Privacy Policy

Owl Keeper is a monitoring service. To do its job it has to keep two things: enough about you to let you back into your account, and a record of what the sites you asked it to watch were doing. This page says what those are, how long they are kept, and what Owl Keeper deliberately does not collect.

Analytics

This marketing site loads Google Analytics 4, and only once you allow it. It is a script from Google that sets its own cookies and records which pages you visit, which site sent you here, roughly where in the world you are, and what kind of device and browser you are using. It is used to understand which pages bring people here and where they give up.

The application itself loads no analytics. Nothing inside your account — the sites you add, the monitors you create, what you click — is sent to an analytics service.

None of it is used for advertising. Nothing about you is sold or rented, and nothing is shared for marketing.

Public status pages carry no analytics. A link you send a client loads none at all — not ours, not Google's. Those are your client's visitors, not ours, and they are not measured.

Cookies

The cookie that makes a signed-in session work — a session cookie, kept longer if you tick "remember me" — is strictly necessary, which is why you are not asked to consent to it. Your light or dark theme preference is stored in your browser.

Google Analytics sets cookies of its own, and those are not strictly necessary, which is why you are asked before any of them are set. Until you say yes, Google's tag is held in a consent-denied state and writes nothing to your browser. Saying no changes nothing about how any of this works.

You can change your mind at any time with the Cookies link in the footer of this page, which brings the question back. Withdrawing is the same single click as agreeing was.

What is stored about you

• Your account. Your name, your email address and a one-way hash of your password. If you sign in with Google, the identifier Google gives your account instead of a password.
• Sign-in security. If you turn it on, your two-factor secret and your recovery codes. Secrets are stored encrypted.
• What you asked to be watched. The hostnames, URLs, ports and mail servers you add, along with their schedules and check settings.
• Where you asked to be told. Webhook addresses and their signing secrets, which are stored encrypted.
• Billing. If you subscribe, Stripe handles the payment. Owl Keeper keeps the Stripe customer and subscription identifiers and the brand and last four digits of the card, never the card number.

What is recorded about the sites you watch

• Check results. Whether each check answered, how long it took, and the response code or error. These are kept for 35 days and then deleted; a daily summary of uptime and average response time is kept beyond that so the long history bars survive.
• Public facts about your domains. Certificate details, domain registration and registrar data, nameservers, DNS records, mail authentication records, and the security-relevant headers your site returns. All of it is read from your own site or from public registries.
• Changes. A check that finds the same thing as yesterday records nothing. Only changes are written down.

Owl Keeper does not store the body of your pages. It reads a response to answer the question you set — a status code, or whether a keyword you chose is present — and keeps the answer, not the page.

Requests made on your behalf

When you add something to be watched, Owl Keeper makes requests to it on the schedule you set, identifying itself in the User-Agent header as OwlKeeper/1.0 (+https://next.owlkeeper.com). Uptime checks are made from three places — Ohio, Frankfurt and Singapore — on Amazon Web Services, so those requests appear in your own server logs from Amazon's addresses, which change. It also queries public sources to answer questions your site cannot: domain registry (RDAP) lookups and ordinary DNS lookups. Only the hostname being checked is sent.

Email

Your email address is used to verify your account, to let you reset your password, and to send the alerts you have configured. There is no marketing email and no newsletter. Email is sent through a third-party email provider, which necessarily sees the address and the contents of the message.

If you write to us through the contact form, your name, address and message are emailed to us so that we can reply, and are not added to any list.

Public status pages

If you publish a status page, anyone holding the link can see what is on it: the hostname, whether services are answering, uptime figures, recent incidents, and when the certificate and registration renew. It never shows monitor names, addresses, or anything from the security checks. The link is unguessable and the page asks search engines not to index it, but it is not protected by a password — treat it as public. You can withdraw it or issue a new link at any time, which stops the old one working immediately.

Who else can see it

Everything you add belongs to your team, and is visible to the members of that team. Beyond that, your monitoring data is not shared with anyone. It is processed by the infrastructure providers that run the service — the server that hosts the application and its database, Amazon Web Services for the checks made from each region, Stripe for payments, and the email provider for outbound mail. They act on instructions and do not use it for their own purposes.

Google Analytics is the exception worth naming, because it is the only place where anything about you leaves for a company that is not simply running the service. Google receives what its script collects in your browser, on this marketing site only, and only if you allowed it; Google is a large advertising company and, while this property is not used for advertising, what Google does with data it collects is governed by its own terms rather than by this page.

Deleting your account

You can delete your account from your settings. Doing so removes your account and the monitoring data belonging to it. Some records may persist briefly in encrypted backups before those are rotated out.

Your rights

You can see and correct your account details in the application at any time, export or request a copy of what is held about you, and delete it. If you are in the UK or the European Economic Area you also have the right to object to processing and to complain to your national data protection authority.

Changes

If this policy changes in a way that materially affects what is collected or who can see it, the date at the top of this page will change and you will be told by email before it takes effect.