Privacy

What we collect

• Waitlist. Your email address, the time you joined and whether you unsubscribed. We may email you about the relay and to ask whether you would pay for it. Every email has a one-click unsubscribe link.
• Account. If you sign in, your email address and when you signed up. To sign in you email us a one-time code, which expires after 15 minutes and is stored only as a hash. We read the sender address and the subject of that email and keep nothing else from it. Signing in never sends you email. You send us one.
• Session cookie. Signing in sets one cookie, cb_session, that keeps you signed in for 30 days. It is HttpOnly, Secure and SameSite=Lax. We store only a hash of it. Signing out deletes it. We set no other cookies.
• Activity log. For signed-in users it records five things, each with a timestamp: when you sign in, each checklist step you tick or untick (provider and step number), each change to your relay setup (creating or deleting a relay, setting or clearing a Slack webhook, turning browser alerts on or off), when you open your alerts, and each alert relayed to you (provider only). Nothing else. We count weekly active users from your own actions only, not from alerts we relay.
• Relay. Your relay addresses, an optional Slack incoming webhook URL, and the web push address your browser gives us if you turn on browser alerts. For each relayed alert we keep the provider, a short summary and the time. Summaries are deleted after 30 days. We never store the alert email itself. If AWS sends a verification email to your relay, we send its link to your browser alert or Slack.
• Pay commitments. If you commit, your email address, the exact sentence, the time and whether the address was verified. If you commit by email we keep nothing else from that email. We never collect payment details.
• Anonymous page counts. How many times each checklist page is viewed per day. The count is a number per page per day and nothing else. We do not store IP addresses.
• Cloudflare Web Analytics. A cookieless script from Cloudflare (static.cloudflareinsights.com) counts visits, pages and referrers. Cloudflare says it does not use cookies or fingerprinting to track visitors.

What we do not do

• We never sell or share your data.
• We use no ad pixels or tracking cookies. The only third party script is Cloudflare Web Analytics.
• We never ask for your cloud or API credentials.
• Checklist progress stays in your browser unless you sign in.

Deleting your data

Signed in? Use Delete my account on your account page. It removes your account, sessions, activity, checklist progress, relays, alert summaries, push devices, waitlist entry and pay commitment right away.

You can also email hello@capbrake.com from the address you used and we will delete it.

The site is hosted on Cloudflare, which processes requests to serve it.