Privacy policy.
Your data, explained.

Effective date: October 30, 2026. Last updated: October 30, 2026.

1. Who we are and how to contact us

Upty is the website, API and server monitoring service available through this website and its application. In this policy, “Upty,” “we” and “our” mean the team operating this service. This policy covers the Upty website, account and workspace features, monitoring backend, and support interactions.

For privacy questions, access or correction requests, or help deleting your information, email [email protected]. Signed-in users can also contact the Upty team through Support in their workspace. We may ask for information reasonably necessary to verify that a request relates to your account.

2. Information received when you sign in with Google

Google sign-in uses the openid, email and profile permissions. When you choose it, Google provides your Google account identifier, email address and verification status, display name, and profile picture URL when available. Upty stores the identifier, email, name and picture URL in your account so that it can recognize you on later visits and display your profile.

We use this information to authenticate you, create or link your Upty account, maintain your signed-in session, identify you within your workspace, and provide account and support functions. Your Google password is never provided to Upty. We do not request access to Gmail messages, Google Drive files, Google Calendar, contacts or other Google Workspace content. We do not request offline access to your Google account, and we do not store Google access or refresh tokens in the account database. OAuth tokens are used during the sign-in exchange.

Google authentication takes place on Google's services. If your Google profile image is displayed, your browser may request it from Google's image servers. Those requests and Google's own handling of information are governed by Google's Privacy Policy.

3. Other information Upty handles

• Account and workspace information: account preferences, workspace membership and roles, selected settings, and API key metadata. If password sign-in is available and you set a password, the service stores a password hash rather than a readable password.
• Monitoring configuration and results: URLs, domain names, IP addresses, ports, check intervals, rules, request options, response status and timing, certificate and DNS results, incident history, and other information necessary to run the monitors you configure. Monitor request headers or credentials are processed when you supply them.
• Submitted telemetry: host identifiers, host metrics, service attributes and application logs that you or your agents send to Upty. The contents depend on your configuration and may include personal information if you include it in those inputs.
• Communications and publishing: support ticket content, notification preferences and destinations, status-page settings, and information you choose to publish or share with workspace members.
• Technical and security information: IP addresses, request times, requested paths, browser or client information, authentication events and error records used to operate the website, investigate faults and prevent abuse.

Only submit monitoring targets and data you are authorized to use. Avoid placing passwords, access tokens, payment details or unnecessary personal information in application logs, URL query strings, public monitor names or support messages.

4. How we use information

We process information to provide the features you request: run checks, evaluate monitoring rules, show availability and performance history, receive telemetry, manage workspaces and status pages, and handle support requests. We also use operational records to protect accounts, enforce access controls, detect misuse, troubleshoot failures and maintain the service. Notification destinations are used for the notification features you configure when those features are available.

Google profile information is used for the account, authentication, workspace and support purposes described above. We do not sell personal information or Google user data, use Google user data for targeted advertising, or use it to train general-purpose artificial intelligence or machine-learning models.

5. Sharing and disclosure

Upty does not publish your Google account identifier or email address merely because you sign in. Your name, profile image and relevant account details may be visible to authorized members of workspaces you join and to Upty administrators supporting the service. Workspace owners and administrators control access within their workspace.

Our monitoring backend and infrastructure process account, configuration and telemetry data needed to operate Upty. Infrastructure providers may handle stored information or network traffic as part of hosting and maintaining the service. Google handles the authentication exchange. IPinfo receives monitored target IP addresses when the service looks up a target's geographic region to place checks; we do not send your Google profile to IPinfo.

If you enable an available external notification integration, we send the destination details and relevant alert content to that provider. Features that have not been enabled do not send data to their providers. Publishing a status page intentionally makes its selected names, status and history accessible to its audience; check its settings before publishing.

Access to information is limited to service operation and support. We may disclose information when reasonably necessary to comply with a legal obligation, respond to a valid legal request, or protect the security and rights of users and the service. We do not disclose Google user data to third parties for advertising, data brokerage or unrelated profiling.

6. Storage and security

Upty stores account and application information in its service databases, and monitoring data in its monitoring backend. We use HTTPS for connections to the website and API, authenticated sessions, workspace access controls, private service credentials and restricted administrative access. Sensitive monitoring configuration is masked in user-facing exports where applicable, and sensitive request-header values stored in the platform's monitor configuration are encrypted by the application. The monitoring backend also receives credentials needed to execute your checks; this protection does not mean all monitoring data is encrypted end to end. These controls reduce risk, but no method of transmission or storage can guarantee absolute security.

Information is processed on the infrastructure used to provide Upty. Google and other providers involved in a feature may process information in countries different from yours, subject to their own service arrangements and policies.

7. Cookies and browser storage

Upty uses cookies for sign-in sessions, the OAuth sign-in exchange, account security and administrator access. The regular account session cookie can last up to 14 days, unless you sign out or the session is invalidated sooner. Browser storage remembers interface preferences such as the selected theme. Google may set its own cookies while you use Google sign-in. Upty does not use Google sign-in data to create an advertising profile.

8. Retention

We keep your Google profile details and other account information while your account exists and they are needed to provide its features. Monitor configuration and workspace records remain while you use those features, unless you remove them. Submitted logs and metrics follow the monitoring project's retention settings; the current project default is 15 days. Availability of individual check history also depends on the relevant monitoring retention settings.

Operational and security logs rotate on the server's retention schedule. Limited audit records may remain after account deletion to preserve service integrity; the account deletion process removes the personal account link and IP address from associated audit events and clears user-authored audit details.

Database backups use a 30-day retention schedule with daily rotation. A backup created before deletion can contain an earlier copy of account data until it is rotated out; backups are used for recovery rather than ordinary account access. Information may be retained longer when necessary to meet a legal obligation or resolve an active security issue or dispute.

9. Access, export, correction and deletion

You can review your profile, monitor settings and preferences in your workspace. Google-supplied profile information is refreshed when you sign in with Google. In account settings, Export my data downloads an export of the account information and configuration covered by that feature; secrets and password hashes are excluded.

Use Delete my account in account settings and confirm your account email to request removal through the application. The process removes your account, associated monitors, status pages, keys and related application records, and requests cleanup of the associated hosts and submitted log services in the monitoring backend. If a required backend cleanup fails, the application reports an error so that deletion can be retried. Historical monitoring records may remain until backend cleanup runs or their retention period expires. Deletion does not retract information other people have already copied from a page you made public.

You can also request access, correction or deletion by emailing [email protected], including if you can no longer sign in. You may remove Upty's access through your Google Account connections. Removing a Google connection prevents future authorized access but does not itself delete the information already stored in your Upty account; use the deletion controls or contact us for that.

10. Google API Services User Data Policy

Upty's handling and transfer of information received from Google APIs follow the Google API Services User Data Policy, including its Limited Use requirements. We limit use of Google user data to the user-facing account and service functions described in this policy.

11. Changes to this policy

We update this page when our data practices change and revise the “Last updated” date. Material changes to how Google user data is accessed, used or shared will be communicated through the service or another appropriate account notice before the new use is introduced, with additional permission requested when required. Contact [email protected] if you have questions about this policy.