Last updated: November 6, 2026
DownBad by Future Vision Concepts, LLC
Effective Date: February 1, 2025
Last Updated: November 6, 2026
DownBad is a service owned and operated by Future Vision Concepts, LLC, an Ohio Limited Liability Company ("Company," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our uptime monitoring service at downbad.app (the "Service").
We are committed to protecting your privacy. As fellow indie developers, we understand the importance of data privacy and have designed our Service to collect only what's necessary to provide you with reliable monitoring.
Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.
Collection begins before you have an account. If you run the free health check on our public site, we store what it records — see 1.9. We also kept a waitlist before sign-up opened, and it was deleted on October 21, 2026 — see 1.8. The rest of this section describes what we collect once an account exists.
When you create an account, we collect:
When you set up monitors, we collect the configuration details you provide:
When our Service checks your monitored endpoints, we collect:
Certificate details from an incident diagnosis. When a URL or SSL monitor's incident opens because the site's certificate is not trusted, we contact the monitored site again to work out why (for example, a missing intermediate certificate). We do this at most three times for one incident. We store the result with the incident:
The diagnosis is kept with the incident, including its archived copy after the incident is archived; the diagnosis job's record is removed when the incident is archived. To find an issuer certificate, we fetch from addresses named in the certificates we examine: the site's own certificates and certificates we have already downloaded. We make at most four such fetches per diagnosis. Those addresses are chosen by the certificates, not by us, and can be any public web host a certificate names. The requests go to plain http addresses and carry our user agent and no account or monitor data.
To deliver alerts and maintain service quality, we collect:
For security and compliance purposes, we automatically collect:
To personalize your experience and ensure the site renders correctly, we use functional cookies and browser localStorage to store:
Signing in also keeps five values in your browser's localStorage. They describe this device, not your account, and none of them is sent to us except as stated:
db-last-sign-in-method) — Which way you last signed in on this device (email, password, passkey, or a provider such as GitHub, Google, or Microsoft), so the sign-in page can mark that option as "Last used". It stays in your browser and is never sent to us.db-sign-in-oauth-attempt) — Which provider you chose, written when you leave to sign in with it, so that the method can be recorded once you return signed in. It stays in your browser and is never sent to us. It is removed when a sign-in is recorded or you next open the sign-in or sign-up page; if you abandon the provider's sign-in, it stays until then.db-sign-in-requester) — A random value created in your browser. It is sent when you ask for an email sign-in link from the sign-in or sign-up page, or ask for another after requesting a sign-in link, and when you sign up with a password. It is sent again from the email link's landing page, so that page can tell it is open in the browser that asked for the email (in any other browser the page shows a code to enter in the browser that asked), and when you finish with that page's button or the email's code, so that a password set at sign-up is kept only when its email is finished in the browser that signed up. Emails sent another way, such as a new one requested after a password sign-up, carry no such value, so their page always shows the code. The value itself is kept only in your browser. We store a one-way hash of it with the pending sign-in. A pending sign-in stops working 15 minutes after the email is sent, and is deleted when it is used, when a newer email is sent for the same address, or when expired sign-in records are cleared. The value is random and contains nothing about you or your account, but it stays the same for every sign-in email this browser asks for, until you clear your browser's storage.db-passkey-offer-due) — Set when you sign in on this device some way other than a passkey, so the next signed-in page can offer to create one. It is removed once you answer the offer or sign in with a passkey, or without an offer when your account already has a passkey, this browser cannot create one, or you chose "Not now" in the last 30 days. It is never sent to us.db-passkey-offer-declined) — The date and time you last chose "Not now" on that offer, so this device does not offer again for 30 days. It is never sent to us, and is kept until you clear your browser's storage.For authenticated users, your preferences are also stored in our database so they sync across devices. For unauthenticated visitors, preferences are stored only in your browser via functional cookies.
Functional cookies are strictly necessary for the site to operate correctly and do not require consent under GDPR or ePrivacy regulations.
To understand how people use our Service, we collect usage data through a first-party analytics system that we build and host ourselves. The surfaces this measurement covers are:
Our other public pages (for example sign-in, privacy, and terms) are not covered. This measurement is limited to:
Events from the sign-up page and from signed-in pages are pseudonymous. They carry no account, user, or sign-in identifier, and we never link them to an account. For the short working window while individual events still exist, someone with access to both the measurement store and our service logs could in principle match an event to a person by timing — for example, matching a sign-up completion event to the account created a moment earlier, and then to that visit's other events through the per-visit identifier. Aggregate counts we keep after that window carry no visit identifier and cannot be matched that way. Events from the landing page alone, with no sign-up or signed-in activity in the same visit, remain anonymous.
What this analytics system does NOT collect:
If your browser sends the Do Not Track (DNT) or Global Privacy Control (Sec-GPC) signal, we honour it: our server discards each event on arrival and writes nothing, so none of the above is collected from you.
Our analytics use no cookies and no third-party services. All analytics data is processed and stored entirely on our own infrastructure. Events carry no identifier that outlives a single visit, and individual events are discarded within days, leaving only aggregate counts.
Before sign-up opened to everyone, the public site let visitors leave an email address on a waitlist. The waitlist was closed when sign-up opened, and it was deleted on October 21, 2026. We no longer collect waitlist entries, and we hold none.
The free health check on our public site looks up DNS records, SSL certificates, domain registration (WHOIS), email security records (MX, SPF, DKIM, DMARC), blacklist listings, and the endpoints it can find for the target you give it. Every run is stored, whether or not you are signed in. In the two modes that ask for an email address, the address you enter is what the stored run is filed under — it is the key we store the result against, and the key a repeat check is matched to. The domain-only mode stores no email address.
Each stored run holds:
A stored run is attached to the identifier in your health check session cookie, or to your account if you are signed in. That identifier is a random value we generate and set in a first-party cookie on your device. The cookie is HttpOnly, so scripts on the page cannot read it, and SameSite=Lax, so it is not sent with requests made from other sites. It expires 30 days after it is set, and it is listed in 9.1 with our other cookies.
Results are reused for a short window, so checking the same target again does not re-run every lookup. Health checks you run before you sign up can be carried into your account if you create one.
We use the information we collect to:
We do not use your information for:
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
| Purpose | Legal Basis |
|---|---|
| Providing the monitoring service | Performance of contract |
| Sending service notifications | Performance of contract |
| Account security and fraud prevention | Legitimate interests |
| Service improvement and usage measurement | Legitimate interests |
| Legal compliance | Legal obligation |
| Marketing communications (if any) | Consent |
You may withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal.
We share data with the following categories of service providers who assist in operating our Service. We list them by category rather than by name:
| Provider category | Purpose | Data Shared |
|---|---|---|
| Managed database hosting provider | Managed PostgreSQL database hosting | Account data, monitor configurations, results |
| Email delivery provider | Email delivery | Recipient email addresses, notification content |
| Cloud function (probe execution) provider | Probe executors that re-run a failing check from other US regions, to confirm an outage before we alert you | The target and request configuration of that check — URL, host, domain or port, and the method, headers and body you configured |
| S3-compatible object storage provider | Data exports and archives | Exported monitoring data |
| Payment processor | Payment processing, through the hosted checkout and customer portal your browser is sent to | Payment and subscription identifiers. Your card details go to the payment processor directly and never reach us |
| FVC Billing Service | Subscription management — plans, checkout, and entitlements. Operated by Future Vision Concepts, LLC, the same company that operates DownBad, so this is not a third party | Account identifier, account name, the account owner's email address, plan and subscription state |
| AI model provider used for automated service diagnostics | Automated tools, including third-party AI services, that check whether a failing monitor's problem is on our side. Used only while Proactive troubleshooting is on for your account | The details of a failed check needed to diagnose it — the monitor's target, the failure type and error, response status and timing, and our own service health data at the time |
The third-party providers above are contractually obligated to protect your data and use it only for the purposes we specify.
Every account has a Proactive troubleshooting setting, on by default, under Settings. It reads:
When your monitors fail, DownBad may use automated tools, including third-party AI services, to check whether the problem is on our side and let you know.
Turn it off and we stop that automated review of your account's monitors, including sending any of your data to the AI model provider. It does not stop members of our team from looking at a failure in our admin tools when something is wrong, and it does not stop us from showing you a note when a problem we already know about is affecting your monitors.
If you configure webhook notifications, monitor data will be sent to the endpoints you specify. You are responsible for the privacy practices of any third-party services you integrate.
We do not:
We may disclose your information if required to:
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.
Our Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.
For users in the EEA, UK, or Switzerland, we ensure appropriate safeguards for international transfers through:
We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account |
| Monitor configurations | Until you delete them or your account |
| Monitor results | 30 days (Free tier) / 90 days (Paid tiers) |
| Notification history | 90 days |
| Data archives/exports | 365 days, then automatically deleted |
| Audit logs | 90 days |
| Email delivery records | 90 days |
| Usage measurement data | 90 days, then automatically deleted |
After account deletion:
We implement appropriate technical and organizational measures to protect your personal information:
While we strive to protect your information, no method of transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.
Regardless of your location, you can:
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following additional rights:
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
To exercise these rights, contact us at [email protected] or use the data export and account deletion features in your dashboard.
Categories of personal information collected in the preceding 12 months:
We do not sell personal information.
We use a minimal set of cookies, all of which are strictly functional:
| Cookie Type | Purpose | Required |
|---|---|---|
| Authentication cookies | Maintain your logged-in session | Yes |
| Functional cookies | Store display preferences (theme, UI settings) for unauthenticated visitors to ensure the site renders correctly | Yes |
| Passkey sign-in cookie | Hold a reference to the one-time challenge your device's passkey answer is checked against. Set each time a challenge is asked for: when you start creating a passkey or signing in with one, and, in a browser that can suggest passkeys in the email field, each time the sign-in page opens, every few minutes while it stays open, and when you return to the email field after an earlier request ended. Expires 5 minutes after it is set. Each challenge is also kept with our sign-in records, and deleted when a sign-in or new passkey succeeds with it, otherwise once it has expired | Yes |
| Health check session cookie | Hold a random identifier so the health checks you run on our public site are stored together and can be carried into your account if you sign up; expires 30 days after it is set | Yes |
All cookies we use are first-party (set by downbad.app) and strictly necessary for the site to function. No consent banner is required for these cookies under GDPR and ePrivacy regulations.
We use browser localStorage to persist UI preferences on your device. For authenticated users, preferences are synced to your account so they carry across devices.
We also use localStorage for the five sign-in values described in 1.6: the last sign-in method, a provider sign-in in progress, the sign-in requester, and whether to offer a passkey (due, or declined). They stay in your browser; only the sign-in requester is sent to us, as described there.
We operate a first-party analytics system, built and hosted ourselves, to understand usage patterns in aggregate. The surfaces this measurement covers are our landing page (and the health check run from it), our sign-up page, and the signed-in pages of the customer app. Our analytics:
Our usage measurement is limited to page views of those measured surfaces, click events (including the order of events within one visit), referral sources, general device information (browser type, screen size), the time of each event, and a per-visit identifier that is never written to your device, collected solely to improve the Service. Individual events are discarded within days; only aggregate counts are retained. This data is never sold, shared, or used for advertising.
We do not use:
You can clear cookies and localStorage through your browser settings. Note that clearing authentication cookies will require you to log in again, and clearing functional cookies or localStorage may reset your display preferences, remove the "Last used" marker on the sign-in page, and make an email sign-in link's page treat your browser as a different one and show a code.
DownBad is not directed to children under 13 (or under the minimum age required to consent to data processing in your country). We do not knowingly collect personal information from them. If we learn we have, we'll delete it. Parents can contact us at [email protected] to request deletion.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy. If you do not agree to the changes, you should stop using the Service and delete your account.
We encourage you to review this Privacy Policy periodically.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Privacy Inquiries:
General Legal Inquiries:
Company: Future Vision Concepts, LLC Ohio, United States
We aim to respond to all inquiries within 48 hours.
This Privacy Policy was last updated on November 6, 2026.
Questions? Contact us at privacy@downbad.app