privacy

who I am

heartbeet is run by me, a sole proprietor in Norway, and I'm the data controller for the information described here. for anything privacy-related (access, deletion, questions) email hi@heartbeet.page.

what I collect

• when you sign in: your email address. if you use Google or GitHub instead of an email link, I also receive your name, profile image URL, and a stable account ID from that provider. I never see or store a password; sign-in is a one-time email link or an OAuth handshake.
• what you create in the app: your projects, the jobs you monitor and their tags, and the heartbeats they send (a timestamp, the job name, and any tags on the heartbeat). a heartbeat is only a liveness ping, so I do not receive the contents, payload, or output of your job. I also store your dashboards and their layout, your API keys (only as a hash; the secret is shown once and never stored in the clear), and any alert-recipient email addresses you add.
• automatically: the IP address a request comes from, plus timestamps, used for security, abuse-prevention, and rate-limiting. I keep operational logs of requests and of alert deliveries.
• if you subscribe to a paid plan: Lemon Squeezy sends me a customer ID, a subscription ID, the current period end, and the subscription status. I never receive your card number.
• cookies: a single session cookie that keeps you signed in. no advertising or analytics cookies, and no third-party trackers.

what I do with it

• run the service: store your jobs and configuration, learn each job's usual rhythm, and email you (or your chosen recipients) when a job goes silent.
• keep it secure and fair: IP and request logs for abuse-prevention and rate-limiting.
• manage paid subscriptions: the Lemon Squeezy fields above decide whether your account is on the backer or team plan.

legal basis (GDPR)

• performance of a contract: running the service you signed up for.
• legitimate interest: keeping the service secure, preventing abuse, and operational logging.
• consent: only where the law specifically requires it.

who I share it with

I use a small set of processors, and nothing else:

• Railway: hosting and the database, within the EEA.
• Resend: sending transactional and alert email, in the US, under standard contractual clauses.
• Lemon Squeezy: my merchant of record for paid subscriptions; at checkout they receive your email and billing details and process the payment.
• Google / GitHub: only if you choose to sign in with them.
• OpenAI: only if you use the snippet-language helper, and only the language name you type is sent; none of your monitoring data or personal data is involved.

I do not sell your data, I do not share it with advertisers, and I do not use it to train AI models.

where it lives

your account and monitoring data are stored within the EEA. email delivery (Resend) happens in the US under standard contractual clauses, and paid-plan billing is governed by Lemon Squeezy's own privacy terms.

how long I keep it

I keep your data for as long as your account exists. ask me to delete your account and I remove your projects, jobs, heartbeats, dashboards, API keys, and recipients; some records may be kept longer where the law requires it (for example, tax records held by Lemon Squeezy).

your rights

under the GDPR you can access, correct, export, or delete your data, and object to or restrict certain processing. email hi@heartbeet.page and I'll respond within 30 days. you can also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local authority.

security

traffic is served over HTTPS; API keys are stored only as hashes; sessions are short-lived; and access to the production database is limited. no system is perfectly secure, but I aim to notify you without undue delay if a breach affects your data.

children

heartbeet is a developer tool and isn't directed at anyone under 16. if I learn an account belongs to a child under 16, I'll close it.

changes

I'll update this notice when my processors, the law, or the product change; the date at the top always reflects the current version. this notice sits alongside my terms and refund policy.