running and whether it is paid. |
| Vercel | Runs this site and the app, and counts page views. | Every request to the site and the app, including the one that carries a credential to be tested on its way through. The page counting is separate and narrower: the address of each page viewed and the pattern behind it, with no account attached. That includes signed-in pages, and a signed-in address has a monitor or connection identifier in it. Our code sends nothing else with it; the counting script is Vercel’s own, so what else it does is theirs to state and not something this page can show you from our code. |
| Railway | Runs the worker - the part that makes the checks and sends the alerts. | Everything a check touches. The worker holds the database connection and decrypts a connection’s credential in memory each time it goes to look, which makes it the one place a credential exists in the clear. |
| Anthropic | Reads the sentence you type at setup, when you ask it to. | That sentence, up to 600 characters of it, and nothing else - not your credentials, not your account, not your connections, not a file listing, not anything from a message we received for you. It goes when you press the button and never as you type. What comes back fills in the form for you to confirm; it is not saved, and neither is the sentence. The whole feature is off wherever no key is configured, and setup falls back to the plain form. |
| Slack | Posts alerts into a channel, if you connect one. | The alert, and the channel you chose to put it in. Connecting sends you to Slack to authorise it, and leaves us holding a token that can post to that channel and read the channel list. Nothing reaches Slack unless a channel is connected. |
Part of running the service. Nothing of yours goes to it.
| Who | What they do for us | What reaches them |
|---|---|---|
| A heartbeat service | Watches the watchdog: something has to notice if our sweep stops. | Nothing about you. An empty request, once a sweep, to an address we configure. It carries the fact that the loop ran and no word about whose monitors it ran for. |
When you point a monitor at your bucket, your SFTP server, your database or a URL of yours, we connect outward to something you run, with a credential you issued and can take back. Those vendors are your suppliers, not ours. We did not choose them and we send them nothing about you - we ask the one question the monitor is for and read the answer.
The same goes for a webhook of yours that we post an alert to. Slack is the one that sits on the other side of that line, and it is in the table above for a reason: the app is ours and we hold a token that can post to the channel you picked.
What we can see of each source, one row per source, is the Trust page.
No product analytics, no session recording, no advertising or marketing tags, on the site or inside the app. The page counting named above is the whole of it, and it is why we cannot tell you we collect nothing.
No error-reporting service either. When something goes wrong on this site or inside the app, nothing about it is sent to a third party.
The fonts are fetched when the site is built and served from our own domain, so reading this page does not call anybody else.
What happens to the credential you hand us, and what we can see with it, per source.