Privacy Policy

This policy explains what data OutageDeck collects when you visit outagedeck.com, use the JSON API, or purchase a subscription, and how that data is used. The Service is operated by Kerolos Atallah, doing business as OutageDeck; contact hello@outagedeck.com for anything privacy-related.

• Hosting logs. Our host (Vercel) keeps standard server logs (IP address, user agent, requested URL, and timestamp) used for security, abuse prevention, and debugging, and retained only briefly.
• Aggregate analytics. We use Vercel Web Analytics, a cookieless, privacy-friendly counter of page views. It builds no cross-site profiles and stores no identifiers in your browser.
• Optional campaign measurement. If you allow it, we record a narrow set of product actions: viewing the stack, clicking its free-alert or paid-plan link, and viewing the sign-in or pricing page. An event can include the campaign source, campaign label, page path, referrer host, and number of vendors selected. The event table stores no email address, user id, IP address, full referrer URL, or query string. Short-lived abuse-prevention keys are derived from an IP address with a secret hourly HMAC and cannot be compared across hours.
• API usage. For keyed API access we record the key used, request counts, and timestamps so we can enforce quotas.
• Purchase data. Checkout is operated by Paddle, our merchant of record. Paddle collects your name, email, billing country, and payment details under its own privacy policy. We receive your email address, plan, billing country, and subscription status, never your full card details.
• Account sign-in. Accounts are identified by email address. If you sign in with a one-time email link, we store the address you enter; if you sign in with GitHub or Google, the provider shares your verified email address with us and nothing else: no repositories, contacts, or files. Alongside the address we keep the sign-in method and, when present and only after you allow campaign measurement, the campaign or referrer that first brought you here, so we can tell which channels work. We use account emails to operate the Service and to send our own product updates you can opt out of. We never sell or share them for third-party marketing.
• Email. If you write to us, we keep the correspondence for as long as it stays relevant.

The site sets no cross-site tracking cookies. Aggregate page counts and performance measurements are cookieless. Campaign measurement is off until you choose Allow. If you allow it, we set od_attribution, a first-touch UTM/referrer cookie that expires after 180 days, plus a same-duration cookie holding only your Allow or Decline preference. Declining or withdrawing consent deletes the attribution cookie and stops future campaign events; the preference cookie remains so we do not ask on every page.

We use the data above to operate and secure the Service, enforce API quotas, provision subscriptions and provide support, meet tax and accounting obligations (via Paddle), understand which pages are useful in aggregate, and—only with consent—measure our own promotions. We do not sell personal data, and we do not share it with third parties for their marketing.

• Vercel: website hosting and CDN; logs may be processed in the US and EU.
• Supabase: our primary database, hosted in the EU (AWS eu-west-1, Ireland).
• Paddle: payment processing and billing records, as merchant of record.

Each processor handles only what it needs for its role. Beyond these, we disclose personal data only if the law requires it.

Hosting logs are rotated on our providers’ standard short schedules. Optional campaign action events and client-observed checkout funnel events are deleted after 90 days. Their pseudonymous hourly abuse-prevention counters are deleted after 48 hours. API usage data is kept in aggregate form. Billing records are retained for as long as tax and accounting rules require. Everything else is kept only as long as it is needed for the purpose it was collected for.

You can ask us to access, correct, export, or delete the personal data we hold about you, or object to how it is used, by emailing hello@outagedeck.com. If you are in the EU or UK, this includes your GDPR rights, and you may also lodge a complaint with your local supervisory authority. For data held by Paddle as merchant of record, we will help route your request or you can contact Paddle directly.

The Service is not directed at children under 16, and we do not knowingly collect their personal data.

When this policy changes, the “Last updated” date above changes with it, and material changes will be announced on the site. Questions? Email hello@outagedeck.com.