1. Who is responsible
The operator of Pingstead is responsible for the personal data described here (the “controller” under the EU General Data Protection Regulation). The operator’s details and the contact address, when published, are shown under “Contact” at the end of this page; the details also stand at the bottom of every page.
2. Your account
When you sign up and use your account we keep:
- your email address;
- your password, only as a one-way hash (argon2id) — we cannot read it;
- your interface language, your plan and whether the account is active or suspended;
- which version of the terms you accepted and when;
- when you last signed in, when you confirmed your email address (once email confirmation is switched on), and when the account was created and last changed.
Why: to provide the service you signed up for (performance of a contract). How long: until you delete your account.
3. Signing in
When you sign in, your browser receives a random token in a cookie. We keep only a hash of it (SHA-256), together with when the session started and was last used, when it expires, and the IP address and browser User-Agent (its first 200 characters) at sign-in.
Why: to keep you signed in and to let you and us recognise unusual sign-ins (legitimate interest in the security of the service). How long: until you sign out, or 30 days without use, or 90 days at most.
To slow down password guessing, the service counts recent failed sign-ins and sign-ups per IP address and email address in memory, for up to 24 hours; these counts are not written anywhere.
Links sent by email to confirm an address or reset a password (once these are switched on) are kept as hashes too, until they are used or expire (24 hours and 1 hour), and then 7 more days.
4. Your sites and their checks
For the sites you add we keep the domains and URLs, their names and check settings, and what our checks find:
- each check result: when and from which location, the outcome, the HTTP status, the time spent on each phase of the request, the number of attempts and redirects, the final URL after redirects, the IP address your server answered from, and our own error message — never the content of your pages;
- the verdict of each check round, incidents (when a URL was down or degraded, why, and from where), an activity log of changes and state changes, and statistics by hour and by day.
How long: check results and round verdicts 30 days; hourly statistics, incidents and the activity log 400 days; daily statistics as long as the URL exists. When you delete a URL, a site or your account, its data is deleted at once; the activity entries of a deleted URL stay with its site until the site is deleted.
Certificate and registration data about the hosts and domains you watch (issuer, validity, names, registrar, expiry, name servers) is public information about those hosts, shared by all accounts that watch the same one, and deleted 7 days after no site uses it.
5. Server logs and backups
Our web server records each request: the IP address, the time, the method and path (without query parameters), the status, the size, the duration and the browser User-Agent. Our application logs record account IDs, never email addresses, passwords or cookies. Logs are rotated by size — at most 50 MB per service — and the oldest lines are overwritten.
Why: to keep the service secure and working (legitimate interest).
The database is copied every night; the 7 most recent copies are kept, so deleted data leaves the backups within 7 days.
7. Who else handles the data
Our servers are rented from DigitalOcean. The website, the database and the certificate and domain checks run in Frankfurt, Germany. The HTTP checks run on servers in the locations listed on the home page, some of them outside the European Union; those servers receive only the URLs to check and their settings, never your email address or password.
Email confirmation and password reset are not switched on yet. When they are, the messages will be sent through an email delivery service, which we will name here.
We do not sell personal data and do not share it with anyone else, unless the law requires us to.
8. Your rights
You can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its use, and receive it in a portable form. You can delete your account and all its data yourself in your account settings. For anything else, write to the address under “Contact” at the end of this page.
You can also complain to a data protection authority, for example the Commissioner for Personal Data Protection of the Republic of Cyprus or the authority of the country where you live.
9. Security
Passwords and session tokens are stored only as hashes. Access to the servers is limited to the people who run the service.
10. Children
The service is not meant for children under 16, and we do not knowingly keep their data.
11. Changes
When this policy changes, we publish the new version here with its date. If a change affects how we use your data significantly, we will announce it on this website before it takes effect.
12. Contact
Write to sagitta0401@gmail.com.