Privacy Policy

Operator: API Watch

Information processed

Account name, email, password hash and acceptance of the applicable Terms version.
Monitor names, target URLs, configured intervals, HTTP results, response latency and incident timestamps.
Notification email addresses, Discord webhook URLs and Telegram chat IDs when supplied. These fields are encrypted at rest in production using the configured application encryption key.
A signed HttpOnly session cookie and a local browser theme preference; the app does not include advertising trackers.
Public status subscribers' email addresses and confirmation/unsubscribe state.
Operational request information processed by the VPS, Docker and reverse-proxy logs.

Purpose and disclosure

Data is used to run the monitors and account features requested by the account owner, send configured alerts and maintain the service. Contact-form messages are delivered to the configured support mailbox. When enabled, Resend delivers email, Stripe handles subscriptions, and Discord or Telegram receive notifications selected by the account owner. No advertising or analytics provider is currently integrated.

Retention

Raw probe results are retained for up to 24 hours.
PRO accounts receive daily aggregates for up to 30 days.
Resolved FREE incidents are retained for 24 hours; resolved PRO incidents for up to 30 days. Open incidents are retained until resolved.
Unsubscribed status-page subscriber records are removed after 90 days.
Account deletion removes associated monitors, results, incidents, subscriptions and status subscribers. Stripe may retain records it is legally required to keep.

Your choices and requests

You can keep monitors private, publish individual monitors, export account data from settings, delete your account from settings, unsubscribe from status updates, or contact test@overover.site. Account exports omit encrypted notification secrets. Account deletion immediately cancels a paid Stripe subscription before removing stored data.

International processing and legal basis

The service is self-hosted on the operator's VPS. Data sent to configured email, payment, Discord or Telegram providers is processed under those providers' terms. The operator must complete a jurisdiction-specific legal review and identify the applicable legal basis before enabling public registration.