Privacy Policy
This policy explains what personal data Heartcron collects, why, how long we keep it and what choices you have. We collect only what we need to run the Service. We don’t sell your data and we don’t use advertising trackers.
What we collect
| Data | Why |
|---|---|
| Account: email address, name if you add it, language, time zone, time format; GitHub user ID and login if you sign in with GitHub | To sign you in, show times in your zone and contact you about your account |
| Sign-in records: one-time sign-in tokens (stored as hashes), session records with browser user agent, IP address of sign-in requests | Security, rate limiting and keeping you signed in |
| Checks: names, schedules, tags, URLs, hosts and domains you monitor | To run your checks |
| Pings: time, type, exit code, HTTP method, sender IP address, user agent and up to 100 KB of request body | To show what your jobs reported and when |
| Check results: status codes, response times, errors, certificate and domain expiry dates | Uptime history and alerts |
| Integrations: email addresses for alerts, Telegram chat IDs, Slack and Discord webhook URLs, webhook URLs and secrets | To deliver your alerts |
| Payments: plan, amount, date and status of each payment. Card details go straight to Robokassa; we never see or store them | To run your subscription and keep records the law requires |
| Waitlist: email address, language and country, if you joined before sign-up opened | To invite you to the beta |
Cookies
We use only cookies the Service needs: a session cookie to keep you signed in, and small cookies that remember your language, theme and last opened project. We don’t use analytics or advertising cookies, so there is no cookie banner.
Who processes data for us
- DigitalOcean hosts our servers and database in the United States.
- Postmark sends sign-in emails and email alerts.
- Robokassa (Russia) processes payments and sends receipts.
- Telegram, Slack, Discord and webhook endpoints receive alerts only when you connect them.
- GitHub is used only if you choose to sign in with it.
Our probe servers in different regions connect to the sites you ask us to monitor. Those sites see our probe IP addresses, not yours.
How long we keep it
- Ping and check history: as long as your plan allows (7 days on Free, 90 days on Starter, a year on Pro and Business), then it is deleted automatically.
- Delivered alert records: 90 days.
- Expired sign-in tokens and sessions: removed shortly after they expire.
- Your account and checks: until you delete them. Deleting your account removes your projects, checks and history right away.
- Database backups: kept for up to 14 days, after which deleted data is gone from backups too.
Your rights
You can see and change your data in the dashboard and delete your account in Account settings at any time. You can also ask us to give you a copy of your data, correct it or delete it by writing to hello@heartcron.com. If you are in the EU, UK or another region with data protection laws, you have these rights under those laws, including the right to complain to your local data protection authority.
We process your data to provide the Service you asked for (performance of a contract) and, for security and abuse prevention, on the basis of our legitimate interest.
Security
All connections use HTTPS. Sign-in tokens and session tokens are stored only as hashes. Access to servers is limited and protected by SSH keys. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.
Changes
If we change this policy in a way that matters, we will email you or show a notice in the dashboard before the change takes effect.
Contact
Privacy questions and requests: hello@heartcron.com.