Loading IndexHaven…
IndexHaven · Trust & transparency
Effective date: 12 October 2026
How information moves through IndexHaven, what we use it for, and the choices available to you.
Questions or requests: contact@codeupp.xyz.
This policy describes how IndexHaven handles information when you visit the website, create an account, monitor websites, receive emails, use public tools or contact support. For privacy questions or requests, contact the IndexHaven service team at contact@codeupp.xyz.
If you monitor a client's website or invite colleagues, you are responsible for the permissions and notices required for your use. Other organisations' websites and services have their own privacy practices. This policy does not replace the information they provide.
When you register, we receive your first and last name and email address. We store your name as the account display name, email-verification status, account identifiers, creation timestamps and the version and time of accepted signup terms. Existing accounts may predate these consent records; we do not backdate acceptance.
If you choose a password, the authentication system stores a password hash rather than a readable password. Passwordless links, verification tokens and reset tokens enable account access or changes and expire. Session identifiers and timestamps let us keep you signed in and revoke access when appropriate. Do not share passwords or authentication links with support.
We store workspace names, memberships, roles, verified hostnames, domain verification records, monitored URLs, schedules, settings, baselines, incidents and relevant audit events. Scans may record server responses, redirect destinations, page titles, headings, descriptions, crawler directives, canonicals, robots.txt content, sitemap information and certificate expiry. Even publicly accessible page content can contain personal information.
Avoid submitting sensitive information, authentication tokens in URLs, private documents or pages containing personal data you are not authorised to share. We inspect server HTML for supported checks; the standard scanner does not execute website JavaScript. Public tools process submitted URLs to produce requested results and apply safeguards and usage limits.
Stripe processes payments and may receive payment details directly from you. We receive identifiers and billing information needed to recognise purchases, apply plan entitlements, show billing status and connect you to invoices or the billing portal. We do not store full card numbers or card security codes.
Support correspondence includes the contact details and information you choose to send. Infrastructure and application records can include request times, technical errors, browser or request information, network addresses, security events and rate-limit records. We use aggregate service counts to understand operation and usage. Do not include passwords, payment-card details or confidential client material in support messages.
We use information to create and secure accounts, verify control of websites, run requested checks, compare evidence, manage workspaces, deliver selected alerts, prepare requested reports, process billing, provide support and maintain the service. Security and usage controls help prevent spam, fraud, quota abuse and unauthorised access.
Where data-protection law requires a legal basis, relevant bases may include performing the service contract, legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. Agreement to the service terms is not blanket permission for unrelated marketing. We do not use the required signup checkbox to enrol you in marketing emails.
Essential authentication cookies maintain sign-in sessions and help protect account requests. Session cookies are configured for HTTP-only access and, on the HTTPS service, secure transmission. The application may use browser state for interface preferences and interaction state.
You can clear or block cookies in your browser, but sign-in and protected features may stop working. The current service does not require advertising cookies to use monitoring. If optional tracking or marketing technologies are introduced, we will provide information and obtain consent where required before using them.
Resend delivers service emails, including sign-in links, email verification and password recovery. These emails are necessary for the authentication action you request. Alert preferences control supported monitoring notifications. Notification delivery can be affected by mail providers, suppression, rate limits and your inbox settings.
You can change monitoring email preferences in the dashboard. Turning off alerts does not prevent necessary account, security or billing communications. Password and sign-in emails contain sensitive links: only use links you requested, and keep access to your email account secure.
Service providers process information as needed to deliver hosting and infrastructure, transactional email through Resend, and checkout and billing through Stripe. These providers may have their own legal obligations and privacy notices. We aim to limit information sent to a provider to what its function requires. Public pages may also load media from external delivery networks, including CloudFront-hosted video. Those requests disclose technical connection information, such as your network address, to the media provider.
Workspace members can access information permitted by their role. People with an active report-sharing link may be able to view its contents, so distribute links carefully. We may disclose information when required by law, to respond to a valid legal request, or to protect rights, security and the service. We do not sell personal account information to advertisers.
Hosting, email, payment and support services may process information in countries different from yours. The location can depend on the selected infrastructure and a provider's operations. For example, an email provider's configured sending region does not necessarily describe every location in which that provider processes information.
Where cross-border transfer rules apply, appropriate contractual or other recognised safeguards must be used as required. Contact us for information about relevant processing arrangements; this notice does not claim a particular certification or guarantee that all information remains in a single country.
We keep account and workspace information while needed to provide the service, resolve requests, protect security and meet applicable obligations. History available through the product depends on the plan: currently seven days for Free, 30 days for Solo and 90 days for Growth and Unlimited Lifetime. A visible history window is not a promise that every associated audit, incident or backup record is erased on exactly the same date.
Removing a monitor or workspace can delete associated records from the active application. Account deletion requests can be sent to contact@codeupp.xyz. We may retain billing, legal and security records when necessary; backups may retain copies until their normal replacement. Expired authentication records are subject to cleanup. Active records, backups and legally required records can follow different deletion schedules.
We use access controls, verified-domain checks, protected authentication sessions, password hashing, encrypted HTTPS transport and request safeguards. Access is limited according to system roles and operating needs. No service or security measure can guarantee absolute protection; report suspected account compromise promptly.
You can update your profile, manage monitoring preferences, change your password, request a password link, sign out and use available workspace and sharing controls. Adding a password does not disable passwordless sign-in. A completed password reset revokes existing sessions; a password change can revoke other sessions.
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or to object to certain processing or withdraw consent. Some rights have exceptions. Email contact@codeupp.xyz with your request; we may need to verify your identity without asking for your password. We will respond within the requirements of applicable law and explain any lawful limitation.
You may also be entitled to complain to the relevant data-protection authority. The service is intended for adults aged 18 and over and is not designed to collect children's information. If you believe a child has supplied personal information, contact us so we can investigate and take appropriate action.
We may update this policy as the service or processing practices change. The effective date identifies the current version, and material changes will be communicated through appropriate service channels where required. Please review this notice periodically.
For questions about data, service providers, retention or your rights, email contact@codeupp.xyz. Include enough information to identify your account and request, but never send a password, sign-in token or full payment-card details.
Read our Terms and Conditions, Privacy Policy and security information.