Privacy Policy

Effective Date: October 1, 2026

This Privacy Policy explains how Network Canaries LLC. ("we", "us"), operating the Network Canaries service at https://networkcanaries.com, collects, uses, and shares personal data when you use the Service. It applies to all visitors and customers.

1. Data We Collect

We collect and process the following categories of data:

• Account data: name, email address, password hash, and (if you sign in with Google) the OAuth identifier and basic profile fields returned by Google. Profile avatars display an initial from your workspace name, name, or email address without contacting an external avatar service.
• Billing data: for paid plans, billing address and payment-method metadata. Card numbers are handled exclusively by Stripe; we never see or store them.
• Configuration data: the targets you choose to monitor (IP, domain, URL), check types, intervals, alert rules, and labels. This may include data that is sensitive in context (for example, a URL that reveals an internal service name).
• Operational logs: request timestamps, HTTP status codes, error traces, and the SHA-256-truncated hash of source IP addresses. General application logs use IP hashes; the separate visitor security records described below may contain raw IP addresses when enabled.
• Visitor security records: when enabled, we store the observed network IP address, request time, page-route name (not the full URL), request method, response status and completed-login events in a separate first-party database. Requests made while signed in are linked to your account; anonymous requests are not identified by matching IP addresses. These records help us investigate access and misuse. They are not sent to Google Analytics or our error-reporting service and are accessible only to authorized site administrators with multi-factor authentication. We do not store passwords, form contents, query strings or session tokens in this log. Administrators may view an approximate country and region derived locally from the recorded IP address using a downloaded geolocation database. These lookups do not send visitor IPs to the database provider or create additional stored location fields. A VPN or relay may show the network operator's location rather than your actual location. Separately, when registered-network-owner lookup is enabled, background jobs send the recorded public IP address to the responsible official internet-address registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC). A lookup may follow one validated HTTPS redirect for the same IP address, only to one of these official registries, making at most two requests in total. Each registry contacted receives that IP. The registry receives the queried IP and our server's connection information, not your account details, passwords or visited pages. We cache the reported organization, registry, lookup status and check time in our database to avoid repeating requests. Results are reused for up to 30 days, never beyond the supporting visitor record's retention period, and may be checked again after expiry. We do not store registry contact details or full responses. A registered network owner identifies a network organization, not the individual visitor.
• Cookies: we use service cookies and, when enabled and you consent, optional analytics cookies as described in §5 below. We do not use these cookies for advertising.
• Signup attribution: when you create an account, we record the campaign tags (utm_source and similar) present in the link you arrived through, the website that referred you — the site name only, never the full address — and the plan you clicked. This tells us which channels bring us customers. It is read from that single request. For this signup-attribution feature, we store nothing on your device beforehand and do not use it to track your browsing across visits. If you arrive without any of this, we record nothing. This is separate from optional, consent-based website analytics described below.
• Website analytics: when enabled, we use Google Analytics 4 only after you accept analytics in our privacy controls, and only on the anonymous homepage and pricing page. Our engagement events measure page views, pricing and sign-up link clicks, and a scroll milestone. They use fixed page and plan labels and a broad traffic-source category, not account or monitor identifiers. A sign-up link click does not mean an account was created or a payment was made. We do not run this visitor analytics on sign-in, sign-up, account-security, authenticated application or customer status pages. Google Analytics also uses pseudonymous browser and session identifiers. Google receives connection information, including your IP address, and browser and device information such as language and screen resolution. It derives approximate location and first-visit/session statistics. Its analytics cookies can recognize the same browser across visits while your consent remains valid.

2. How We Use Data

We use the data above to:

• Operate and maintain the Service, including running the checks you configure.
• Authenticate you and secure your account.
• Bill you and process payments through Stripe.
• Send transactional email — verification, password reset, alert notifications, and billing receipts.
• Detect, investigate, and respond to abuse or security incidents.
• Understand engagement with our homepage and pricing page through optional visitor analytics, when enabled and you consent.
• Comply with our legal obligations.

We do not sell your personal data. We do not use your data to train machine-learning models. We do not run advertising on the Service. We do not perform automated decision-making — including profiling — that produces legal or similarly significant effects concerning you.

3. Legal Bases (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (operating the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), consent (where required for optional communications, and for optional visitor analytics), and legal obligation (tax, accounting, lawful requests).

4. Subprocessors

We use the following third-party service providers ("subprocessors") to operate the Service. Each is bound by a data-processing agreement and processes data only on our instructions.

Subprocessor	Purpose	Data location
Stripe	Payments and subscription billing	United States, EEA
Resend	Transactional email delivery	United States
Google (OAuth)	"Sign in with Google" authentication	United States
Google (Analytics)	Optional, consent-based website analytics when enabled	See Google's data-processing terms
DigitalOcean	Application hosting and managed databases	United States
Sentry	Error monitoring and aggregated diagnostics	United States
Cloudflare	Bot mitigation (Turnstile) on signup; static asset CDN (cdnjs)	Global edge; United States
jsDelivr (Fastly)	JavaScript / CSS asset delivery (CDN)	Global edge

We will update this list when we add or change subprocessors. Material additions will be announced by email to active customers.

5. Cookies and Local Storage

The service cookies listed below support functions such as sign-in, form security and your language/theme preferences. Optional visitor analytics uses separate analytics cookies only with your consent.

• sessionid — session cookie required for login to work; cleared on logout.
• csrftoken — CSRF protection cookie required for form submissions.
• nc_language — stores the language you selected from the locale switcher.
• theme — stores your light/dark theme preference.
• messages — short-lived cookie carrying one-off status notifications (for example "Saved") across a redirect; cleared as soon as the message is displayed.

Our analytics integration uses nc_ga to distinguish browsers and nc_ga_7XC2GGG8QR for session information. We configure these cookies to expire no later than your current analytics-consent deadline, up to 180 days, and attempt to clear them when you withdraw consent. This browser-cookie lifetime is separate from the Google data-retention settings described in section 7.

When analytics is enabled, you can accept or reject it on our anonymous homepage or pricing page. Use the Analytics preferences control in the footer to review or withdraw your choice. Your choice is stored locally in your browser and is valid for up to 180 days; you may change or withdraw it sooner. Rejecting analytics does not prevent you using the service. Withdrawal disables our integration in the current page; other open pages apply the change when they detect it. We attempt to clear the known analytics cookies managed by our integration, but browser restrictions may prevent removal. Withdrawal cannot recall information already sent. If your browser blocks preference storage, the control will explain that the choice could not be saved. No advertising analytics is enabled by this feature.

6. International Transfers

Our infrastructure and several of our subprocessors are located in the United States. Where we transfer personal data of EEA, UK, or Swiss users to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards offered by each subprocessor.

7. Data Retention

We retain personal data only as long as needed for the purposes listed above. Specific retention windows:

• Account data: retained while your account is active. After we verify and fulfil a deletion request, account data is deleted from the application database except where limited records must be retained for security, tax, accounting, or other legal obligations.
• Check results: retained per plan — Free 7 days, Pro 90 days, Business 180 days — then automatically purged.
• Audit logs: agent audit logs (the per-request record of monitoring-agent API activity) are retained for 30 days; account and activity audit logs (changes to monitors, alert rules, memberships and operator actions, stored with a hashed IP address and user agent) are retained for 365 days.
• Visitor security record retention: when enabled, the retention window is 30 days. Expired records are immediately excluded from the administrator viewer and deleted by a daily cleanup, so physical deletion may follow on the next sweep. Deleting your account removes the account link from these records; any remaining IP records expire under the same schedule. Backup copies expire under the backup lifecycle and are not used for visitor analysis. Contact us using the privacy details below for access or deletion requests.
• Billing records: retained for the period required by tax and accounting law (typically 7 years).
• Optional visitor analytics: when enabled, we configure Google Analytics user-level and event-level data retention to two months, without resetting user-identifier retention on new activity. This setting does not limit the retention of Google's standard aggregated reports. Google processes expired-data deletion monthly; it is not a promise that every item of analytics data disappears exactly two months after collection. Google's retention controls.

8. Your Rights

Depending on your jurisdiction (EEA, UK, California, and others), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent (where processing is based on consent).
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email [email protected]. We respond within 30 days.

9. Data Protection Officer

We are not required to appoint a Data Protection Officer under GDPR Article 37 and have not done so. Privacy questions should be directed to [email protected].

10. Security

We protect data with industry-standard controls: TLS for data in transit, encryption at rest for our managed databases, per-tenant authorization checks, rate limiting and audit logging on sensitive endpoints, hashed API keys, and restricted, short-retention visitor security records when enabled. No system is impenetrable; report suspected vulnerabilities to [email protected] — see our security.txt for disclosure terms.

11. Children

The Service is not intended for individuals under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Data Processing Addendum (DPA)

Customers acting as data controllers under the GDPR may request a Data Processing Addendum incorporating the EU Standard Contractual Clauses by emailing [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised Effective Date and, for material changes, notify account holders by email.

14. Controller and Contact

The data controller is Network Canaries LLC.. Privacy questions and rights requests: [email protected].