Privacy

Plain language, because there is nothing complicated to hide. Last updated 30 July 2026. Questions or requests: oc-60a678@agentmail.to.

What Watchpup stores

• Your account: email address, a salted password hash (PBKDF2-SHA-256 — never the password itself), and your API key.
• Your monitors: the URLs, hostnames, ports and domains you ask Watchpup to check, plus any check settings you configure. If you add custom request headers or bodies (for example an Authorization token so Watchpup can probe an authenticated endpoint), those are stored as monitor configuration in order to run the check, are visible only to your account, and are never included on status pages, badges, feeds or metrics endpoints.
• Check results: raw per-check results (timestamp, up/down, response time, status code) are kept for about 3 days, then reduced to daily per-monitor summaries kept for about 90 days. Down/up events for incident history are kept 90 days. Older rows are deleted automatically every hour.
• Alert channels: the email addresses, webhook/Discord/Slack/Teams/Google Chat URLs, ntfy topics, or Telegram bot tokens/chat ids you configure. An alert email address that isn't your account email only receives anything after its owner clicks a confirmation link.
• Status-page subscribers: email addresses of people who subscribed to one of your public status pages — double opt-in, with a one-click unsubscribe link in every email.
• Domain watches: if you use the account-free domain-expiry watch, the domain and the email address you entered — double opt-in, one-click unsubscribe in every email; unsubscribing deletes the record immediately, and unconfirmed requests are deleted automatically after 3 days.
• Back-up watches: if you use the account-free "email me when it’s back up" watch, the URL and the email address you entered — double opt-in, and the record deletes itself as soon as the single recovery email is sent (or after 7 days if the URL never recovers). Unconfirmed requests are deleted automatically after 1 day; the confirmation email’s stop link deletes the record immediately.

What Watchpup doesn't do

• No analytics trackers, no ad scripts, no third-party JavaScript. Pages are served with zero external assets. The only traffic measurement is two aggregate server-side tallies on public pages (the landing page, docs, guides, changelog, the instant check, signup and public status pages): a per-page visit count, a count per referring site's hostname, and a count of instant checks run (by kind and by coarse client family, e.g. curl vs. browser — the URL you check is not recorded) — no IPs, no cookies, no per-visitor records of any kind.
• Two cookies, both functional: wp_sess, the login session (HttpOnly, Secure, 30 days), and — only if you unlock a password-protected status page — a signed wp_sp_<page> unlock cookie for that page (HttpOnly, Secure, 30 days; it proves you entered the password, nothing else). Logged-out visitors and viewers of public status pages get no cookies at all.
• Nothing is sold, rented, or shared. Your data is used to run your checks and send the alerts you asked for — that's it.
• IP addresses are used only transiently for abuse rate-limiting (signup/login attempts and similar) and those counters are deleted within hours. Check results and status-page visits are not tied to visitor IPs.

Email

Watchpup sends transactional email only: down/up alerts, test alerts, confirmations, password resets, status-page subscriber notices, domain-expiry watch reminders, back-up watch notices, and an optional weekly digest. Every recurring category has its own opt-out (digest checkbox in Settings, unsubscribe link in subscriber emails, delete the channel to stop alerts). There is no marketing list.

Where it runs

Watchpup runs on a managed serverless edge platform; your data lives in its managed database. Check probes are made from that platform's network to the targets you configure.

Deleting your data

Delete individual monitors any time (their results, events and history go with them, immediately). Delete your entire account from Settings or via DELETE /api/account — this removes every row associated with the account (monitors, results, events, channels, status pages, subscribers, sessions) in one action, immediately, with no retention period. You can export your check history as CSV first.

Changes

If this policy changes materially, the change will be dated here and noted on the changelog.