1. Who this applies to
This policy covers the managed Stablemate service at stablemate.dev. The data controller is [operating entity and registered address — to be completed before launch]. You can reach us at [email protected].
If you self-host Stablemate, none of your data reaches us: your instance talks to your own database and your own email provider. You are the controller of it, and this policy does not apply.
2. What we collect, and why
Your account
- Email address — it is your login, and where alerts and account email go.
- Password — stored only as a bcrypt hash. We never hold your actual password and cannot recover it for you.
- Plan and billing state — which plan you are on, whether your email is verified, and whether a downgrade choice is pending.
Sign-in sessions
Every time you sign in we create a session record holding your IP address and your browser’s user-agent string, with the time it was created. It is what keeps you signed in, and it is our record of account access if something looks wrong.
The monitoring data you send us
- Project and monitor names, and the schedule you configure for each monitor.
- Every ping: when it arrived, the source IP address it came from, and optionally a duration your job reports.
- Error text your job reports. If a job pings us to say it failed, we store the message verbatim, truncated to 1,000 characters. We also email it to you in the alert.
- Incidents. When a monitor goes down we open an incident record, which keeps its own copy of that error text. Incidents are deliberately kept longer than raw pings, so your outage history survives.
- API keys. Only a SHA-256 hash and the last four characters are stored; the key itself is shown to you once and never again.
Names and error messages are free text that you control. Please don’t put personal data, customer identifiers or secrets in them — we store exactly what you send, and it will appear in alert emails.
Billing
Handled by Stripe. Card details go directly to Stripe and never touch our servers. We keep a local mirror of what Stripe tells us about you: its identifiers for your customer and subscription, the subscription’s status and renewal dates, a summary of each charge, and the brand and last four digits of the card — never a card number. That mirror is what decides which plan your account is on.
The waitlist
While sign-ups are capped, joining the waitlist stores your email address and nothing else — no account, no password, no session.
Operational data
- Server logs containing request metadata such as IP addresses, paths and timings, kept for a short period for debugging and abuse prevention.
- Error reports. When the application raises an unexpected error, a report is sent to our error-tracking provider. It can include the failing request’s URL and parameters, the IP address and browser, and a stack trace. Passwords, API keys, ping tokens and your session cookies are stripped out before it is sent.
Website analytics
We use Cloudflare Web Analytics to count page views and see which pages are popular. It is cookieless — it doesn’t set a cookie, doesn’t use fingerprinting, and can’t follow you across other sites. It is not tied to your account and cannot be linked back to who you are.
What we do not collect
No advertising, no tracking pixels, no cross-site tracking, no profiling and no automated decision-making. We do not buy data about you, and we never sell or share yours.
3. Cookies
Stablemate sets exactly two cookies, both first-party and both strictly necessary. There is no cookie banner because there is nothing here to consent to.
-
session_id— a signed, long-lived cookie holding the identifier of your sign-in session. It is what keeps you signed in. HTTP-only,SameSite=Lax, and marked secure over HTTPS. -
_stablemate_session— Rails’ own session cookie, used for the page you were heading to before signing in, one-off status messages, and cross-site request forgery protection.
Signing out deletes the session cookie and the session record behind it.
Cloudflare Web Analytics (above) sets no cookie of its own — that’s why it doesn’t change the count above or require a consent banner.
4. Our lawful bases (UK GDPR)
- Performance of a contract — running your account, receiving pings, sending alerts, taking payment.
- Legitimate interests — keeping the service secure and abuse-free (session IPs, ping source IPs, rate limiting), fixing errors, knowing when someone signs up, and understanding how the site is used via cookieless, non-tracking page-view analytics (Cloudflare Web Analytics).
- Legal obligation — keeping records of payments and tax for as long as the law requires.
We don’t rely on consent for anything, because we don’t do marketing email or any tracking that requires it — our page-view analytics is cookieless and can’t identify you.
5. How long we keep it
- Raw ping records: 90 days. A daily job prunes anything older. One nuance, so this is honest: a day’s pings are only pruned once that day’s uptime figure has been calculated, so pruning can lag a little rather than deleting data we haven’t summarised yet.
- Daily uptime figures: kept for as long as the monitor exists. These are counts of up and down seconds per monitor per day — the 90-day chart and the overall percentage are built from them.
- Incidents (including the copied error text): for the life of the monitor.
- Sessions: until you sign out, or the account is deleted.
- Waitlist entries: until sign-ups open and you have been invited, or until you ask us to remove yours — whichever is first. If you go on to create an account and later delete it, the waitlist entry goes too.
- Everything else: for the life of your account.
Deleting your account deletes everything
Account → Delete this account is self-serve, immediate and irreversible. It cancels any active subscription, then removes your user record, your sessions, your projects and monitors, and every ping, incident, uptime figure, alert record and API key belonging to them — plus any waitlist entry for the same email address. Nothing is soft-deleted and there is no recovery window.
The one thing we cannot delete for you is Stripe’s own copy: Stripe keeps its record of your customer and past payments to meet its legal and accounting obligations. Ask us and we will request deletion of whatever Stripe is able to remove.
6. Who else processes your data
We use a small number of providers to run the service. They act on our instructions, and none of them is allowed to use your data for their own purposes.
- Hetzner (Germany) — the servers and database. Everything above lives here at rest.
- Cloudflare — DNS, TLS and the proxy in front of the site, so it sees the metadata of every request, including IP addresses. It also provides our cookieless page-view analytics, described above.
- Stripe — payments and subscriptions. Receives your email address, card details (directly from you) and billing/tax location.
- Postmark — delivery of our email. Receives your email address and the contents of the message, which for a down alert includes the monitor’s name and any error text your job reported.
- Honeybadger — error reporting, as described in section 2.
- Slack — our own private team channel. So that we notice new customers, an automated message containing the email address is posted there when someone signs up or joins the waitlist. Nothing else about you is sent to Slack.
Some of these providers are based outside the UK. Where data is transferred, we rely on the safeguards those providers offer for international transfers — standard contractual clauses, the UK Addendum, or the UK extension to the EU–US Data Privacy Framework as applicable.
7. Security
- Everything is served over HTTPS.
- Passwords are bcrypt-hashed; API keys are stored only as SHA-256 digests; ping tokens are random secrets.
- Session cookies are signed and HTTP-only, so page scripts can’t read them.
- Sign-in, sign-up, password reset and the public ping endpoint are all rate-limited, and an unknown token gets the same blank answer as a wrong one.
- Access to the production database is limited to the people who operate the service.
No system is perfectly secure. If you find a vulnerability, please email [email protected] before disclosing it publicly.
8. Your rights
Under UK data protection law you can ask us to do the following, free of charge, and we will respond within one month.
- Access — a copy of the data we hold about you. You can also pull your monitors yourself at any time through the API with a project API key; email us for anything beyond that.
- Rectification — correct anything wrong. You can change your password on your account page. Changing your email address is not yet self-serve: email [email protected] from the address on the account and we will change it for you.
- Erasure — self-serve, from Account → Delete this account. If you only joined the waitlist, email us and we will remove your entry.
- Portability — ask us and we will send your account’s data in a machine-readable format.
- Restriction and objection — ask us to pause or stop a particular use of your data.
If you think we have got something wrong, please tell us first — but you also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk. If you are in the EU, you may complain to your local supervisory authority instead.
9. Children
Stablemate is a developer tool, is not directed at children, and is not for anyone under 16.
10. Changes to this policy
If we change how we handle your data, we will update this page and its “last updated” date, and email you before anything material takes effect.
11. Contact
[email protected] — for any question, request or complaint about your data.