Privacy Policy
What we collect, why we collect it, who else sees it, and how long we keep it. No analytics, no ad trackers, no third-party scripts.
Last updated 16 August 2026
This document is not finished.
The operator's legal entity, address and jurisdiction are still placeholders. Fill them in at src/lib/legal.ts and have a lawyer review these documents before taking payments.
1. Two different relationships
This matters more than anything else on the page, because it decides who you should ask about your data.
- If you have a Feedfast account, we are the data controller for your account data. This policy applies to you directly.
- If you left feedback, voted, commented, or subscribed to a status page on a project hosted here, the customer who runs that project is the controller. We are their processor and act on their instructions. Ask them about your data first; we will help them respond.
In plain English: If you signed up here, talk to us. If you posted on someone's feedback board, talk to whoever runs that board — it is their data, we just store it for them.
2. What we collect from account holders
| Data | Why | Lawful basis |
|---|---|---|
| Email address | To identify your account, send sign-in links, uptime alerts and billing notices | Contract |
| Name and profile picture | Shown on your owner replies. Only if you sign in with Google or GitHub, or type a name | Contract |
| Timezone | So every date in the dashboard and in your alert emails is in your local time | Contract |
| Last active timestamp | Shown to you in Settings, and used to skip weekly digests for dormant accounts | Legitimate interests |
| Plan, subscription status and Creem customer ID | To apply your plan limits and manage billing | Contract |
| OAuth tokens, sessions and sign-in links | To keep you signed in. Magic-link tokens expire after 15 minutes | Contract |
| API keys | Only a SHA-256 hash, a short prefix and the last-used time. We cannot recover the key itself | Contract |
3. What we store on behalf of our customers
When someone uses a customer's public project page or embedded widget, we store what they submit so the customer can read it:
| Data | Where it comes from |
|---|---|
| Feedback posts and comments, with any name and email supplied | Typed into the public board or the embedded feedback modal — all optional |
| An external user ID, name and email | Passed by the customer's own application when the widget is embedded in their signed-in area, so their users do not have to retype anything |
| Votes, stored as an irreversible hash | Derived from an email address or external user ID if given, otherwise from a hash of IP address and browser user-agent. The raw IP is never stored |
| Status page subscriber email addresses | Entered on a status page, and confirmed by clicking a link in a double opt-in email |
In plain English: You can leave feedback without giving a name or email at all. If you do, an anonymous vote fingerprint is derived from your IP and browser and immediately hashed — we keep the hash, not the IP.
4. IP addresses
We use your IP address transiently, and do not store it in our database:
- to rate-limit public writes — feedback, votes, comments and status subscriptions — using a counter keyed by IP that is discarded after 60 seconds
- to rate-limit sign-in link requests, using the same mechanism over a 10-minute window
- to derive an anonymous vote fingerprint, which is hashed immediately so the same person cannot vote twice
Our hosting provider and reverse proxy keep standard server logs, including IP addresses, for security and troubleshooting.
5. What we deliberately do not do
- No analytics or product-telemetry service. We do not know which pages you visit.
- No advertising, no ad networks, no tracking pixels, no fingerprinting.
- No third-party scripts on the marketing site, dashboard or public project pages.
- No selling or renting personal data, ever.
- No using your content or your users' feedback to train machine-learning models.
The embedded widget on a customer's site loads one script from us and fetches one public JSON document. It sets no cookies and sends us no information about the visitor unless they actually submit feedback.
6. Who else processes your data
We use a small number of sub-processors. Each one gets only what it needs to do its job.
| Provider | What for | What they get | Region |
|---|---|---|---|
| Hostinger | Hosting for the application, database and job queue | Everything stored by the service | EU |
| Resend | Transactional email — sign-in links, uptime alerts, subscriber notifications | Recipient email address and message content | EU / US |
| Creem.io | Payment processing and invoicing, as merchant of record | Billing email, payment details, transaction records | EU / US |
| Optional sign-in with Google | Email address, name, profile picture — only if you choose this method | US | |
| GitHub | Optional sign-in with GitHub | Email address, name, profile picture — only if you choose this method | US |
Where a provider is outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision. We will update this list before adding a new sub-processor that handles personal data.
We may also disclose data where the law requires it, or to establish or defend legal claims.
7. How long we keep things
| Data | Kept for |
|---|---|
| Account and project data | Until you delete the project or your account |
| Uptime check history | 30 days on Free, 90 days on Pro — trimmed automatically every night |
| Sessions | 30 days, or until you sign out |
| Sign-in links | 15 minutes, single use |
| Rate-limit counters | 60 seconds for public writes, 10 minutes for sign-in link requests |
| Billing records | As long as tax and accounting law requires, typically several years |
| Feedback, comments and subscribers | Until the customer deletes them or closes the project |
Deleting your account cascades: projects, changelog entries, feedback boards, monitors, check history, subscribers and API keys all go with it. It cannot be undone.
8. Security
- Everything is served over HTTPS.
- Passwords do not exist here — sign-in is a one-time link or an OAuth provider, so there is no password of yours for us to lose.
- API keys are stored only as SHA-256 hashes, and compared in constant time.
- Widget identity signatures are verified with HMAC-SHA256 when a project enables it.
- Payment card details never reach our servers; checkout is hosted by Creem.io.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.
9. Your rights
If the GDPR or UK GDPR applies to you, you have the right to access your data, correct it, delete it, get a portable copy, restrict or object to processing, and withdraw consent where processing relies on it.
Most of these you can exercise yourself: Settings shows and edits your account data, and deletes it. For anything else, email [email protected] and we will respond within one month.
You can also complain to your local data protection authority. We would rather you told us first so we can fix it.
Every subscriber email carries a one-click unsubscribe link, and status subscriptions are double opt-in, so nobody receives mail they did not confirm.
10. Children
Feedfast is a tool for people running software projects and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email [email protected] and we will delete it.
11. Cookies
We set five cookies, all of them strictly necessary or functional, and none for advertising. The Cookie Policy lists every one by name, along with the browser storage we use.
12. Changes and contact
If we change this policy materially, we will email account holders before it takes effect. The date at the top always reflects the current version.
Controller: [Your registered legal entity], [Your registered address]. Privacy contact: [email protected].