Privacy policy

Last updated 5 October 2026

1. Who we are

SteadyMonitor is operated by Steady Circuit Ltd, registered in England & Wales under company number 16471673, with its registered office at 66 Paul Street, London, EC2A 4NA. For anything in this policy, or to exercise any of the rights in section 9, contact hello@steadycircuit.com.

Where we host SteadyMonitor for you, we are the data controller for the information described below. SteadyMonitor can also be installed on your own servers; in that case the organisation running the installation is the controller, we hold none of the data, and this policy describes only what the software itself stores on their behalf.

2. What we hold

SteadyMonitor is an uptime monitor. Most of what it stores is about your systems rather than about people, but some of it can identify someone, and all of it is listed here.

• Your account. You sign in with a Steady Circuit account. We store an identifier for that account and your workspace's name and short name. We never receive or store your password.
• What you configure. Project and check names, and the addresses you ask us to watch — URLs, hostnames and host:port pairs — along with each check's interval, timeout and options. Also the names you give your monitoring agents, and any custom domain you point at your dashboard.
• Monitoring results. For every check an agent runs: the time, which agent ran it, whether it succeeded, how long it took, and any error message the target returned. An error message is text from your system, so it contains whatever your system puts in it.
• Alert settings. If you turn on alerts, the details needed to send them: a Telegram bot token and chat ID, or a Resend API key and the email addresses alerts are sent from and to. Tokens and API keys are encrypted before they are written to the database.
• Security and operational data. Our edge server processes the IP address and request details of every request in order to apply rate limits and web application firewall rules, and keeps a list of addresses that have been blocked. Errors and refusals are logged; by default, ordinary successful requests are not.

3. Cookies and browser storage

SteadyMonitor uses one cookie, and only for authentication and authorisation: a first-party session cookie, set when you sign in, that tells our servers who you are and what your account is allowed to do. It is sent only over HTTPS and only to the site that set it, it carries no tracking or advertising information, and signing out removes it. Because the service cannot work without it, it is strictly necessary and does not need your consent.

We use no advertising, analytics or tracking cookies, and no third-party cookies, and we do no advertising, analytics or tracking of any kind.

For functional purposes only, your browser also keeps a few settings in its own storage, which stay on your device: your light or dark theme, your recent commands in the command palette, the currency you chose in the pricing calculator and, only while a sign-in is in progress, the state of that sign-in, plus a short record of the sign-in steps that helps diagnose a sign-in problem if you report one. You can clear these at any time from your browser's settings.

4. Why we hold it, and on what basis

Account and configuration data is processed to perform our contract with you: without it there is no service. Monitoring results are processed for the same reason — they are the service. Security and operational data is processed under our legitimate interest in keeping the service available and defending it from abuse. We do not sell personal data, and we do not use it to profile or advertise to anyone.

Improving our services

We also use the data described in section 2, and information about how the service is used, to maintain and improve SteadyMonitor and our other Steady Circuit services. That includes finding and fixing faults, planning capacity, understanding which features are used and how, making checks, alerts and incident detection more accurate, and designing new features. We do this under our legitimate interest in running and improving our services, which we have weighed against your interests and rights:

• Wherever we can, we work from aggregated or de-identified data, such as how many checks of each type run, typical response times or error rates across the service, rather than from anything that identifies you, your workspace or the systems you monitor.
• Only Steady Circuit staff who need it for this work can see the underlying data, under the same protections described in section 8.
• We never publish or share anything that identifies you, your workspace or your systems, and we never sell your data or let anyone else use it for their own purposes.
• Aggregated or de-identified information that can no longer identify you may be kept after the periods in section 7, since it is no longer personal data.
• You can object to this use at any time; see section 9.

5. Who else sees it

• Steady Circuit accounts — verifies your sign-in.
• Telegram — receives your alert messages, but only if you configure and enable Telegram alerts.
• Resend — sends your alert emails, but only if you configure and enable email alerts.
• Let's Encrypt — issues the TLS certificate for your dashboard, and for any custom domain you point at it. Custom domains are handled for us by Steady Circuit's own domain service, which checks the DNS record, obtains the certificate and forwards visitors to your status page. This means the hostname is submitted to a public certificate transparency log.
• Hetzner Cloud — hosts the service in Nuremberg and Falkenstein, Germany, and stores the data on our behalf.

We will also disclose data where the law requires it. Nobody else receives it.

6. Where it is held

Your data is stored on Hetzner Cloud infrastructure in Nuremberg and Falkenstein, Germany — inside the European Economic Area. The third parties in section 5 may process data outside that region under their own terms; the only data that reaches them is what is needed to sign you in or to deliver an alert you asked for.

7. How long we keep it

• Monitoring results are deleted automatically after 90 days.
• Checks, projects, agents and settings are kept until you delete them. Deleting a check deletes its results; closing your workspace deletes everything in it.
• Security logs and blocked address lists are kept only as long as they are useful for defending the service.
• Aggregated or de-identified information used to improve our services (section 4) can be kept for longer, because it no longer identifies anyone.

8. How it is protected

Traffic is encrypted in transit with TLS. Each workspace's data is separated in the database at the row level, so one workspace's queries cannot read another's. Agent tokens are stored only as hashes, and alerting credentials are encrypted before storage. Requests pass through a web application firewall and per-address rate limits before they reach the application. No system is perfectly secure, and we do not claim otherwise.

9. Your rights

Under the UK GDPR and the EU GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to restrict or object to how we use it, including its use to improve our services, and ask for it in a portable form. Much of this you can do yourself from the dashboard, which lets you edit and delete anything you have configured and export your data. For anything else, write to hello@steadycircuit.com and we will respond within one month.

If you think we have handled your data badly, you can complain to the supervisory authority in your country — in the UK, the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

10. Changes

If we change this policy we will update the date at the top, and we will tell you before any change that materially affects you takes effect.