Privacy Policy
Last updated: 2026-09-29
Pingolab ("Pingolab", "we") is a free, donation-funded service that monitors the availability of websites and servers. This policy explains which personal data we process when you use pingolab.net, panel.pingolab.net, status pages and the API, why, who we share it with, how long we keep it and what your rights are.
Users in Turkey should also read the KVKK notice. Details about cookies are in the Cookie Policy.
1. In short
- You sign up and sign in only with your Google account; we store no passwords.
- From Google we receive only your name, e-mail address and profile photo.
- We do not sell, rent or use your data to target ads at you. The marketing website (not the panel or status pages) uses Google Analytics to count visits and the Google Ads conversion tag to measure how many of our ads lead to sign-ups.
- You can export your data and delete your account from the panel at any time.
2. Data we collect
Account data. When you sign in with Google, Google sends us your name, e-mail address, the address of your profile photo and the Google account identifier that lets us recognise you next time. We only request the openid, email and profile scopes; we have no access to Gmail, Drive, contacts, calendar or any other Google data, and we never see your Google password. We also store your language, timezone and weekly-report preferences.
Monitoring data. The settings of your monitors (name, URL/host, port, method, expected response, optional request headers, body and credentials), check results (status, response time, error message, resolved IP), incidents, maintenance windows, tags and status pages. Request headers, bodies, credentials and webhook URLs are stored encrypted in the database.
Alert channels. The e-mail addresses, Telegram chat id and Discord/Slack/webhook URLs you add, and a log of the alerts sent to them.
API keys. Only a hash of the API keys you create is stored; the key itself is shown once, when it is created.
Technical and security logs. IP address, browser information, session records and a limited audit log (e.g. sign-ins, API key creation/deletion, account deletion), kept for security, abuse prevention and debugging.
Donation interactions. Clicks on donation links are recorded against your account together with where they came from (e.g. the panel card), so we don't show donation reminders more often than necessary. Payments happen on Buy Me a Coffee; we never see card or payment details.
Status page visitors and the website. No account is created for people who visit status pages or pingolab.net; we only keep web server access logs (IP address, browser information, requested page) and short-lived rate-limiting data for security. On the marketing website (pingolab.net pages and the API documentation) Google Analytics also records pages viewed, referrer, approximate location and device/browser type using cookies. If you arrived by clicking one of our Google Ads, a "sign-up" conversion is reported to Google Ads after you create an account, without your name or e-mail address; see the Cookie Policy.
Sites checked by PingolabBot. We send requests with the PingolabBot user agent to the addresses our users add. We collect no personal data from the owners of those sites — only technical results such as status code, response time and error details. Site owners can ask us to stop checking their site via the PingolabBot page; we then store the domain and the requesting e-mail address.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, running your monitors, sending alerts, publishing status pages | Performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c) |
| Security, preventing abuse and attacks, debugging, keeping the service stable | Legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5/2-f) |
| Measuring website visits and sign-ups from our ads (Google Analytics, Google Ads) | Legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5/2-f) |
| Weekly report e-mails | Your preference — turn them off any time in your profile or via the link in the e-mail |
| Responding to lawful requests and meeting legal obligations | Legal obligation (GDPR Art. 6(1)(c), KVKK Art. 5/2-ç) |
We do not use your data for profiling, automated decision-making or ad targeting (remarketing).
4. Who we share data with
We share data only as far as needed to provide the service, with these providers:
| Provider | Purpose | Location |
|---|---|---|
| Our hosting provider | The server running the application and database | Turkey |
| Google LLC | Sign in with Google (authentication); Google Analytics and Google Ads conversion measurement on the marketing website | USA |
| Brevo (Sendinblue SAS) | Sending alert and account e-mails | France / EU |
| Cloudflare, Inc. | DNS, forwarding of support@ e-mail, external availability monitoring, off-site storage of database backups over encrypted connections (EU region), bot protection on the PingolabBot opt-out form (Turnstile) | USA / EU |
| Telegram, Discord, Slack, your webhook URLs | Only to deliver alerts to channels you add | Wherever the channel is located |
| Buy Me a Coffee | Only if you choose to donate; payment happens on their site | USA |
Beyond this, we share data only when legally required (e.g. a court order) with the competent authorities. Information you publish on status pages (monitor names, uptime, announcements) is public by your choice.
5. International transfers
Some of the providers above are located outside Turkey and the EU. These transfers happen only as far as needed to provide the service and rely on the safeguards provided for by the GDPR and Article 9 of the KVKK (e.g. the providers' standard contractual clauses).
6. Retention
| Data | Period |
|---|---|
| Account data | While your account exists; permanently deleted within 30 days after you delete it |
| Raw check results | 30 days |
| Hourly aggregates | 90 days |
| Daily aggregates (uptime history) | 2 years |
| Alert delivery logs | 90 days |
| Audit logs | 1 year |
| Application error logs | 14 days |
| Database backups | 14 days on the server, 30 days off-site |
Data of a deleted account also disappears from backups once their retention period ends.
7. Security
All connections are encrypted with HTTPS. Sensitive monitor settings and webhook URLs are stored encrypted, and only hashes of API keys are kept. Administrative actions are logged, and rate limits and abuse protections are in place. No system is perfect; if we become aware of a data breach we will inform affected users and, where required, the supervisory authority as the law requires.
8. Your rights
You can:
- Access and portability: download your data as JSON or CSV in the panel under Settings → Profile → Export.
- Rectification: change your name, language and timezone in the panel (your e-mail address comes from your Google account).
- Erasure: delete your account at any time under Settings → Profile → Delete account.
- Revoke Google access: remove Pingolab's access to your Google account on your Google account permissions page.
- Object and other requests: for any other request under the GDPR or KVKK Art. 11, e-mail support@pingolab.net. We answer within 30 days at the latest. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority or, in the EU, to the data protection authority of your country.
9. Children
Pingolab is not intended for people under 16 and we do not knowingly collect their data. If we notice such an account, we delete it.
10. Changes
We may update this policy. The current date is always shown at the top of the page; we announce material changes in the panel or by e-mail.
11. Contact
For any privacy question or request: support@pingolab.net