Privacy policy
Draft for review. This policy covers the free check and the free watch as they run today. It is checked by a lawyer before paid plans start.
Who is responsible
The controller under the GDPR is the provider named in the legal notice. Write to support@ttlwatch.com with any question about your data.
The short version
- One cookie, and only when you sign in:
__Host-rw_session, which keeps you signed in. - No request logs. Your IP address is never stored. Abuse limits count requests per address in memory only, for at most 24 hours.
- We count visits with Umami, which we run ourselves: no cookie, your IP address is not stored, and the counts never go to anyone else. You can switch it off.
- No tracking pixels in mails, no advertising, and nothing in your browser loads from another site.
- The names you check without an account are kept for 24 hours, then deleted.
- If you sign in, we keep your email address, your settings and what you watch until you delete the account, which you can do yourself at any time.
What the free check processes
When you start a check, we process the domain or hostname you type and what we find about it: the certificates its servers send, its DNS records, its public certificate history and its security.txt. Domain names and certificates are not personal data in most cases; a name can be, for example when it contains a person's name. We need this to run the check and show its result (legal basis: our legitimate interest in offering the check, and yours in using it, Art. 6 (1) (f) GDPR).
To keep automated abuse out, your browser solves a small proof-of-work puzzle (ALTCHA, self-hosted, no third party, no cookie) before a check or a sign-in starts, and we count requests per IP address in memory (legal basis: our legitimate interest in protecting the service and the servers it connects to, Art. 6 (1) (f) GDPR). The address itself is never written to disk or to a log.
What the watch processes
To watch endpoints for you, we need an account (legal basis: the contract with you, Art. 6 (1) (b) GDPR):
- Your email address, your time zone (taken from your browser when you sign in, changeable) and your mail settings. The address is confirmed by the sign-in itself: we send nothing else to an address before its first sign-in.
- Sign-in requests: the address, a hash of the link and of the 6-digit code, and what you picked in a check. We never store the link or the code themselves, and there is no password.
- Sessions: a hash of the session id in the cookie, with when it was created and last used.
- What you watch: hostnames, ports and protocols, your settings for each, and what our checks found: the certificates served (public data), each check's outcome, findings and the renewal history read from Certificate Transparency.
- Mails we sent you: kind, time and the mail provider's message id, so nothing is sent twice and bounces can be matched. Not the content.
The account page has a download of everything we store about your account (JSON) and a button that deletes the account with everything above at once. Each alert and weekly report has a link that stops that kind of mail without signing in.
If you report an alert as wrong, the report (the finding, its evidence, your comment and your email address, so the answer can reach you) is mailed to the person who maintains the renewal rules (legal basis: the contract, and our legitimate interest in fixing wrong alerts, Art. 6 (1) (b) and (f) GDPR). For the operator's weekly overview we count events per day (for example sign-ins and alerts sent), without names or addresses.
Counting visits
To see how many people use this site and which links bring them here, we count visits with Umami, open-source software that runs on our own server at Hetzner. Your browser loads the counting script from this site and sends the counts only to this site; nothing is passed on to third parties, and no cookie is set.
With each page view your browser sends the address of the page, the page you came from (referrer), the page title, the browser's language and the screen size. Before anything is sent, a script on this site takes out the names and ids in the address (a check of a domain is counted as /check/:name, without the title), every query parameter except campaign tags such as utm_source (a ?via= code becomes utm_source), and everything after a #. Pages whose address carries a personal link (signing in, unsubscribing, reporting a wrong alert) are not counted at all. We also count when a few buttons are pressed (starting a check, asking for a sign-in link, watching hostnames, adding an endpoint), never with anything you typed.
From your IP address and your browser's identification, Umami works out country, region and city, browser, operating system and device type, and, with a secret key that changes every day, a pseudonymous visit id. The IP address itself is not stored, and a visit on another day cannot be linked to earlier ones. Nothing is stored on your device.
Legal basis: our legitimate interest in understanding how the site is used and improving it (Art. 6 (1) (f) GDPR). The counts are deleted automatically after 13 months. If your browser sends Do Not Track or Global Privacy Control, your visits are not counted.
How long we keep what
| Data | Kept |
|---|---|
| Account: email address, time zone, settings | until you delete the account |
| Watched endpoints and their settings | until you remove them or delete the account |
| Sign-in requests (hashed link and code) | until 24 hours after they expire |
| Sessions (hashed) | 30 days after the last use |
| Outcomes of single checks | 30 days |
| Findings (what a check found wrong) | while open; once closed, 365 days |
| Log of the mails we sent (kind and time, no content) | 90 days |
| Shared check results per host (so several accounts cause one connection an hour) | 1 hour |
| Check results (the name checked and what we found) | 24 hours |
| Names waiting for the Certificate Transparency search | until answered, at most 24 hours |
| Certificate Transparency results | 24 hours |
| Renewal information of the certificate authorities | until the certificate has expired, plus 7 days |
| Certificate details (public data: names, issuer, validity) | while a watched endpoint lists it, otherwise 30 days after we last saw the certificate |
| Used proof-of-work puzzles (no personal data) | until the puzzle expires, plus 1 hour |
| IP addresses, for abuse limits (in memory only) | 24 hours |
| Hostnames whose owners asked us not to connect | until the owner asks us to remove them |
| Encrypted backups of the database | 7 days |
| Visit counts (pseudonymous, without IP address) | 13 months |
The retention job deletes everything past its period once an hour; the visit counts are deleted daily by the counting server. Aggregate counts (for example, how many checks ran on a day) contain no names or addresses and are kept.
What this site stores in your browser
- The cookie
__Host-rw_session, only after you sign in: a random session id, valid for 30 days after your last visit, sent only to this site over HTTPS and not readable by scripts. Signing out deletes it. - One entry in your browser's local storage,
rw:mode, if you choose light or dark mode. It never leaves your browser. - One more entry,
umami.disabled, only if you switch off the counting of visits above. It never leaves your browser either.
Who our server talks to
Our server (never your browser) contacts these services:
- The hosts that are checked or watched, on the ports you name, and their DNS records, looked up through the resolvers of our hosting provider, Hetzner Online GmbH (Germany), which also hosts the server and keeps the encrypted backups in its object storage in Germany.
- Mail: Brevo (Sendinblue SAS, France) at
api.brevo.comsends our mails. It receives your email address and the content of each mail, and tells us when an address bounces or reports a mail as spam; we then stop mailing that address until you sign in again. - Certificate Transparency search:
crt.sh(operated by Sectigo) and, as a fallback, SSLMate's Cert Spotter API atapi.certspotter.com. They receive the domain names that are checked or watched. - The renewal information (ACME Renewal Information, RFC 9773) of the certificate authorities that publish it. They receive the public identifier of a certificate they issued:
acme-v02.api.letsencrypt.org(Let's Encrypt),dv.acme-v02.api.pki.goog(Google Trust Services),acme.zerossl.comandari.trust-provider.com(ZeroSSL),acme.sectigo.comandari.sectigo.com(Sectigo),acme.ssl.com(SSL.com),acme-api.actalis.com(Actalis).
Hetzner and Brevo process data on our behalf under data processing agreements (Art. 28 GDPR), in Germany and France. The other services receive only names and certificate identifiers, which are public; we ask them, as anyone may.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR), and the right to object to processing based on legitimate interests (Art. 21 GDPR). With an account, the download and the delete button on the account page do the first and the third yourself, at once. Check results without an account are deleted after 24 hours and we store nothing that links them to you, so we usually cannot find a check by person. You can also complain to a data protection authority, for example the one for North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).