stillindexedStart monitoringOpen the app

Privacy policy

Last updated: 20 August 2026. This policy covers stillindexed ("we", "us", "the service") and explains what we collect, why, and what you can ask us to do about it. For GDPR purposes we are the data controller for the personal data described here. Questions or requests: privacy@stillindexed.com.

What we collect

  • Account data: your email address. That is the only personal data we require.
  • Monitoring data: the domains and URL paths you ask us to watch, and the results of our checks (HTTP status, directives, certificates, domain registration data). These are public responses from public web servers.
  • Billing data: handled entirely by Polar (polar.sh) as merchant of record. We never see or store your card details. Polar processes your payment data under its own privacy policy.
  • Support and alert channels: your Telegram chat ID or Slack webhook URL if you connect them. Slack webhook URLs are stored encrypted.
  • Technical logs: standard server logs (IP address, user agent) kept for 30 days for abuse prevention and debugging.

Why we are allowed to process it (GDPR)

  • Performing our contract with you, Article 6(1)(b): running the checks you asked for, sending the alerts, and managing your subscription.
  • Legitimate interests, Article 6(1)(f): rate limiting, fraud and abuse prevention, and keeping the service secure and working.
  • Legal obligation, Article 6(1)(c): keeping billing records where tax or accounting law requires it.

We do not sell your personal data, we do not use it for advertising, and we do not share it with third parties for their own marketing.

What we do with it

Provide the service: run checks, send alerts, produce reports, process payments. We do not sell data, run ads, or build advertising profiles. We do not use your monitoring data for anything other than providing the service to you.

Cookies

Three of our own, listed below. There is also one advertising tag, described under Advertising, and it can set cookies we do not control.

  • dfsess, the session cookie that keeps you signed in. HttpOnly, so no script can read it.
  • si_signedin, the value 1 and nothing else. It lets this site offer you "Open the app" instead of a sign-up button. It holds no token and no identity.
  • si_attr, which records how you first arrived, for example a link from a search result or a campaign tag in the address. It exists so we know which of our own pages bring people here. It holds no identifier for you and is not shared.

If you give us your email on a free tool

The free tools need no account and store nothing about the URLs you check. After a result you may be offered the chance to leave an email address. That is optional, the result is already on screen either way, and dismissing it is remembered so you are not asked again.

If you do leave one we store the address, which tool you were using, and the campaign that first brought you to the site if there was one. We use it to send occasional writing about how indexing breaks. We do not sell it, share it, or pass it to an advertising network. Reply to any message, or email privacy@stillindexed.com, and we delete it.

Analytics

We run Umami, self-hosted on our own server at analytics.stillindexed.com. It records page views and a small set of named actions, for example that someone ran a free tool or started a checkout. It sets no cookie of its own and builds no cross-site profile, and the data is never sent to an advertising network or sold.

Advertising

We run paid search ads and load the Google Ads tag so we can tell which ads produce customers. It is a third party, it can set cookies of its own, and what it collects is governed byGoogle's privacy policy rather than by this one. If you use an ad blocker or browser tracking protection, it will not load, and nothing on this site depends on it.

Inside the app the tag is loaded with page tracking switched off. It is told about one thing only, that a purchase completed, and never about which pages you visit. The same rule as the analytics above applies and matters more here: our app puts sign-in tokens in web addresses, and an advertising network is the last place those should go.

We do not upload your email address, your monitored URLs or anything from your account to an advertising network, and we do not build or buy audience profiles.

Page addresses are cleaned before they are recorded: sign-in tokens, report share tokens and anything else that works as a credential are stripped, and account identifiers are collapsed to the shape of the page rather than kept.

Third parties

Polar (payments), Resend (transactional email), Telegram and Slack (alert delivery, only if you connect them), Hetzner (infrastructure). Each processes data only as needed to deliver their part of the service. Analytics is not on this list because it runs on our own infrastructure.

Retention

Account and monitoring data is kept while your account is active. Check snapshots are pruned automatically after your plan's retention window. Delete your account and we delete your data within 30 days, except records we must keep for tax or legal reasons (handled by Polar).

Your rights

Email privacy@stillindexed.com to access, correct, export, or delete your data. EU/UK users: the legal basis is contract performance (providing the service) and legitimate interest (abuse prevention).