Privacy Policy

1. Two different things called "UptimeCove"

This distinction decides who is responsible for your data, so it comes first:

• The software. UptimeCove is an open-source project you download and deploy to your own Cloudflare account. It has no phone-home, no licence check and no telemetry. When you run it, you are the data controller for everything inside your instance — this policy cannot and does not speak for your deployment.
• This website (the marketing pages, the docs and the public demo). That's the only thing the sections below describe.

If you reached a status page hosted by some other company or person, they run that instance. Ask them for their privacy policy — not us.

2. What this website collects

Analytics: none

There is no Google Analytics, no Plausible, no PostHog, no Segment, no session recording and no advertising pixel anywhere on this site. Web fonts are self-hosted, so loading a page does not contact a font CDN either.

Cookies: one, and only if you log in

A single cookie named uc_session is set when an administrator signs in to a dashboard. It holds an opaque session identifier — no personal data is encoded in it. It isHttpOnly, SameSite=Lax, Secure in production, and expires after 7 days or when the session is revoked.

It is strictly necessary for authentication, is never used for tracking or profiling, and is never shared. Browsing the public pages sets no cookies at all, which is why you don't see a consent banner.

Server logs

This site is hosted on Cloudflare Workers. Like any web host, Cloudflare processes request metadata — IP address, user agent, timestamp, requested URL — to route traffic and block abuse. That processing is governed byCloudflare's privacy policy. We do not build profiles from it or retain it in our own database.

Third-party requests

The landing page embeds a GitHub star-count badge from img.shields.io. Loading that image discloses your IP address and user agent to shields.io, the same as any other remote image would. It sets no cookies. No other third-party resource is requested by this site.

The demo dashboard

/demo is populated with sample data and is read-only. Nothing you look at there is submitted, stored or associated with you.

3. What a self-hosted instance stores

Listed so you know exactly what lands in your own Cloudflare D1 database — and so self-hosters can write an accurate policy for their own users. All of it stays in your account.

• Monitors and check results — URLs, HTTP status codes, response times, failure reasons.
• Incidents and updates — open/close timestamps, causes, any notes an operator writes.
• Status page subscribers — the email address someone submits to receive updates, the page they subscribed to, a verification flag and the signup timestamp. This is the only genuinely personal data the software collects by design.
• Notification channel config — recipient addresses and webhook URLs for email, webhook, Slack and Discord alerts.
• Sessions and API keys — hashed credentials and expiry timestamps. Raw tokens are never stored; keys are kept as SHA-256 hashes.
• Audit log — which actor performed which administrative action, and when.
• Heartbeat pings — if you enable heartbeat (dead-man's-switch) monitoring, the source IP of each ping is recorded alongside its timestamp so you can tell which job checked in.

Check history is pruned automatically by a daily scheduled task, and expired sessions are deleted on the same run. Deleting a monitor or status page cascades to its related rows.

4. Outbound requests the software makes

Your instance reaches the network only to do the job you configured:

• The endpoints you asked it to monitor. Your monitor's requests carry whatever headers you configured, so the target host sees your Worker's traffic.
• Notification providers you set up — your own SMTP/email provider, Slack, Discord, or your webhook endpoint. Incident details are sent to them because that is the point of an alert.
• Certificate and DNS lookups for SSL-expiry and domain checks, where enabled.
• Cloudflare Workers AI, only if you bind the optional AI binding for incident summaries. The prompt is processed by Cloudflare, not by any other AI vendor, and the feature is inert when the binding is absent.

Nothing is ever sent to the maintainers of this project.

5. Legal bases and your rights

For this website, the processing above rests on legitimate interests (operating and securing a site) and, for the session cookie, on it being strictly necessary to deliver a service you explicitly requested by logging in. Subscriber emails in a self-hosted instance rest on the consent that person gave when subscribing.

If you're in the UK, EEA, Switzerland, California or a comparable jurisdiction, you have rights of access, rectification, erasure, restriction, portability and objection over personal data held about you. Because the data lives in the instance you or your provider operates:

• Using someone's status page? Contact whoever runs it. Unsubscribe links in their emails remove you immediately.
• Running your own instance? You can service those requests directly against your D1 database.
• Something about this website? Use the contact page.

We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as California defines those terms. There is nothing to opt out of.

6. Children

UptimeCove is a developer tool and isn't directed at children under 13 (or under 16 where local law sets that bar). We don't knowingly collect their data.

7. Security

Sessions and API keys are stored hashed, monitor URLs and redirect targets are validated to block requests to internal addresses, and the dashboard and write APIs sit behind authentication. No system is perfectly secure, and this project is young — thesecurity policydescribes the current scope and how to report a vulnerability privately.

If you deploy UptimeCove, treat ADMIN_TOKEN, .dev.vars and your remote D1/KV state as production secrets.

8. Changes

Material changes to this page will be reflected in the "last updated" date above. Because the site is open source, the full revision history is public in therepository — you can diff any change yourself rather than take our word for it.

This page describes how the software behaves and is written to be plain and accurate. It is not legal advice; if you deploy UptimeCove in a regulated setting, have your own counsel review your obligations.