Privacy
Written to match what the software actually does. If you change the code, change this page.
What is stored
| Data | Why | Kept |
|---|---|---|
| E-mail address | Signing in, sending alerts | Until you delete the account |
| Password hash (Argon2id) | Signing in | Until you delete the account |
| Google account id, if you use Google sign-in | Matching you to your account | Until you delete the account |
| The URLs you monitor and what you watch on them | The entire point of the service | Until you delete the monitor |
| A monitor you set up before signing up: the address, what to watch and the condition | Creating it once you have an account | 6 hours, then it is useless and deleted within 2 days; nothing is kept if you never sign up |
| Values read from those pages, over time | History graphs, "changed since last time" | Last 500 checks per monitor |
| Notification settings (webhook URLs, bot tokens) | Delivering alerts | Until you remove the channel |
| Session records (browser string, last seen) | Showing your signed-in devices, letting you revoke them | Until they expire or you revoke them |
| Security log: sign-ins, failed attempts, password and two-factor changes (never a password or a code) | Showing your recent account activity, spotting abuse | 180 days, or until you delete the account |
| A salted hash of your IP address | Rate limiting and stopping bulk free-tier sign-ups | With the account or audit row |
Your IP address is never written down in readable form. It is passed through a keyed hash (HMAC-SHA256 with this install's secret) and only the hash is stored, which is enough to count sign-ups from one connection but cannot be turned back into an address.
What is not done
- No advertising, no ad networks, no data sold or shared for marketing.
- No third-party analytics. No Google Analytics, no Facebook pixel, no session recording.
- No external fonts, scripts or images — every asset comes from this site, so no font, script or advertising company sees your visit.
- No profiling and no automated decisions with legal effects.
Pages you ask us to watch
When you create a monitor we fetch the URL you give us from this server, on the schedule you choose. We identify ourselves honestly in the User-Agent string (WatchpostBot/1.0 (+https://watchpost.watch/about/bot)) and store the value we extracted plus the timestamp. We do not log in on your behalf, we do not send your cookies, and we do not fetch pages behind a login.
Third parties
These companies do part of the work of running this site, and see what that work needs:
- Cloudflare — carries all traffic to this site, so it sees visitors' IP addresses and the pages they open
- Brevo — delivers our e-mail (sign-in links, confirmations and alerts), so it sees the recipient address and the message
Beyond those, only the ones you set up yourself. If you add a Discord or Slack webhook, alert text goes to Discord or Slack. If you add Telegram, it goes to Telegram. If you add your phone, it goes to the ntfy server you chose (ntfy.sh unless you named your own). If you use Google sign-in, Google learns that you signed in here. E-mail goes through the mail service this install is configured with. That is the complete list.
Your rights
Under the GDPR you can see, correct, export and delete your data. Two buttons on the account page cover all of it: Download JSON export gives you everything held about you in a machine-readable file, and Delete everything removes the account and all attached records immediately — no grace period, no soft delete. The nightly backups still hold a copy for up to 14 days, until they rotate out; they are only ever used to bring the service back after a failure.
Security
- Passwords hashed with Argon2id.
- Webhook URLs, bot tokens and two-factor seeds encrypted at rest.
- Session cookies are HttpOnly and SameSite=Lax; the cookie holds a random id and the database stores only its hash.
- Strict Content-Security-Policy, CSRF tokens on every form, rate limiting, and account lockout after repeated failed sign-ins.
Who is responsible for your data
The data controller, and the address for any request about your data:
- Contact
- [email protected]
You can also complain to your data protection authority; in Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données.