// Legal

Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Uplyze ("we", "us", "our") collects, uses, and protects information about you when you use our domain monitoring service at uplyze.net ("Service").

The short version: We collect only what we need to run your account and deliver the monitoring service. We don't sell your data, we don't track your browsing, and we don't store your payment card details. We set exactly one cookie, and it only keeps you signed in.

1. Our Data Minimization Principle

We only collect personal data that is necessary to provide the Service. We do not collect data speculatively or for future use. When a piece of data is no longer needed, we delete it. This principle guides every decision about data in Uplyze.

2. What We Collect

Data	Why we collect it	Stored?
Email address	Account login, service notifications, subscription management via Stripe	YES
Password (bcrypt hash only)	Account authentication. Your actual password is never stored — only a one-way hash. It is not recoverable by us.	HASH ONLY
Domains you monitor	Required to perform the monitoring service you signed up for. This includes anything you configure for a monitor: the URLs of transaction-monitor steps and the names of your heartbeats.	YES
Check results & health scores	Displaying your monitoring history and powering alerts	YES
Alert destinations	Delivering notifications where you asked for them: your Telegram chat ID, and any Slack, Discord or custom webhook URL you enter in Settings	IF CONNECTED
Signup IP address	Abuse and trial-fraud prevention — one free trial is permitted per network, so we store the IP your account was created from and, separately, a truncated one-way hash of it to count trials per network. Administrative actions on your account (taken by us) are also logged with the acting IP.	YES
Two-factor secret & recovery codes	Only if you enable two-factor authentication. The TOTP secret is stored encrypted (AES-256-GCM); recovery codes are stored as one-way hashes, so we cannot read either back.	IF ENABLED
Subscription & billing status	Enforcing plan limits and managing renewals	YES
Marketing-page event counts	Measuring whether our own landing page works: a page-view count, and which button was clicked. Sent to our own server, from our own domain. No cookie, no identifier, no account link, no referrer, no device fingerprint — see section 9.	AGGREGATE ONLY

We do not ask for a phone number. Earlier versions of this policy listed one as a backup recovery contact; the field does not exist in the product and never collected anything, so it has been removed rather than left as a claim about data we hold.

3. What We Do NOT Collect

To be explicit about what is out of scope:

No payment card data — all billing is processed by Stripe. We never see or store your card number, expiry, or CVV.
No phone number — we never ask for one, and there is nowhere in the product to enter one.
No browsing history — we do not track what websites you visit outside of Uplyze.
No physical address — we do not ask for or store your home or business address.
No government ID — we do not require identity verification documents.
No behavioral profiling — we do not build profiles of your behavior for advertising purposes.
No third-party tracking scripts — there are no Google Analytics, Meta Pixel, or similar trackers on Uplyze pages. The only measurement anywhere on this site is the first-party, cookie-free event count described in sections 2 and 9, which is sent to our own server and never to anyone else.
No cross-site or advertising cookies — the single cookie we set cannot be read by any other site (see section 9).

4. How We Use Your Data

Service operation: Running domain checks on your behalf, calculating health scores, delivering alerts
Account authentication: Verifying your identity when you log in
Service notifications: Sending you alerts about domain issues, subscription renewals, or important service updates
Billing: Sharing your email and subscription status with Stripe to process payments and manage your plan
Account recovery: Sending a reset link or verification code to your email address — the only recovery channel we have
Security & abuse prevention: Detecting unauthorized access attempts and enforcing one trial per person, email address and network, using the signup IP address described in section 2
Measuring our own marketing: Counting page views and button clicks on the public pages, in aggregate and without any identifier, so we can tell whether the landing page works

We do not use your data for advertising, third-party profiling, or sale to any party.

5. Proxy Infrastructure and Domain Checks

When you set up monitoring, Uplyze sends automated HTTP requests to your configured domains through our residential and mobile proxy infrastructure (provided by Thordata). This is purely functional — the requests are identical to what a browser would send when loading a URL.

No personal data about you is passed to Thordata. The only information transmitted through their infrastructure is the domain URL being checked and the result of the HTTP request. Thordata does not receive your email, phone number, or account details.

6. Data Retention

Active account data (email, hashed password, alert destinations, plan state): retained while your account is active, and for 30 days after account deletion
Domain check results: per-check raw logs retained for 90 days; daily uptime summaries retained for 12 months, then deleted; aggregated statistics retained while the account is active
Signup IP address: retained with the account. The separate per-network trial counter is a truncated one-way hash and is kept so a used trial cannot be silently repeated
Session cookie: the refresh cookie described in section 9 expires 30 days after it is issued, and signing out invalidates it immediately
Marketing-page event counts: retained as aggregate counts. They contain no cookie, account id or other identifier, so there is nothing in them to link back to you or to delete on request
Billing records: retained for 7 years as required by financial regulations (held by Stripe)
Deleted accounts: all personal data is purged within 30 days of deletion request

7. Third-Party Services

We use a small number of third-party services to operate Uplyze:

Stripe (billing) — processes subscription payments. Receives your email address and subscription plan. Does not receive your monitoring data. Subject to Stripe's Privacy Policy.
Thordata (proxy infrastructure) — provides the residential and mobile IP network used for domain checks. Does not receive any personal data about you. Only the domain URLs being checked are routed through their network.
Telegram — if you connect Telegram alerts, your Telegram chat ID is stored and used to send notifications via the Telegram Bot API. Subject to Telegram's Privacy Policy.

8. Data Security

We implement appropriate technical safeguards to protect your data:

Passwords stored as bcrypt hashes — never in plaintext, never recoverable
All connections encrypted via TLS/HTTPS
Database access restricted to internal service components only
Regular security reviews of access controls and infrastructure

No system is completely impenetrable. We cannot guarantee absolute security. We encourage you to use a strong, unique password for your Uplyze account.

9. Cookies, Local Storage and Session Handling

An earlier version of this section said the session token is a JWT in localStorage and that we set no cookies. Both statements were wrong about our own product, so here is exactly what happens in your browser.

One cookie, and it is strictly necessary. When you sign in, we set a single cookie named uplyze_refresh. It holds a random session token — not your password, not your email, nothing readable about you — and its only job is to let you stay signed in and get a fresh access token without typing your password again. It is set with:

HttpOnly — JavaScript cannot read it, on our pages or anyone else's;
Secure — it is only ever sent over HTTPS;
SameSite=Strict — browsers refuse to send it on requests originating from any other site, which is why it cannot be used to follow you anywhere;
Path=/api/auth — it is attached only to authentication requests, not to every page load;
a 30-day lifetime, and signing out invalidates it on the server as well as clearing it.

Under EU rules this is a strictly necessary cookie: without it you would be signed out on every page load. It is not used for analytics, advertising or profiling, and there is no consent banner because there is nothing here that consent would apply to.

The access token is not stored at all. The short-lived token used to authorise API calls is kept in memory in the open tab and disappears when you close it. It is not written to localStorage, sessionStorage or a cookie.

Local storage holds preferences only. The dashboard remembers how you like it set up — nothing more, and nothing that identifies you: your interface language, light/dark theme, casual/pro interface mode, which dashboard tab and tab order you last used, whether you have finished the onboarding tour, and which domain you last looked at on the World Map. You can clear all of it at any time from your browser settings; you will only lose those preferences.

Public pages set no cookies. The landing page, this Privacy Policy and the Terms of Service set no cookies and read none. They do send one first-party measurement request to our own server — a page-view count on load, and which button was clicked if you click a call-to-action. That request is sent without cookies, carries no identifier, no referrer and no device or browser fingerprint, and goes to no one but us. There is no third-party analytics, advertising or tracking script anywhere on this site.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Rectification: Ask us to correct inaccurate or incomplete data
Erasure: Request deletion of your account and all associated personal data
Portability: Receive your monitoring data in a machine-readable format
Objection: Object to specific processing activities where we rely on legitimate interest
Restriction: Ask us to restrict processing while a dispute is resolved

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing a request.

11. Children's Privacy

The Service is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.

12. International Users

The Service is operated from servers located in the EU. If you access Uplyze from outside the EU, your data may be processed in jurisdictions with different data protection standards. By using the Service, you consent to this transfer. We take appropriate contractual and technical measures to protect your data in all jurisdictions where it is processed.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes your acceptance of the updated Policy.

14. Contact

For privacy-related questions or to exercise your data rights: [email protected]

For general support: [email protected]

See also: Terms of Service · Contact Support