Privacy Policy

Overview

This policy explains what CuliPulse (part of CuliOps) collects, why, and what you can do about it. Questions: support@culipulse.dev.

What we collect

• Account information from your sign-in provider (Google or GitHub): your email, name, and provider account id.
• What you set up: your monitors, agents, heartbeats and reports, and the results of their checks.
• Where alerts go: the email address you signed in with (on by default for accounts created after email alerts launched; you can turn it off anytime), and the destinations you connect — a Telegram chat id, a Slack incoming-webhook address, or your own webhook address and its signing secret. Slack and webhook addresses and secrets are encrypted at rest.
• API tokens you create. We keep only a hash of each token, never the token itself.
• If you buy a paid plan: your Polar customer and subscription identifiers, and your subscription's plan, status and renewal date. Card details go to Polar, never to us.
• Logs and error reports needed to operate and secure the Service (see below).

How we use it

To run the Service, perform the checks you set up, send the alerts you request, keep the Service secure, and improve it. We don't use your data for advertising.

Sharing & subprocessors

We don't sell your personal data. We share it only with providers that help us run the Service:

• Cloudflare — hosting, database, request logs, and sending email alerts.
• OVH — servers in Singapore, Germany (Frankfurt) and Canada (Montreal) that run CuliPulse's own checking agents. They receive the monitor settings needed to run your checks, including credentials you saved on a monitor.
• Sentry — error reports from the web app, the service and our own checking agents.
• Polar.sh — sells our paid plans as merchant of record. When you start a checkout we send Polar your email address and account id; Polar collects your payment details itself.
• Telegram and Slack — only to deliver alerts to the destinations you connect.
• Google and GitHub — sign-in; Google also hosts our support email.
• Google Analytics — website and docs analytics, plus counts of sign-ups, new monitors and checkouts in the console, only with your consent where required.

Each processes data on our behalf or as you direct.

Error reports

When something breaks, the web app, the service and our own checking agents send an error report to Sentry so we can find and fix the bug. Error reports can include a short list of the network requests made just before the error. In that list we drop query strings and link tokens from addresses on our own site, and for any other address we keep only the domain, and we replace that too unless it belongs to us or to a well-known service such as Slack or Telegram. That means a webhook address you connected doesn't end up in an error report.

Data retention

The console shows 30 days, 1 year or 2 years of monitoring history, depending on your plan. Older monitoring data is not yet deleted automatically; if you want it removed, email support@culipulse.dev and we'll delete it. Account data is kept while your account is active and deleted within a reasonable period after you close it or ask us to.

Security

Data is encrypted in transit. Sensitive values such as monitor credentials and webhook secrets are encrypted at rest, and agent and API tokens are stored only as hashes. No system is perfectly secure, but we take reasonable measures to protect your data. Details: Security.

Your rights

You can access, correct, or delete your data — email support@culipulse.dev and we'll help. Depending on where you live, you may have additional rights under local law.

Cookies

We use two essential cookies: __Host-cp_session keeps you signed in, and __Host-cp_oauth lasts at most 10 minutes while you sign in with Google or GitHub. On our public website and docs we use Google Analytics to understand which pages help people find CuliPulse, and to count sign-ups. Visitors from the EU, the UK and Switzerland are asked first, and nothing loads unless you accept; everyone can change their choice with "Cookie settings" in the footer. Your choice is stored in a cp_consent cookie for up to 6 months. Google Analytics sets its own cookies (_ga, _ga_*) and processes your IP address and browser details; we don't use advertising features or sell data. Inside the console we only record that a sign-up, a new monitor or a checkout happened — never what you monitor.

International transfers

CuliPulse runs on global infrastructure, so your data may be processed in countries other than your own. We rely on our providers' safeguards for such transfers.

Children

CuliPulse isn't directed at children under 16 and we don't knowingly collect their data.

Changes

We may update this policy; we'll change the date above and, for material changes, notify you where appropriate.

Contact

Privacy questions? Email support@culipulse.dev.