What we collect, what we never collect, and exactly who else touches it.
Last updated 7 September 2026
Account data: your email address, a hashed password (Argon2 — we never store the password itself), and your plan.
Monitoring data: the domains you ask us to watch, and the results of those checks — certificate expiry dates, HTTP status codes, DNS records and domain registration dates. All of this is public information about public infrastructure.
Delivery records: which alerts we sent, to which of your channels, and whether they were accepted.
Analytics: aggregate page views on public marketing pages via Plausible. No cookies and no cross-site tracking. Signed-in application pages are not analytics-tracked.
We do not ask for, receive or store credentials for the sites you monitor. IT Watch only ever makes the same unauthenticated requests any visitor could make: a TLS handshake, an HTTP GET, a DNS query and a public registration lookup.
We do not store card numbers. Payments go directly to Stripe.
We do not sell data, and we do not share it with advertisers.
These are the third parties that process data on our behalf:
| Processor | Purpose | What it receives |
|---|---|---|
| Amazon Web Services | Hosting and database (US East) | Application servers and the MySQL database holding your account and monitoring data. |
| Mailgun (Sinch) | Transactional email | Delivers alerts, sign-in links and password resets. Receives the recipient address and the message. |
| Stripe | Payments | Handles card details and subscriptions. We never see or store a card number. |
| Plausible Analytics | Website analytics | Aggregate page analytics on public pages only. No cookies, no cross-site tracking, no personal data. |
| rdap.org and TLD registries | Domain expiry lookups | Receives the domain names you ask us to monitor. No personal data is sent. |
Check results are kept for rolling historical context and are pruned as they age out of usefulness. Alert and delivery records are kept for the life of the account so you can audit what we told you and when.
Delete your account and we remove your account record, sites, monitors, alerts and delivery history. Aggregate analytics, which contain no personal data, are unaffected.
You can export your monitoring data at any time from the app, and request deletion of your account by emailing support@it-watch.com. If you are in the UK or EU, you have the right to access, correct, export and erase your personal data, and to object to processing.
Data is processed in the United States. Where personal data is transferred from the UK or EU, that transfer relies on the standard contractual clauses operated by the subprocessors listed above.
Questions about this policy: support@it-watch.com.