Privacy

What we collect about you

Only what the product needs to work:

• Your email address, to sign you in and to send you alerts. Authentication is handled by Supabase; we never see or store your password.
• What you asked us to watch — the URLs, hostnames and schedules of your monitors, and the names you gave them.
• Alert recipients — the email addresses, phone numbers and chat webhooks you tell us to notify.
• Credentials you give a monitor, where you are checking an authenticated endpoint. These are sealed with AES-256-GCM before they are written down, are never returned to the browser, and can be replaced but not read back — including by us.
• Billing details are handled entirely by Polar, our merchant of record. We receive a subscription status and a customer id. We never see your card.

What we collect about your visitors

Site Insights is our analytics product. If you add a site and install the snippet, we record a page view, the path, the referring domain, a coarse device and browser, a country, and real performance timings from the visitor's own device.

There is no cookie, and nothing is stored on the visitor's device. A visitor is identified by a hash of their IP address, their user agent, the site, and a secret salt that includes the current calendar month in UTC. The IP is used to compute that hash and to resolve a country, and is then discarded — it is never written to our database.

Because the month is part of the salt, the identifier changes at the start of each month, and within a month two visits by the same person to the same site can be recognised as the same person. That is what lets a site owner see how many of their visitors are returning. It is a real limit on privacy and we would rather state it than imply otherwise: for up to 31 days, visits to one site can be linked together.

What that linking cannot do is as important as what it can. The site is part of the salt, so the same person on two different customers' sites is two unrelated identifiers and no profile can be assembled across sites. The hash cannot be reversed to an IP address or a person. Nothing is read from or written to the visitor's device at any point. And at the start of the next month the identifier changes, so the linking window closes rather than extending.

This is a change from how it worked before September 2026, when the salt contained the date and no visitor could be recognised across two days.

What we never do

• We do not sell your data, or your visitors' data, to anyone.
• We do not run advertising, and we do not embed anyone else's advertising or tracking code on our site or in our snippet.
• We do not read the content of the pages we monitor beyond the check you configured — a status code, a keyword, or a JSON path.
• We do not store raw IP addresses of your visitors.

Who else processes it

We are a small operation and we do not run our own hardware. These are the companies that necessarily handle data on our behalf:

• Supabase — the database and authentication. Hosted in AWS ap-northeast-2 (Seoul).
• Vercel — hosts the website and dashboard.
• Fly.io — runs the checker that performs monitoring and sends alerts, in Tokyo.
• Resend — delivers alert email.
• Polar — merchant of record for all payments.
• Cloudflare — DNS and inbound email routing.
• Meta — WhatsApp delivery, once that channel is live. Nothing is sent to Meta today.

How long we keep it

Check results and analytics events are kept for as long as your plan retains them — seven days on Free, 90 days on Pro, 365 days on Business — and are then deleted. Daily summaries outlive the individual events.

Everything else lasts as long as your account. Delete a monitor and its history goes with it; delete your account and we remove your data.

Your rights

You can export or delete your data at any time, and you can ask us what we hold about you. Write to hello@alertkite.com and a person will answer.

If you use Site Insights, you are the controller of your visitors' data and we are your processor. We believe the design above means you do not need a consent banner for our analytics, because nothing is stored on or read from a visitor's device — which is the question a cookie banner exists to answer. The month-long identifier does mean more is linkable than when it lasted a day, and whether that is acceptable under your own obligations is a judgement only you can make. We are not your lawyers, and your obligations are yours to assess.

Changes

If we change this in a way that affects what we collect, we will say so by email before it takes effect rather than quietly changing the date at the top.