This explains what we collect, what we do with it, and what you can ask us to do about it. It covers both the website and the monitoring service. The company responsible for your data — the controller, in GDPR terms — is UptimeTwin LLC, 351 San Felipe Road, Ste 101 #1018, Hollister, CA 95023, USA.
Your email address, and your password stored as a bcrypt hash. We never keep the password itself. If you sign in with Google or GitHub instead, we get your email address and name from them, plus an identifier for your account there — never your password for that service. Microsoft sign-in is built but switched off, so nothing goes to Microsoft today. If you turn on two-factor login, we store the shared secret your authenticator app needs. We never store the six-digit codes.
The URLs, hostnames, ports and check intervals you configure, plus your alert preferences — thresholds, quiet hours and which channels to use.
The outcome of every check: up, down or degraded, how long it took, when it ran, and whatever the check itself returned, such as SSL certificate details or DNS records. This is what your dashboard, reports and status pages are built from.
If you add someone else as an alert recipient, or they subscribe to one of your status pages, we hold the email address or phone number you or they gave us, so we can send what you set up. When you use UptimeTwin for a business, that information is yours rather than ours: you decide what happens to it and we act only on your instructions. Section 9 of our Terms of Use sets out that arrangement in full. If you are one of those people and you want your details removed, ask whoever runs the monitoring, or contact us and we will put you in touch.
Paid plans and extras are handled entirely by Stripe. Your card number and CVV never reach us. All we get back is a customer ID, the status of your subscriptions, and for a one-time purchase what it was, what it cost and when, which is what we need to know what your account includes. If you open a checkout for a plan and leave it unpaid, Stripe also tells us when it expired and which plan it was for. If a payment is refused, Stripe also tells us that it failed and why (for example, that your bank declined it), with your card's brand, type and issuing country and your billing country, so we can help you finish it; we do not keep the billing name or street address that come with that notice. If you choose to save your card at checkout, Stripe keeps it, not us, and offers it back to you the next time you buy something.
If you make a branded report, we keep the company name, colour and logo you give us, and a copy of the report's figures so its private link keeps working for 12 months. Anyone you give that link to can open the report; it is not listed anywhere and search engines are asked not to index it. If you put your status page on your own domain, we keep that domain name so we can serve your page on it.
If you answer "Was the diagnosis right?", from the email or inside your account, we keep your yes or no with the incident it is about. We use it to judge and improve the AI write-ups.
If you contact support or send feedback, we keep your name or email, the category you picked and your message. We use it to reply to you and nothing else.
Add a mobile number as an alert channel and we store the number, the time you ticked the consent box, and the exact wording you agreed to. We text you a six-digit code first and only start sending alerts once you enter it, so nobody can sign up a phone they do not hold.
Your mobile number, and the fact that you opted in, will not be shared or sold to third parties for marketing purposes. Your number goes to our SMS delivery provider, ClickSend, so it can deliver the alerts you asked for. That is the only place it goes.
How often you hear from us is entirely down to your own monitors: you get a text when one goes down or comes back, or when it reports another change you monitor for, such as a slow response or a certificate or domain about to expire — so the volume varies. Message and data rates may apply. Reply STOP to any message to end them, or HELP for help. Stopping texts leaves the rest of your account alone — your monitors keep running and your other alert channels keep working. The full SMS terms are in section 16 of our Terms of Use.
Where alert phone calls are available, you can add a phone number for them. We store the number, the time you ticked the consent box, and the exact wording you agreed to. We call once to read out a six-digit code and only call with alerts after you enter it. If you press 9 during a call, we stop calling that number and keep the time you did so with the record of your consent.
Your phone number will not be shared or sold to third parties for marketing purposes. Our calling provider, Twilio, receives the number and the words of each call so it can place the calls you asked for. That is the only place it goes. Alert calls come only when one of your monitors goes down. Press 9 during any call, or remove the number in your settings, to stop the calls; nothing else about your account changes. The full terms are in section 17 of our Terms of Use.
If you use our mobile app, we store a push token for each device you sign in on, along with the device's platform and name, so alerts can reach it. Each device appears as its own alert channel under Settings → Notifications, where you can remove it at any time.
The free tools at /tools need no account, and most of them keep nothing at all. Three can email you. Two are subscriptions, the SSL-expiry reminder and the weekly site report: if you ask for either, we store the email address you gave, the domain you asked about, and when we last wrote to you. That is all of it, and there is no account behind it. Nothing is ever sent to an address until it has confirmed by clicking through from the first message, and every message carries an unsubscribe link. Because there is no account to sign in to, section 7 does not apply to these: use the unsubscribe link, or contact us and we will remove the address. The third is a single message: the full report offered after the instant check on the home page. We use the address you give once, to send that one report, and keep only a one-way hash of it in memory until the end of the day so an address cannot ask for more than one report per site per day. The address itself is not stored, nothing follows the message, and there is no list to come off.
Basic request logs: IP address, browser or app user agent, and a timestamp. We use them for security and debugging. They sit in the logging systems our hosting and edge providers run, and age out on those providers' own schedules — usually within about a month. We do not copy them anywhere else or build any profile from them.
When you open one of our public pages — the home page, pricing, the documentation, the free tools and similar — we record the visit ourselves. That record holds the pages you opened, when and for roughly how long; the website that linked you to us and any campaign tag on that link; your IP address, for 30 days only (see below); the approximate place Cloudflare works out from your IP address (country, region and city); whether you were on a phone, tablet or computer and in which browser; and whether you ran a site check or created an account during the visit.
We set no cookie for this. The only thing kept in your browser is a note of the last page it reported, for the life of the tab, so that one page is not counted twice. To tell one visitor from another we turn your IP address and browser details into a short code, using a key that is replaced every day with the old one deleted. The code cannot be turned back into an address once its key is gone, and you get a different code the next day, so the code itself cannot be used to follow you from one day to the next. Separately, we keep your IP address with the record of the visit for 30 days, for security and to recognise automated or abusive traffic, and then delete it from the record. While it is kept, visits from the same address can be recognised as coming from the same address, including on different days. On those public pages we also record which buttons and links you press, by the name we gave them, and how far down a page you scrolled, so we can see which parts of a page people use. On the sign-up form we record which fields were reached and whether the form was refused and why, but never what you typed.
Inside your signed-in account we record the same kind of thing, and there it is tied to your account rather than to a daily code: which of our pages you open and which buttons and links you press, by the name we gave them. We use it to see where new accounts get stuck, to improve the first steps, and to help you when you write to support. We never record what you type, the addresses or contents of your monitors, your alerts, or anything on a customer's status page. These records are deleted on the same schedule as the visit records in section 6, and the IP address is kept with them for 30 days in the same way.
If you create an account, we keep how that visit reached us — the referring website, the campaign tag, the first page you opened and the country — with the account, so we can tell which of our efforts bring people to us.
We do not sell your personal data, and nothing about your account or your monitoring is shared for advertising. We do advertise on Google and on Reddit, and on our public pages — the home page, pricing, documentation, tools and similar, never inside your signed-in account and never on a customer's status page — we use Google Ads and Reddit Ads to measure whether our ads lead to visits and sign-ups. We have switched off ad personalisation with Google, and we use neither to build an advertising profile of you or to show you our ads on other sites. Visitors in the EU, EEA, UK and Switzerland are asked first, and neither runs for them unless they agree. When you create an account, add the first site of your own, or later start a paid plan, and only if ad measurement was allowed for you, we also tell Reddit directly from our servers that it happened, so the ad that brought you can be counted: your email address, your IP address and your account number are sent only as one-way codes (hashes) that Reddit can match against its own accounts but cannot turn back into the original, together with your browser details (including screen size), the identifier Reddit's pixel keeps in your browser, the plan price for a purchase, and the Reddit ad-click identifier if you arrived from a Reddit ad. Beyond that, no analytics company builds a profile of you or follows you between sites. We also keep our own daily totals of how far visitors get through signing up on our home and sign-up pages — for example, how many site checks were run and how many accounts were created that day. These are plain counts: no cookie, no identifier, and nothing tied to you or the site you checked. Separately, we measure visits to our public pages ourselves, as set out under "Visits to our website" in section 1: no cookie, nothing used for advertising, and nothing passed to an analytics company. The only other measurement that could be present is Cloudflare's own page counting at the edge of the site it already protects: aggregate page views, no cookie, nothing tied to your account, and nothing used for advertising. Nothing here makes an automated decision that has a legal or similarly significant effect on you — the AI features suggest, they do not decide.
If you are in the EU, UK or EEA, here is what we rely on:
Only these providers and services, and only as far as each one needs. The list is meant to be complete: it names the companies that handle data for us, the systems we run ourselves that hold a copy of it away from the main application, and the public registries a check has to ask a question of.
_gcl_au. Ad personalisation is switched off. See Google's Privacy Policy and how Google uses information from sites that use its services._rdt_uuid. When an account is created, adds its first site to be watched, or starts a paid plan, our servers also send Reddit that event with your email address, IP address and account number as one-way hashes, your browser details and screen size, the identifier Reddit's pixel keeps in your browser, the price for a purchase, and the click identifier. Only where ad measurement was allowed for you. See Reddit's Privacy Policy.We may also disclose data where the law requires it, or to protect the safety and rights of our users or others.
Beyond the Google Ads and Reddit Ads measurement described above, we use no advertising or cross-site tracking companies, and no analytics company beyond the aggregate page counting Cloudflare can do at the edge.
Our databases are in the United States. The servers that run your checks are in the United States, the Netherlands, Singapore and Japan, and they send their results back to the US. If you use the service from the EU, UK or anywhere else outside the US, your data is transferred to and processed in the US. Our providers each maintain their own transfer safeguards, and if you need standard contractual clauses in place with us for your own compliance, ask and we will sort it out.
Why we keep a security record, and why for eighteen months. An account takeover rarely looks like one at the time. It looks like an ordinary sign-in, and it becomes obvious weeks or months later, when something has changed that nobody remembers changing. Without a record of which account signed in, from where and when, we cannot tell you what happened to yours, we cannot tell a real sign-in from someone else using your password, and we cannot show a regulator what we found and what we did about it. So we keep that record deliberately, on a system separate from the application, and we keep only those security events rather than a log of everything you do in the product.
Eighteen months is meant to be long enough for the situations the record exists for, and no longer. A compromise is often discovered well after it happened, a dispute about who changed what can arrive months later, and some patterns only become visible across more than a year. Past that point the record stops being evidence and becomes data about you that we are keeping in case it turns out to be useful, which is not a good enough reason to keep it. We held three years until September 2026 and shortened it for exactly that reason. What we use it for is narrow, and worth stating: we read it when we are investigating something, and that is all. It is never used to build a profile of you, never used for marketing, and never fed into anything that makes an automatic decision about your account.
You can do this yourself, from Settings → Account. It asks for your password, and for a two-factor code if you have one set up. Deletion is scheduled 48 hours out, and signing back in during that window cancels it. Any active subscription is cancelled straight away.
After the 48 hours the account and the data behind it are removed: your monitors, your check results and history, your alert history, your status pages and their subscribers, your support tickets and your AI conversations. If you would rather we handled it, contact us and we will complete the deletion within 30 days.
Four things deliberately outlive the account, and backups make a fifth that works differently. Only the first is something the law obliges us to keep, and we would rather say so than let "your data is removed" stand as if it covered everything:
Backups are the other thing a deletion does not reach straight away. We do not edit backups, because a backup you can edit is not a backup, so your data stays in the copies taken before you deleted it until those copies age out and are destroyed, within about thirteen months. We never restore a backup in order to bring a deleted account back, and if we ever restore one after a real failure, any deletion the restored copy predates is carried out again.
What we actually do:
None of that makes any system perfectly secure. Please use a strong, unique password, and turn on two-factor login — it is the single biggest difference you can make to your own account.
If a breach ever puts your personal data at risk, we will tell you and the relevant regulator as quickly as the law requires.
Depending on where you live, you can ask us to:
One limit on deletion, said plainly. When you ask us to delete your data we remove your account and everything listed in section 7, but two things do not go with it: the security record described in section 6, and any backup taken before you asked. We keep the security record because it is the evidence that our own service was not abused, and because it is only worth keeping if it cannot be quietly altered: it is stored so that entries cannot be changed or removed after the fact, which is what makes it trustworthy and is also what makes lifting single entries out of it impossible. It is not kept forever. It ages out on the eighteen-month schedule in section 6, and backups age out on theirs. If you think that balance is wrong in your case, tell us and we will look at it.
In the EU, UK or EEA you can also complain to your local data protection authority.
California residents (CCPA/CPRA): you can ask what we collect, have it corrected or deleted, and opt out of it being sold or shared. We do not sell or share personal information, so there is nothing to opt out of — but you are welcome to check that with us. We do not collect sensitive personal information as the CPRA defines it, and we will never give you a worse service for exercising any of these rights.
To exercise any of this, use our contact page or email [email protected]. We aim to reply within 5 working days and to finish the job within 30.
Inside your account, two cookies. Both are strictly necessary, and both are only set once you are signed in:
We also keep a couple of small preferences in your browser's local storage, such as light or dark theme. Those are not cookies and never reach our servers.
Our own measurement of visits to the public pages (section 1) sets no cookie; inside your account it relies on the sign-in cookie you already have and sets nothing more.
On our public pages only, Google Ads may also set its own cookies (such as _gcl_au, which lasts up to 90 days) so we can tell whether an ad led to a visit or a sign-up. They are not set inside your account or on customers' status pages, and they are not used to personalise ads. Because they are advertising cookies, visitors in the EU, EEA, UK and Switzerland are asked first and nothing is set unless they agree. If your browser sends a Global Privacy Control signal, we treat it as a no.
On the same pages, and on the same terms, Reddit Ads may set its own cookie (such as _rdt_uuid), and we set one of our own, ut_rdt_cid, which holds the Reddit ad-click identifier for up to 28 days so a sign-up, or a first watched site, that happens later can still be counted. Neither is set unless ad measurement is allowed for you, and choosing "No thanks" removes ours.
Your answer is kept in your browser's local storage, not in a cookie. To change it:
UptimeTwin is not aimed at children and is not for anyone under 16. We do not knowingly collect data from children. If you think a child has given us personal information, contact us and we will delete it.
We will update this policy as the service changes. If a change materially affects how we handle your data, we will email you before it takes effect. For anything smaller we will update the "Last updated" date at the top.
Questions about this policy or your data? Email [email protected], use our contact page, or write to UptimeTwin LLC, 351 San Felipe Road, Ste 101 #1018, Hollister, CA 95023, USA. Our business phone number is 1-833-878-4634. We aim to reply within 5 working days.