Privacy policy

Last updated: 20 August 2026. This policy covers stillindexed ("we", "us", "the service") and explains what we collect, why, and what you can ask us to do about it. For GDPR purposes we are the data controller for the personal data described here. Questions or requests: privacy@stillindexed.com.

What we collect

• Account data: your email address. That is the only personal data we require.
• Monitoring data: the domains and URL paths you ask us to watch, and the results of our checks (HTTP status, directives, certificates, domain registration data). These are public responses from public web servers.
• Billing data: handled entirely by Polar (polar.sh) as merchant of record. We never see or store your card details. Polar processes your payment data under its own privacy policy.
• Support and alert channels: your Telegram chat ID or Slack webhook URL if you connect them. Slack webhook URLs are stored encrypted.
• Technical logs: standard server logs (IP address, user agent) kept for 30 days for abuse prevention and debugging.

Why we are allowed to process it (GDPR)

• Performing our contract with you, Article 6(1)(b): running the checks you asked for, sending the alerts, and managing your subscription.
• Legitimate interests, Article 6(1)(f): rate limiting, fraud and abuse prevention, and keeping the service secure and working.
• Legal obligation, Article 6(1)(c): keeping billing records where tax or accounting law requires it.

We do not sell your personal data, we do not use it for advertising, and we do not share it with third parties for their own marketing.

What we do with it

Provide the service: run checks, send alerts, produce reports, process payments. We do not sell data, run ads, or build advertising profiles. We do not use your monitoring data for anything other than providing the service to you.

Cookies

Three, all first-party, all set by us. No third-party cookies and no advertising cookies.

• dfsess, the session cookie that keeps you signed in. HttpOnly, so no script can read it.
• si_signedin, the value 1 and nothing else. It lets this site offer you "Open the app" instead of a sign-up button. It holds no token and no identity.
• si_attr, which records how you first arrived, for example a link from a search result or a campaign tag in the address. It exists so we know which of our own pages bring people here. It holds no identifier for you and is not shared.

Analytics

We run Umami, self-hosted on our own server at analytics.stillindexed.com. It records page views and a small set of named actions, for example that someone ran a free tool or started a checkout. It sets no cookie of its own and builds no cross-site profile, and the data is never sent to an advertising network or sold.

Page addresses are cleaned before they are recorded: sign-in tokens, report share tokens and anything else that works as a credential are stripped, and account identifiers are collapsed to the shape of the page rather than kept.

Third parties

Polar (payments), Resend (transactional email), Telegram and Slack (alert delivery, only if you connect them), Hetzner (infrastructure). Each processes data only as needed to deliver their part of the service. Analytics is not on this list because it runs on our own infrastructure.

Retention

Account and monitoring data is kept while your account is active. Check snapshots are pruned automatically after your plan's retention window. Delete your account and we delete your data within 30 days, except records we must keep for tax or legal reasons (handled by Polar).

Your rights

Email privacy@stillindexed.com to access, correct, export, or delete your data. EU/UK users: the legal basis is contract performance (providing the service) and legitimate interest (abuse prevention).