Privacy Policy

Last updated: 1 September 2026 GDPR + DPDP Compliant No Tracking Cookies

Data Controller
What We Collect & Why
Legal Basis for Processing
Third-Party Data Processors
Cookies & Local Storage
Data Retention Periods
International Data Transfers
Your Rights (GDPR / DPDP)
Children Privacy
Changes to This Policy
Contact Us

1. Data Controller

DownCheck ("we", "us", "our") operates downcheck.online. For purposes of GDPR (EU) 2016/679 and India's DPDP Act 2023, DownCheck is the Data Controller responsible for personal data processed when you use this website.

DownCheck is an independent third-party monitoring service. We are not affiliated with, endorsed by, or connected to any services we monitor. All service names and logos belong to their respective owners.

2. What We Collect & Why

DownCheck is designed around data minimisation. We collect only what is strictly necessary.

Data Type	What It Is	Purpose	Stored Where
Server Access Logs	IP address, request URL, HTTP status, User-Agent, timestamp	Security, abuse prevention, debugging	Railway infrastructure — auto-purged after 7 days
Outage Vote Counts	Integer counters (problem / fine) per service per day	Aggregate community outage reporting	SQLite database — counts only, never linked to you
Check History	Service slug, probe status, confidence score, Unix timestamp	Historical uptime chart on status pages	SQLite database — no personal identifiers stored
Theme Preference	Light or dark mode string in `localStorage`	Remembering your display preference	Your browser only — never sent to our servers

We do NOT collect: names, email addresses, passwords, payment information, device IDs, location data, or biometric data. No user accounts exist.

3. Legal Basis for Processing (GDPR Art. 6)

Legitimate Interests (Art. 6(1)(f)) — Server access logs are processed to protect the security and integrity of the service and prevent abuse. Logs are automatically purged within 7 days and contain no sensitive personal data.
Legitimate Interests (Art. 6(1)(f)) — Aggregate vote counts enable the community outage reporting feature. These are counters only — no individual is identifiable from stored data.
Strictly Necessary Function — The theme key in localStorage is a functional preference stored locally in your browser and never transmitted to our servers.

4. Third-Party Data Processors

Processor	Purpose	Data Transferred	Privacy Policy
Google LLC — Fonts API	Loading Inter and JetBrains Mono from `fonts.googleapis.com`	Your IP address and User-Agent sent to Google on font load	Google Privacy Policy
Google LLC — S2 Favicon API	Loading service brand logos via `google.com/s2/favicons`	Domain name being looked up and your IP sent to Google	Google Privacy Policy
Cloudflare, Inc.	Edge network probing (AS13335) in our uptime check methodology	Target domain and probe metadata — your IP is not involved (probes from our server)	Cloudflare Privacy
Railway Corp.	Cloud hosting for our Node.js server and SQLite database	All server-side data (logs, votes, check history) on Railway infrastructure (US)	Railway Privacy

We do not use Google Analytics, Meta Pixel, Hotjar, Mixpanel, or any behavioural analytics or advertising tracking tools.

5. Cookies & Local Storage

Cookies: We set zero first-party cookies.

localStorage (functional only): One key — theme — stores your display preference. It is never sent to our servers. Delete it via browser Settings → Site data → downcheck.online → Clear.

Third-party cookies: Google Fonts may set cookies per Google's cookie policy. Block fonts.googleapis.com in your browser to prevent this.

6. Data Retention Periods

Data	Retention Period	Deletion Method
Server access logs (IP, User-Agent)	7 days	Automatic rolling deletion on Railway
Vote counts (aggregate, non-personal)	Rolling daily totals retained indefinitely	Daily counts reset; totals kept for service metrics
Check history (probe results, timestamps)	96 records per service (~8 days)	Automatic FIFO pruning on insert
localStorage (theme preference)	Until you clear browser site data	Browser Settings → Site data → Clear

7. International Data Transfers

Our servers are hosted on Railway Corp. infrastructure in the United States. If you access DownCheck from the EEA, UK, or India, your server log data (IP address) is transferred to the US under Railway's Standard Contractual Clauses (SCCs). Google Fonts and S2 API transfers to Google are covered by Google's Data Processing Terms and SCCs.

8. Your Rights (GDPR / DPDP)

Depending on your jurisdiction, you have the following rights:

Right of AccessRequest a copy of personal data we hold (server logs associated with your IP).

Right to ErasureRequest deletion of your IP from server logs before the 7-day auto-purge.

Right to ObjectObject to processing based on legitimate interests.

Right to RestrictionRequest we restrict processing while a complaint is resolved.

Right to PortabilityReceive your personal data in a machine-readable format where feasible.

Right to ComplainLodge a complaint with your local DPA (ICO in UK, MeitY/DPB in India).

9. Children Privacy

DownCheck is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. Contact us to request deletion if you believe a child has provided data.

10. Changes to This Policy

We may update this Privacy Policy as our service evolves. Material changes will be reflected by an updated "Last updated" date above. Continued use of DownCheck constitutes acceptance of the updated policy.

11. Contact Us

For privacy questions, data subject requests, or complaints:

DownCheck — Data Controller

Email: privacy@downcheck.online

Website: downcheck.online

We aim to respond within 30 days as required by GDPR Article 12(3).