Privacy Policy

Last updated 9 November 2026

This Privacy Policy explains how Alyx s. r. o. (“Alyx”, “we”, “us”) processes personal data when you use Stackpulse (the “Service”) at stackpulse.app. We act as the data controller and process your data under the EU General Data Protection Regulation (GDPR) and Slovak law.

In short: we collect what Stackpulse needs to work, we don’t sell your data or show ads, and we don’t use tracking cookies.

1. Who we are

The data controller is Alyx s. r. o., a company incorporated in Slovakia:

  • Registered office: Závodská 2963/4, 010 01 Žilina, Slovakia
  • Company ID: 56229763
  • Tax ID: 2122249338
  • VAT ID: SK2122249338
  • Commercial Register: District Court Žilina, Section Sro, insert no. 84989/L
  • Contact: info@stackpulse.app

2. What data we collect

  • Account data — your email address and your password, which we store only as a secure hash. If you sign in with Google or GitHub, we receive your email address and username from them and keep a link to that account, so you can sign in with it again. We never see your Google or GitHub password. When you sign up we also note where from: the page of ours or the other site your browser says you opened sign-up from, any campaign tags in its address, and whether you came to get alerts for a particular service. We don’t use a cookie for this.
  • Profile data — what you add in Settings: your first and last name, your company name and a profile photo.
  • Dashboards and status pages — the dashboards you create, their names and the services on them, and your status page settings, such as its description, logo, favicon, Stackpulse address and custom domain. Anyone with its link can see a public status page, with its name, description, logo and the status of its services.
  • URL monitors — the addresses (URLs) you ask Stackpulse to check and their settings, including any headers and request body you add, which can hold keys. For each monitor we keep what the checks found: its status changes with the error that caused them, its response times, and its certificate’s issuer and expiry date. A public status page shows a monitor’s name and status, never its address or its errors.
  • API keys — for each key you create: its name, what it may do, the dashboards it may see, when it expires and the day it was last used. We keep only a fingerprint (a hash) of the key itself, so we can’t show it again. Requests made with a key are logged like any other request to Stackpulse.
  • Connected apps — for each AI assistant you allow to use your account: its name and the address of its description of itself (or the id it registered for), where it sends you back to after signing in, what it may do, the dashboards it may see and when it was last used. We keep only fingerprints of its tokens. An app nobody used for 90 days is disconnected, and you can disconnect one any time. About the apps themselves, not about you, we keep their names, the addresses they sign in from, and an icon found on their own website.
  • API and assistant usage — for each key and connected app, how many requests it made each day, by the name of the tool or endpoint it used, and how many were turned away and why; never what was asked. We keep these counts for 90 days, to keep the service running well and see how it’s used.
  • Notification settings — whether you’ve turned on email alerts, whether your email address is confirmed, and which dashboards your alerts cover. For each webhook you add: its address (URL), its name and its settings.
  • Email addresses you add to your alerts — if you add someone else’s address, we store it, which dashboards it covers and when it was confirmed. We email that address once, to ask whether it wants the alerts, and send nothing else until someone there confirms. Every alert to it has a link to unsubscribe.
  • Subscribers to a status page — if you subscribe to a status page’s email updates, we store your email address, which page it’s for and when you confirmed. We email you once to ask you to confirm, and send nothing else until you do. Every update has a link to unsubscribe, which deletes your address. The page’s owner, one of our customers, can see the addresses that subscribed to their page, and remove them.
  • Technical and security data — our server records each request: your IP address, your browser (user agent), the address requested and the time. So that we can warn you when someone signs in to your account from a new device, we keep a one-way hash of the IP address and browser of each sign-in. We also use IP addresses to limit abuse.
  • Plan and billing — which plan you’re on and until when, when your Pro trial ends and which emails about it we’ve sent, which tips we’ve sent and whether you turned them off, when we last sent the weekly email and whether you turned it off, and which dashboard and services you chose to keep on the free plan. If you pay for Pro: the identifiers Dodo Payments gives your customer record and your subscription, the subscription’s status, whether it bills monthly or yearly, and when it next renews or ends. We never see your card details.
  • Activity — the day you last used Stackpulse, the date only, so we can tell accounts in use from abandoned ones.
  • Messages — what you write to us, by email or with the message box on your dashboard and the pricing page, and your email address. So we don’t have to ask, a message from the box also tells us the page you wrote it on, your browser, its window size and your time zone, and, if you’re signed in, your account, its plan and how much of it you use.
  • Usage data — privacy-friendly statistics about page views, described in section 4.

We don’t collect your payment details: Dodo Payments does, when you pay for Pro (see section 6). The status of the services we monitor comes from their public status pages and isn’t personal data.

3. Cookies and browser storage

We use only these cookies, all set by stackpulse.app itself:

  • pb_auth keeps you signed in. It lasts 14 days and is renewed while you use Stackpulse.
  • oauth2 holds a one-time code while you sign in with Google or GitHub, for at most 10 minutes.
  • last_dashboard remembers which dashboard you opened last, so Stackpulse can take you back to it. It lasts a year.

These cookies are needed to provide the Service you asked for, so they don’t require your consent and we don’t show a cookie banner. We don’t use advertising or cross-site tracking cookies, and our analytics set none. Your browser also keeps a few small things for us: your scroll position while a tab is open (session storage), so the back button returns you to where you were; once you close the tip in the status page editor, that you closed it; and when you last opened each dashboard’s Timeline, so the menu can point out an outage you haven’t seen yet (both in local storage).

4. Analytics

We count visits with Umami, an open-source analytics tool that we host ourselves. For each page view it records the page, the site you came from, your browser, operating system, device type, screen size, language and country. It sets no cookies, stores nothing in your browser and doesn’t store your IP address. It also counts a few steps in the app: signing up (with email, Google or GitHub), creating a dashboard, opening the upgrade dialog, starting a checkout and subscribing, with the plan’s billing period, but never your name, email address or account. We use these statistics only to see how Stackpulse is used, never for advertising, and we don’t share them. Status pages that answer on their owners’ own domains or on Stackpulse addresses (like andy.stackpulse.app) don’t load Umami at all.

5. Why we process your data, and our legal bases

  • To provide the Service — your account, dashboards and status pages, and the emails that come with them: confirming your email address, resetting your password, changing your email address and warning you about a sign-in from a new device. This is necessary for our contract with you, Art. 6(1)(b) GDPR.
  • To send you alerts when a service on your dashboards has an outage or comes back online, by email and to the webhooks you add, only as you set them up in Settings → Notifications. Alerts to your own email are on when you sign up and start once your address is confirmed, and you can turn any of them off at any time. Art. 6(1)(b) GDPR.
  • To email alerts to an address that you added, once someone there has confirmed they want them: their consent, Art. 6(1)(a) GDPR, which the unsubscribe link in every alert withdraws. The one email that asks for it relies on our legitimate interest in sending alerts only where they’re wanted, Art. 6(1)(f) GDPR.
  • To email a status page’s updates to its subscribers, once they’ve confirmed they want them: their consent, Art. 6(1)(a) GDPR, which the unsubscribe link in every update withdraws. The one email that asks for it relies on our legitimate interest in sending updates only where they’re wanted, Art. 6(1)(f) GDPR.
  • To sell you Pro and keep your plan in step with your subscription at Dodo Payments. This is necessary for our contract with you, Art. 6(1)(b) GDPR.
  • To email you a few tips about Stackpulse: after you sign up, if your account has no dashboard, few services or no alerts, and a week after a Pro trial ends, what’s locked on the free plan. Never more than one every two days, and only to a confirmed address. Our legitimate interest in helping you use what you signed up for, Art. 6(1)(f) GDPR; every tip has a link that stops them, and so does Settings → Notifications.
  • To email you once a week, on Mondays, what your services did in the week before, only to a confirmed address and only while you watch services. Our legitimate interest in showing you what Stackpulse does for you, Art. 6(1)(f) GDPR; every one has a link that stops them, and so does Settings → Notifications.
  • To see where new accounts come from, from the sign-up page’s own request, so we know which pages and channels bring people. Our legitimate interest in improving how we reach people, Art. 6(1)(f) GDPR.
  • To keep the Service secure and reliable and to prevent abuse, with request logs, sign-in alerts, rate limits, a bot check on some forms, and backups. Our legitimate interests, Art. 6(1)(f) GDPR.
  • To understand how Stackpulse is used and improve it (analytics). Our legitimate interests, Art. 6(1)(f) GDPR; you can object at any time, see section 9.
  • To answer your messages and help with your account. When it takes it, our administrators can see your account as you see it, and change it for you where you’ve asked us to; each time is logged. Our legitimate interests, Art. 6(1)(f) GDPR.
  • To meet our legal obligations, Art. 6(1)(c) GDPR.

We don’t make decisions about you by automated means alone, and we don’t profile you.

6. Who we share data with

We don’t sell your personal data. We share it only with the service providers that help us run Stackpulse, which process it on our behalf under data-processing agreements:

  • Hetzner — hosts our servers, in Germany.
  • Resend — sends our emails, from Ireland.
  • Cloudflare — stores the files you upload (profile photos, status page logos and favicons) and our backups, in the European Union. It also runs our DNS, forwards email sent to info@stackpulse.app, passes our analytics requests on, and runs the bot check on some of our forms, which looks at your IP address and browser to tell people from bots. Every visit to stackpulse.app and its subdomains, and to status pages on their owners’ own domains, passes through Cloudflare’s network, which delivers the pages and keeps copies of our images, fonts and scripts close to you. It sees each visit’s IP address and the address requested. When a check of one of your URL monitors fails, Cloudflare’s network (Cloudflare Workers) checks it again for us: it receives that monitor’s address and request settings for the check, and keeps nothing.

In addition:

  • If you sign in with Google or GitHub, they handle that sign-in under their own privacy policies.
  • When you buy Pro, Dodo Payments, our merchant of record, runs the checkout and takes the payment. It collects your payment details, billing address and tax ID, if you give one, and processes them as a controller under its own privacy policy. We give it your email address, your name and your Stackpulse account id to start the checkout, and it tells us the state of your subscription.
  • Email you send to info@stackpulse.app, and messages from the message box, are delivered to our mailbox at Google (Gmail).
  • When you add a webhook, we send your alerts to its address: the names and statuses of the services and URL monitors, what a monitor’s check found, and the names of your dashboards. It’s the service you chose, such as Slack, Microsoft Teams, Google Chat or Discord, that handles them then, under its own terms.
  • If you subscribe to a status page’s email updates, its owner sees your email address and when you subscribed.
  • Anthropic’s Claude writes the summaries on our public outage pages. It receives only the public status information those pages show, such as services’ incident names and their status pages’ updates, and nothing about you or your account.
  • We disclose data when the law requires it, for example to a court or public authority.

7. International transfers

Our servers are in Germany, the files you upload and our backups in the European Union, and our emails are sent from Ireland. Cloudflare, Google, GitHub and Resend are US companies and may process data outside the European Economic Area; where they do, it is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework. Dodo Payments may also process payment data outside the European Economic Area, as its privacy policy describes.

8. How long we keep your data

  • Your account, profile, dashboards, status pages, webhooks and settings — for as long as your account exists. When you delete it in Settings → Delete account, we delete all of it right away, including your uploaded images.
  • What URL monitors’ checks found — status changes for 90 days; response times in 10-minute steps for 7 days and per day for 90 days. The last checks of each monitor are kept only in memory, so a restart clears them. Deleting a monitor deletes all of it.
  • Email addresses added to someone’s alerts — until that person removes it or deletes their account. An address that unsubscribed stays in their list, switched off, so they can see that it did.
  • Subscribers to a status page — until you unsubscribe, the page’s owner removes you, or the page or its owner’s account is deleted. An address nobody confirms is deleted after 7 days.
  • Your payments — Dodo Payments keeps its records of them, such as invoices, for as long as tax and accounting laws require.
  • Backups — up to 14 days, so deleted data is gone from them within 14 days.
  • Request logs — 5 days.
  • Analytics — kept as aggregate statistics.
  • Messages you send us — by email or with the message box, as long as we need them to handle your request.

9. Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time where we rely on it. You can correct most of your data yourself in Settings, and delete your account in Settings → Delete account. For anything else, including objecting to analytics, email info@stackpulse.app and we’ll answer within one month.

You can also lodge a complaint with the Slovak supervisory authority, the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk), or with the authority where you live or work.

10. How we protect your data

Everything is encrypted in transit (HTTPS). Passwords are stored only as hashes, and your session is kept in a cookie that scripts can’t read. Each account can reach only its own data, plus the status pages others have made public. Access to our servers is restricted.

11. Children

Stackpulse isn’t directed to children. You must be at least 16 years old to use it.

12. Changes to this policy

We may update this policy from time to time. We’ll change the “Last updated” date above and, for material changes, tell you by email or in the app. Our Terms of Service cover the rest of how Stackpulse works.

13. Contact

Email us at info@stackpulse.app or write to Alyx s. r. o., Závodská 2963/4, 010 01 Žilina, Slovakia.