Legal

Privacy policy

Last updated: September 2026. Short version: we store what we need to run monitoring, billing, and alerts — nothing more.

Who we are

Lopingo (“we”) provides HTTP uptime monitoring as a hosted service. Contact for privacy requests: use the email on your account or the contact listed on the site when available.

Data we process

• Account — email, password hash, confirmation / reset tokens, login timestamps.
• Trial anti-abuse — an irreversible fingerprint (HMAC) of your email so a free trial cannot be claimed twice after account deletion. We do not store the email in that table; it cannot be reversed to recover your address.
• Workspace & monitors — names, URLs, check settings, pause state.
• Check results — status codes, latency, errors, incident history (retained for a limited period).
• Billing — subscription status and Stripe customer / subscription identifiers when billing is enabled (card data stays with Stripe).
• Alerts — notification outbox content and delivery status.
• Technical logs — minimal server logs for security and reliability.

Why we process it

To provide the service (contract), send operational emails (alerts, confirm / reset), improve reliability, and meet legal obligations (e.g. invoices / accounting when paid).

Sharing

We use processors such as hosting, email delivery (e.g. Mailgun), Stripe for payments, and error monitoring (Sentry) for reliability. Session replay in the app dashboard may capture masked UI interactions when an error occurs — passwords and form inputs are masked. We do not sell your personal data.

Retention

Account data lasts while your account exists. Check history is pruned on a schedule. You can delete your account from Settings; we then remove associated workspace data from our systems. A non-reversible trial fingerprint may be kept to prevent repeated free trials with the same email (legitimate interest in protecting the service from abuse). Paid subscription remains available.

Your rights (EU / similar)

Access, rectification, erasure, restriction, portability, and objection where applicable. Delete your account in-app or contact us.

Cookies

We use strictly necessary cookies only: the session cookie that keeps you signed in (HTTP-only, SameSite), plus CSRF tokens on forms. We do not set advertising, analytics, or third-party tracking cookies today, so we do not show a cookie consent banner. If we add non-essential tracking later, we will ask for consent first and update this page.

Analytics

We do not currently embed third-party web analytics (no Google Analytics / similar on marketing pages).

Security

Passwords are hashed. Sessions use HTTP-only cookies. Monitoring agents validate URLs to reduce SSRF risk. No method is perfect — report issues responsibly.

Changes

We may update this page; the date above will change. Continued use after material changes means you accept the updated policy where allowed by law.