Privacy Policy

1. Controller

The controller responsible for the processing of personal data is:

Heiko Stuhrmann, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany, email: heiko@uptimealien.de.

Further details can be found in the imprint.

A data protection officer has not been appointed, as the requirements of Art. 37 GDPR or § 38 BDSG are not met.

2. What data we process

When operating UptimeAlien, the following data is processed:

Account data: display name, email address, and password hash (Argon2id), as well as your membership in an organization.
Session data: an encrypted session cookie (sysmon_session) for authentication after login; a comparable session token for the mobile app.
Monitoring configuration: the check targets you create (URLs, hostnames, ports) and related settings.
Check results: status, response times, incidents, and history of the monitors you configure.
Error events: error messages, stack traces, tags, and context data of your applications sent via the ingest interface. These may contain personal data if it is part of an error message.
Notification channels & contacts: channel configuration (e.g. webhook URLs, tokens, email recipients) and notify contacts (label, email).
FCM token: Firebase Cloud Messaging token for the UptimeAlien Android app, if used.
Keys & tokens: ingest keys and session tokens (stored only as a hash) for using the API.
Log data: technical server logs (IP address, timestamp, HTTP method, user agent) for secure operation.

3. Legal basis

Processing is based on Art. 6 (1) (b) GDPR (performance of contract) for all data necessary to provide the service, and Art. 6 (1) (f) GDPR (legitimate interest) for server logs to ensure operation.

4. Cookies

UptimeAlien uses strictly necessary cookies only:

sysmon_session – encrypted session cookie for authentication after login. Necessary for operation.

No tracking, marketing, or analytics cookies are set.

Analytics (Umami)

For anonymous audience measurement we use Umami — privacy-friendly analytics software operated on our own infrastructure.

Umami records aggregated usage statistics such as pages viewed, referring page, approximate origin (country) and device type. It works without cookies and the data never leaves our own infrastructure. No personal user profiles are created and IP addresses are not stored — they only feed into an anonymous, daily-rotating hash and are then discarded.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offering in a needs-based, statistically informed way). As no information is stored on or read from your device, no consent under Section 25 TDDDG is required.

If you sign up for our newsletter via the form in the footer, we process your email address and — if you provide it — your name in order to send you the newsletter.

Sign-up uses a double opt-in process: you first receive a confirmation email and are only added to the mailing list after you confirm. Delivery runs on our Listmonk software operated on our own infrastructure; the data does not leave our hosting.

The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link at the bottom of every newsletter email. The withdrawal does not affect the lawfulness of processing carried out before it.

5. Disclosure to third parties

Data is only transmitted to third parties in the following cases:

Hosting: UptimeAlien is self-operated; the servers are located at the premises of the controller named in section 1 in Germany. There is no outsourcing to an external hosting provider and no third-country transfer. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).
DNS management (Bunny.net): For resolving our domain we use the authoritative name servers of BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. When you access our site, Bunny.net processes the DNS queries from your device (including IP address and requested hostname). Processing takes place within the EU (no third-country transfer). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in reliable and resilient domain resolution).
Polar (payment processing): When you take out a paid plan, your payment and billing data (name, email address, billing address, payment method) is transmitted to Polar Software, Inc., 548 Market Street, PMB 61301, San Francisco, CA 94104-5401, USA. Polar acts as the “Merchant of Record”, i.e. your contractual seller, and processes the payment under its own responsibility; UptimeAlien only receives status events (subscription active/cancelled/expired) and pseudonymous identifiers. The legal basis is Art. 6 (1) (b) GDPR. Transfer to the USA takes place on the basis of the EU-US Data Privacy Framework.
Google Firebase (FCM): When sending push notifications to the UptimeAlien Android app, the message content and FCM token are transmitted to servers of Google Ireland Ltd. / Google LLC. The legal basis is Art. 6 (1) (b) GDPR (performance of contract – delivery of the notifications you triggered). Transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and supplementary EU standard contractual clauses.
Email delivery (Strato): For system emails (verification, invitation, and notification emails) we use Strato AG, Otto-Ostrowski-Str. 7, 10249 Berlin, Germany. Your email address and the respective message content are transmitted. Processing takes place on servers in Germany (no third-country transfer). The legal basis is Art. 6 (1) (b) or (f) GDPR.
Newsletter delivery (Listmonk): We use the software Listmonk, operated on our own infrastructure, to send our newsletter. Your email address and, if provided, your name are processed exclusively on our own infrastructure in Germany and are not passed on to any further third parties.
Notification channels (user-configured): If you set up channels such as webhook, Discord, Slack, Telegram, ntfy, Gotify, MQTT, PagerDuty, or Opsgenie, UptimeAlien transmits notification content to the service you configured. You are responsible for these recipients and their data processing.

No further disclosure to third parties takes place.

6. Data processing (Art. 28 GDPR)

If you use UptimeAlien in the course of a business activity and thereby process personal data of third parties (e.g. in submitted error events or in monitoring targets), we are your processor within the meaning of Art. 28 GDPR in this respect. The corresponding data processing agreement becomes effective automatically upon your registration with UptimeAlien and applies for the duration of the contractual relationship; a separate signature is not required.

You can find the full agreement in the data processing agreement.

7. Retention period

Account data is stored until the account is deleted.
Monitoring configuration, check data, and error events are stored until deleted by the user or until the project or account is deleted.
Server logs are deleted after a maximum of 30 days.

8. Your rights

Under the GDPR you have the following rights:

Access to stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)

To exercise your rights, contact heiko@uptimealien.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority depends on your place of residence.

9. Data security

Transmission is exclusively encrypted via HTTPS (TLS). Passwords are stored exclusively as an Argon2id hash and are not readable by us. Access to administrative functions is limited to a small group of authorized persons.

10. Protection against abuse and spam

To protect our forms against automated attacks and spam, we use our own, data-minimising security measures. No data is transmitted to third parties and no personal data is stored permanently for this purpose. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of our service).