Privacy Policy

Last updated: June 1, 2026

This Privacy Policy explains how pngr.dev (“pngr”, “we”, “us”), operated by Fine Ventures LLC, collects, uses, shares, and protects information when you use the pngr.dev website, web app, API, command-line tool, and MCP server (together, the “Service”). It applies to the data of account holders, organization members, and people you invite.

The short version. We collect the minimum needed to run a URL-monitoring service: who you are, the monitors, channels, and rules you configure, and the results of the checks we run on your behalf. We do not sell your data and we do not run advertising trackers. Credentials for your notification channels are encrypted at rest.

1. Information we collect

Account and identity

Email and password. Your email address, display name, and email-verification status. Passwords are never stored in the clear — only a bcrypt hash (cost factor ≥ 12).
OAuth identities. If you sign in with GitHub or Google, we receive and store the provider name, your provider user ID, your email, and your display name. We read those identity fields and nothing else from the provider.

Organization data

Organization name, slug, and logo URL; your role and membership; and the email addresses of people invited to an organization.

Monitoring configuration

Monitors. The URLs you ask us to check, plus the HTTP method, request headers, request body, and check conditions you configure.
Notification channels. Channel labels and type-specific delivery details — webhook URLs, bot tokens, chat IDs, recipient email addresses, and destination phone numbers. These credentials are encrypted at rest with AES-256-GCM.

You control what goes into monitor and channel configuration. Because request headers and bodies are stored as you enter them, avoid placing secrets you do not need to monitor, or other people’s personal data, into those fields.

Monitoring results

Check results — for each check we run: timestamp, status code, latency, a short excerpt of the response body, a pass/fail outcome, and failure reasons.
Incidents and their phase history (when a monitor opened, escalated, de-escalated, and resolved).
Notification logs — which alert was sent to which channel, when, and whether delivery succeeded.

Credentials and security data

API tokens (PATs). Stored as a hash, never the raw value, alongside a name, a short non-secret prefix for identification, and a last-used timestamp.
Session and refresh tokens needed to keep you signed in, and an audit log of organization-level changes.

Technical data

We process IP addresses for rate limiting, abuse prevention, and security, and basic request metadata in our server logs.

2. Cookies

We use strictly-necessary cookies only. These are an HttpOnly session (access) cookie and a long-lived HttpOnly refresh-token cookie set by our backend, a small non-HttpOnly session-hint cookie used to render the right signed-in/signed-out UI before the page paints, and a cookie that remembers your active organization. We do not use third-party advertising or analytics cookies. Because all of our cookies are essential to providing the Service, they cannot be turned off without breaking sign-in.

For aggregate traffic statistics — such as page views, referrers, and browser or device type — we use Cloudflare Web Analytics, a privacy-first service that is cookieless and collects no personal data. It stores nothing on your device and does not track you across sites or over time, which is why it requires no cookie-consent banner.

3. How we use your information

To provide, operate, and maintain the Service.
To authenticate you and keep your account and organizations secure.
To run the monitors you configure and deliver the alerts you ask for.
To send essential service communications — email verification, password resets, and security notices.
To enforce rate limits, prevent abuse, debug problems, and comply with legal obligations.

4. How we share information

We do not sell your personal data. We share it only with the service providers (“subprocessors”) needed to operate the Service, and only as required to do so:

Email delivery — Resend, to send verification, reset, and email-channel notifications.
SMS delivery — Twilio, to send SMS-channel notifications.
OAuth providers — GitHub and Google, only when you choose to sign in with or link those accounts.
Hosting and infrastructure — DigitalOcean, where the application and database run.
Notification destinations you configure — when an alert fires, we transmit incident details to the Slack, Microsoft Teams, Telegram, webhook, email, or SMS destinations you set up. You are responsible for those destinations and their own privacy practices.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Phone numbers you add as SMS destinations are used solely to deliver the alert notifications you configure (via Twilio, above) and are never sold, rented, or shared for marketing.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of pngr, our users, or the public.

5. Data retention

Check results are retained for 90 days (configurable) and then pruned.
Incidents and their phase history are retained indefinitely, so your historical reliability record survives beyond the check-results window.
Accounts and organizations are soft-deleted with a 30-day recovery window. After that window they are permanently deleted, and copies in routine backups age out on a rolling basis.
Audit logs are retained for a plan-dependent period — up to one year on the Team plan.

6. How we protect your data

HTTPS is enforced everywhere, with HSTS enabled. Passwords are hashed with bcrypt (cost ≥ 12). Notification-channel credentials are encrypted at rest with AES-256-GCM, and all secrets — including encryption keys — are supplied through environment variables, never committed to code or stored in the database in plaintext. We rate-limit authentication and API endpoints to deter abuse. No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard measures.

7. Your rights and choices

You can exercise the following directly in the Service:

Access and update your profile, email, and password from settings → profile.
Export your organization configuration as a YAML file via the API or the pngr dump command.
Link or unlink connected OAuth accounts, and revoke API tokens at any time.
Delete your account, subject to the 30-day recovery window described above.

Depending on where you live, you may also have rights under laws such as the GDPR/UK GDPR or the CCPA — including the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to lodge a complaint with a supervisory authority. We do not sell personal data. To make a request, contact us at the address below.

8. International data transfers

The Service is hosted in the United States (Atlanta — the DigitalOcean ATL1 region). If you access it from elsewhere, your information may be transferred to and processed in the United States under appropriate safeguards.

9. Children

The Service is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will provide a more prominent notice. Your continued use of the Service after an update means you accept the revised policy.

11. Contact us

Questions about this policy or your data? Email [email protected], or write to us at Fine Ventures LLC, 5900 Balcones Drive STE 100, Austin, Texas 78731.