Privacy policy

The short version

• We collect as little as we can and delete what we only needed once.
• We never sell data, show ads, or share anything with vendors.
• Your reports, ratings and anonymous posts don't carry your member ID.

What we collect, and why

• Your work email: to prove you work in IT. It's deleted when your sign-up is approved or declined. We keep only a one-way fingerprint of it so the same address can't be used twice.
• A LinkedIn link or a vouch code: to confirm your role during review. Deleted with the decision.
• A personal email address: to sign you in and, if you choose, to send alerts.
• Your profile: a handle, your role, industry and company size, and your display preferences.
• The products you run: to personalize your home and alerts. Stored encrypted and never shown to anyone.
• Your real name, title and company: only if you choose to post as yourself, and only after we verify them against a LinkedIn link, which is deleted afterward.
• What you post and report: posts, replies, ratings, patch, renewal, outage, insurance and compliance reports. Reports and ratings are stored without your member ID.
• Feedback you send: stored without your identity unless you tick "you can contact me".
• A Teams or Slack webhook link, if you connect one: stored encrypted.

What we don't do

• We don't sell or rent any data, to anyone.
• We don't show ads or use advertising or analytics trackers.
• We don't share member data with vendors, MSPs, recruiters or anyone else.
• We don't send your posts or profile to AI models. Our AI only reads public news and advisories to tag them.

Who processes data for us

A few providers run parts of the service. They process data only to provide it:

• Vercel hosts the app. It keeps short-lived request logs (IP address, time, page) for debugging and abuse prevention.
• Supabase stores the database and handles sign-in codes.
• Resend sends email.
• Anthropic's Claude reads public news and advisories to tag them. It never receives member data.

How long we keep things

• Work email, LinkedIn link and vouch record: until your sign-up decision, then deleted.
• Raw outage reports: 30 days. Incident summaries (start, end, vendor acknowledgment) are kept.
• Rate-limit counters: two days.
• Everything else: while your account is active. Ask us to delete your account and we'll remove your profile and personal data. Posts you made anonymously can't be traced to you, so we can't find them to delete them.

Your choices

• Post as yourself, as your handle, or anonymously, chosen on every post.
• Change or remove your stack, your verified name and your alert settings any time.
• Ask for a copy of your data or for your account to be deleted at [contact email].

Legal requests

We can only provide what we hold, and the service is designed to hold little. The database doesn't store which member sent a report, rating or anonymous post.

Changes

If we change how we handle data, we'll update this page and tell members before the change takes effect.

Contact

Questions or requests: [contact email].