Quietbeat stores what the product needs to monitor your systems and alert you. We do not sell personal data, and we run no advertising or analytics on private product pages. Optional Google Analytics runs only on selected public pages after your choice. This notice describes what is processed, by whom, and for how long.
1Who is responsible
MightyWorks s.r.o., established in Slovakia (EU), is the data controller for personal data processed by the Quietbeat service. Contact for all privacy matters: info@mightyworks.sk.
2What we process, and why
- Account data
- Your email address, session data, and — if you enable it — two-factor authentication secrets. Used to sign you in (magic links) and to send the alerts and account email you asked for. Legal basis: performance of our contract with you.
- Monitor configuration
- Names, URLs, schedules, and check rules you enter. Request headers and bodies you configure for probes are encrypted at rest, used only to run your checks, and never returned by any read. Basis: contract.
- Check and incident history
- Response codes, timings, up/down history, incident timelines and acknowledgements. That history is the product. Basis: contract.
- Incident evidence
- When an incident opens, Quietbeat captures evidence: a response snapshot (status, limited headers with cookies and authorization values stripped, the first bytes of the body), DNS answers, TLS expiry, and the response-time run-up. Heartbeat pings may carry a diagnostic payload you send (up to 10 KB), which is stored with the beat and shown with the incident. Basis: contract.
- Alert destinations
- Webhook URLs, chat IDs, and — for SMS, WhatsApp, and voice paging — phone numbers you connect. Channel configuration is encrypted at rest and never returned by any read. Basis: contract.
- Status page subscribers and feedback
- Email addresses that subscribe to a status page you publish (double-confirmed, with one-click unsubscribe), and feedback messages visitors submit through a status page's feedback box. Basis: consent of the subscriber; our legitimate interest in improving the beta for feedback.
- Web push subscriptions
- If you enable browser push, the push endpoint and keys your browser issues. Basis: consent.
- Mobile app crash reports
- When the store version of the Quietbeat mobile app crashes or meets an unexpected error, it sends a crash report to Google Firebase Crashlytics: the type of error and its stack trace (where in the app's code it happened), the device model, operating system version, app version, the device state at that moment (such as orientation and free memory), the time, and random installation identifiers. A report never contains the error message, your account or email address, monitor names or URLs, incident notes, or the server you paired with, and it is not linked to your identity. Used only to find and fix crashes. Basis: our legitimate interest in an app that works.
- Billing
- Payments are handled by Stripe. We store your plan, billing cycle, and a Stripe customer reference — never card numbers. Basis: contract and legal obligations.
- Technical and security logs
- IP addresses and request metadata, kept short-term for abuse prevention, rate limiting, security, and debugging. Sign-in and registration are additionally protected by Cloudflare Turnstile (see sections 4 and 5). Basis: legitimate interest in keeping the service secure.
3AI-assisted incident diagnosis
Quietbeat can produce an AI-generated hypothesis about an incident's cause. When this runs, a bounded evidence bundle — probe snapshots with cookie and authorization headers stripped, recent check history, deploy markers, TLS/DNS readings, and for heartbeat incidents a capped excerpt of the diagnostic payload you sent — is processed by Anthropic (our AI provider) to generate the hypothesis. The result is always labeled as a hypothesis in the product. Do not include personal data or secrets in heartbeat payloads; the docs describe how to sanitize them.
5Who processes data for us
- Hetzner Online GmbH — application hosting, the database, backups, and the checks we run from our own server; Falkenstein, Germany (EU).
- Stripe — payment processing.
- Resend — transactional email delivery (login links, alerts, reports).
- Google (Gmail SMTP) — standby email delivery if the primary provider fails.
- Cloudflare — DNS and reverse proxy for quietbeat.dev, so every request to quietbeat.dev passes through its network, which also briefly caches public status pages; and Turnstile bot protection on sign-in and registration. Status pages served on status.quietbeat.dev or on your own domain reach our server directly.
- Anthropic — AI incident diagnosis, as described in section 3.
- Google Firebase Cloud Messaging — mobile push, if you use the mobile app.
- Google Firebase Crashlytics — crash reports from the mobile app, as described in section 2.
- Google Analytics 4 — optional public-page visit measurement after consent.
- The alert and paging destinations you connect — for example Slack, Discord, Telegram, Microsoft Teams, PagerDuty, or a telephone carrier for SMS/voice — receive the alert content you route to them, by your configuration.
We add or replace processors only for the purposes above; material changes are announced as described in section 12.
6International transfers
The service, its database and its checks run in the EU, on servers in Falkenstein, Germany. Requests to quietbeat.dev pass through Cloudflare's network, which may handle them at a location outside the EU/EEA. Some processors listed above are US companies; where data reaches them outside the EU/EEA, the transfer relies on the safeguards in their data processing terms — EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
7How long we keep it
Account data is kept until you delete your account. Check history, heartbeat pings, and resolved incidents are pruned automatically per your plan's retention: 90 days on the free plan, 1 year on Solo and Team, 2 years on Business and Scale. Technical logs are short-lived. Firebase keeps mobile app crash reports for 90 days, then starts deleting them from its live and backup systems. Backups age out on a rolling basis. Billing records are retained as required by accounting law.
8Public status pages
Status pages and badges you publish are public by design: they expose the names, grouping, and up/down history of the monitors you place on them, to anyone with the link (unless you password-protect the page). You control what a page shows.
9Data from your monitored systems
Check results, evidence snapshots, and the diagnostic payloads you send with heartbeat pings originate in your systems and may contain personal data of your own users if you put it there. For that content, you are the controller and Quietbeat processes it on your behalf, only to provide the service. Send filtered, sanitized diagnostics — not full logs, secrets, or end-user data.
10Security
Traffic is encrypted in transit. Credentials you store with us — probe headers and bodies, alert channel configuration — are encrypted at rest; API tokens are stored only as hashes. Access to production systems is restricted. No service can promise absolute security, but the design goal throughout is that a leaked read never yields a usable secret.
11Your rights
Under the GDPR you can request access, rectification, erasure, portability, and restriction of — or object to — the processing of your personal data. Email info@mightyworks.sk and we will act within one month; account deletion removes your monitors, history, and channels with it. You can also lodge a complaint with your supervisory authority — in Slovakia, the Úrad na ochranu osobných údajov.
12Changes
If this policy changes materially, account holders receive an email before the change takes effect. The effective date above always identifies the current version.