WebCheck1. Who we are
This policy applies to the WebCheck service provided on webchecks.site and its subdomains (including the console at my.webchecks.site). The data controller is the operator of webchecks.site; contact details are at the end.
2. Information we collect
2.1 What you give us
| Info | When | Why |
|---|---|---|
| Email address, password (hash only) | Sign up | Creating accounts, signing in, password resets, sending alerts |
| Team members' emails | Invite members | Let them join your tenant |
| Alert recipient emails, DingTalk webhook address and secret, custom webhook addresses | Configure notifications | Delivers alerts where you want them |
| Your own SMTP server and credentials (optional) | Configure your own sender | Send business alerts from your own email |
| Site addresses, groups, notes, monitoring rules | Add a site / content watch | Providing the monitoring service itself |
| Invoicing details (optional) | Request an invoice | Issuing an invoice |
2.2 Generated while the service runs
- Monitoring data: status code, response time, actual peer IP, certificate details, and error message for every check; values captured by content watch and page snapshots; resource check results.
- Traffic analytics data (only when you enable analytics for a site): the visitor's anonymous ID (an HMAC of IP, UA, and site, rotated daily), pages visited, referrer domain, UTM params, country (resolved from IP — the raw IP is not stored), time on page, and scroll depth. No cookies, no cross-site tracking.
- Account activity: sign in times and IPs, audit log of key actions (like deleting a site or editing a member).
- Delivery log: which channel each alert went to, whether it succeeded, and the failure reason if not.
2.3 Collected automatically
- Your IP address, browser type, and access times when using the console — kept in server access logs for security and incident troubleshooting, retained no more than 30 days.
- Essential cookies; see the cookie policy.
We do not use any third-party analytics or ad-tracking scripts — not on the site, not in the console.
3. How we use this information
- Providing, maintaining, and improving the monitoring service;
- Sending you service-related notices: email confirmation, password resets, alerts, daily reports, trial-expiry reminders, important changes;
- Abuse prevention: rate limiting on sign in, anti-enumeration, and detecting use that violates the terms of service;
- Responding to your support requests;
- Complying with legal obligations.
We never send marketing email unless you explicitly subscribe. System notifications come from report@my.webchecks.site.
4. About the sites you're monitoring
This is the most important section of this policy. The sites you add may belong to you or to your clients; page content may contain third-party information. Our principles:
- Target sites are fetched only to run the checks you configure, at a strictly limited rate, with an identifiable User-Agent.
- Page content is used only for the checks you configure (keywords, content watch, page error detection, resource check). Uptime probes do not store page bodies; content watch stores only the value you picked and its change snapshots.
- We do not analyze, aggregate, sell, or share content from your sites with any third party.
- You are responsible for making sure you may run monitoring on the sites you add.
5. Retention
| Data | Retention |
|---|---|
| Account and configuration | For the life of the account; cleared within 30 days after account deletion |
| Per-check details | 30 days, then rolled up into daily summaries kept long-term |
| Incident history, alert delivery log | Kept long-term for history |
| Content watch snapshots | Per your settings; keeps the latest changes by default |
| Raw traffic analytics events | 30 days, then aggregated into daily summaries kept long-term |
| Deleted sites | Trash for 30 days, then purged (including all related data) |
| Server access logs | Up to 30 days |
| Audit log | 1 years |
6. Sharing and third parties
We never sell your information. We share only in these cases:
- On your instructions: delivering alerts to your configured DingTalk, webhook, or email; those recipients process data under their own policies.
- Service providers: vendors who provide server hosting (the Hong Kong datacenter) and email delivery (Alibaba Cloud enterprise email) for us; they may process data only to the extent needed to provide their service.
- Site tools: when you actively query Baidu indexing, keyword rankings, and similar, the target domain is sent to the corresponding third-party data API. These features are off by default.
- Legal requirements: when required by law, regulation, or a competent authority. We will notify you to the extent the law allows.
- Business transfer: in a merger or acquisition we will notify you in advance and require the recipient to keep honoring this policy.
7. Where it lives and how it's protected
Data is stored in a Hong Kong datacenter. All transport is HTTPS. Passwords are stored as bcrypt hashes; third-party credentials you configure (DingTalk secrets, SMTP passwords) are stored encrypted and masked in the UI. Each tenant's data is isolated at the database level, verified record by record by automated tests. Platform operators may view your configuration and monitoring data to provide support — read-only and audit-logged.
No system is absolutely secure. If a security event affects your data, we will notify you within 72 hours of confirmation.
8. Your rights
- Access and correction: most information can be viewed and edited right in the console.
- Export: contact us for a machine-readable copy of your configuration and monitoring data.
- Deletion: delete sites and members in the console, or contact us to delete the whole account. Except where the law requires retention.
- Withdraw consent: disable any notification channel or delete configured third-party credentials anytime.
- Complaints: if you disagree with how we handle data, contact us first; you may also complain to your local data-protection authority.
We respond to requests within 30 days and may need to verify your identity.
9. Cookies
The console uses an essential session cookie and a theme-preference cookie; the website stores no cookies or settings beyond that. See the cookie policy.
10. Minors
The service is aimed at site owners and teams, not people under 18. If we find we have inadvertently collected a minor's information, we delete it as soon as possible.
11. Changes
We may update this policy. Material changes will be announced at least 14 days ahead via inbox or email, with the update date shown at the top.
12. Contact
Any privacy questions or requests: support@my.webchecks.site.