Privacy Policy

Last updated: September 24, 2026

This policy explains what personal data Ontrail ("we", "us") collects when you use ontrail.dev, why we collect it, and the choices you have. We keep data collection to what the Service needs to work.

1. Data we collect

Account data

• Your email address and a securely hashed version of your password (we never store your password in plain text).
• Your settings, such as alert thresholds and, if you use it, your own SMTP server details. SMTP passwords are stored encrypted.

Data you add about your sites and clients

• Website URLs you monitor, and optionally client names, client email addresses, phone numbers and tags.

Monitoring data

• Results of our checks: uptime status, response times, SSL certificate expiry dates, performance scores, alerts and outage history.

Billing data

• If you upgrade to Pro, payment is handled by Lemon Squeezy. We never see or store your card details. We receive your subscription status, renewal date and a customer reference so we can activate your plan.

Technical data

• Standard server logs (such as IP address, browser type and request time) kept for security and troubleshooting.

2. How we use it

• To provide the Service: run checks, show your dashboard, publish your status pages, and send alerts and reports.
• To manage your account and subscription, and to send service emails such as password resets.
• To keep the Service secure and prevent abuse.

We do not sell your data, and we do not use it for advertising.

3. Your clients' data

When you add client details (such as a client's email address for monthly reports), you decide what to add and why. For that data, you act as the data controller and Ontrail processes it on your behalf, only to deliver the features you use. Please make sure you have the right to share it with us.

4. Cookies

We only use cookies that are necessary for the Service to work:

• a session cookie that keeps you logged in while you use the app;
• an optional "Remember me" cookie (30 days) if you choose it at login.

We do not use analytics, tracking or advertising cookies.

5. Service providers

We use a small number of trusted providers to run Ontrail. They only process data as needed to provide their service to us:

• DigitalOcean — hosting of our servers and database.
• Cloudflare — DNS, network security and content delivery.
• Resend — delivery of alert, report and account emails (unless you use your own SMTP server).
• Google PageSpeed Insights API — the URLs of your monitored sites are sent to Google to measure performance scores.
• Lemon Squeezy — payment processing and billing as our Merchant of Record.

Some of these providers may process data outside your country, including in the United States and the European Union, under appropriate safeguards.

6. Data retention

We keep your account data for as long as your account exists. Monitoring history is kept to show trends and outage history, and may be trimmed over time. When you delete your account, we delete your account, sites and monitoring data within 30 days, except where we must keep records for legal or accounting reasons.

7. Security

We use HTTPS everywhere, hash passwords, encrypt stored SMTP credentials, and limit access to our systems. No system is perfectly secure, but we take reasonable measures to protect your data.

8. Your rights

Depending on where you live (for example under the GDPR or Türkiye's KVKK), you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us at [email protected]. You also have the right to lodge a complaint with your local data protection authority.

9. Changes

If we make significant changes to this policy, we will let you know by email or in the app before they take effect.

10. Contact

Questions about privacy? Email [email protected].