What Statuspy stores

Reading the site

Pages are pre-rendered and served as static HTML, so simply browsing does not create a record tied to you. We set no cookies of our own, and every page except the blog posts described below loads nothing from anyone else.

Our host serves the site and, like any web host, processes the network requests needed to do that. We do not add any tracking on top of it.

Tweets quoted in blog posts

A few blog posts quote a tweet. On those pages, and only those pages, we load X’s embed script from platform.x.com so the tweet renders as its author published it. X serves the embed, which means X can set its own cookies and can see that the tweet was loaded on this site.

We ask X not to use it for personalisation by marking every embed “do not track”, which is the strongest control the embed offers. Beyond that, what X does with the request is governed by X’s privacy policy rather than ours. Nothing about the embed is passed to us, and we do not read it.

Every other page on the site, including all the status pages, loads nothing from a third party. If you block scripts, the tweet stays as a plain quotation with a link to the original and the rest of the post is unaffected.

If you press “recheck”

That button triggers real outbound work, so it has to be protected from abuse. When you press it we store:

A one-way hash of your IP address

SHA-256 of the address combined with a secret that rotates every day. The address itself is never written down, and because the secret changes daily, two hashes from different days cannot be linked back together.

A coarse network identifier

Where our host provides one, so we can tell ordinary visitors apart from datacentre traffic. It identifies a network, not a person.

The referring page

The page you arrived from, if your browser sent one.

Which service and when

So the request can be rate limited and so we can tell how often a page is being checked.

This exists to stop the button being used to hammer other people’s servers, and to see whether a page is unusually busy. It is not used to build a profile, and it is not shared with anyone.

If you request a service

The request form is the only other place on the site that writes a record. When you send one we store:

The name and address you typed

So we know what to look at. Nothing you submit is published on the site, and we do not treat it as a message that expects a reply.

A one-way hash of your IP address

The same daily-rotating hash the recheck button uses, for rate limiting. The address itself is never written down.

The referring page

The page you sent the request from, if your browser sent one.

How many people asked

Requests for the same website are counted together rather than stored separately, so we can see what is most wanted.

Do not put anything personal in the form. There is no field for your name or email and we do not want either, so please send only the service and its website.

Your theme preference

Choosing light or dark saves that choice in your browser’s local storage so the site does not flash the wrong colours on your next visit. It stays on your device, is never sent to us, and clearing your browser data removes it.

What we never collect

• Names, email addresses, or any account details, since there are no accounts
• Cookies of any kind, including analytics and advertising cookies
• Third-party trackers, pixels, or session recording
• Your raw IP address in any stored record

Third parties

The site is hosted on a commercial platform and its data is kept in a managed database, both of which process requests on our behalf in order to serve the site. We send nothing about visitors to anyone else, and we do not sell data.

We do make outbound requests to the services listed here in order to check them. Those requests come from our infrastructure and contain nothing about you.

Questions or removal requests

Because recheck records contain only a daily-rotating hash, we have no way to find records belonging to a particular person, which also means there is nothing about you for us to hand over or to lose. The hash cannot be reversed and the salt it was made with is gone once the day ends, so a removal request would have nothing to act on.