Our privacy policy, in plain English

The short version

If you browse this site or report a problem, we hold no personal data about you beyond the short-lived operational records described below. Website checks retain the requesting IP address for seven days so staff can investigate abuse; problem reports use only a one-way hash. If you sign in with Google, we hold your email address, display name and avatar URL, plus the IP address and country you signed up from and those of your latest sign-in, to protect accounts from abuse.

Using the ChatGPT or Codex plugin? Read the dedicated IsItDown.now plugin privacy policy, which explains the public MCP server's tool inputs, recipients, retention periods and user controls.

What is stored, in detail

If you use the browser extension

The browser extension uses Chrome's webNavigation API to receive the address and result of top-level page loads. It examines the hostname and error code on your device so it can mark a failed tab and offer a status check. It reads no page content, form data, cookies or authentication information.

Failed hostnames are held temporarily in the extension's memory and may appear in a local browser notification. The extension has no persistent storage, analytics or crash reporting and does not transmit browsing activity. After you click a check, it opens https://isitdown.now/status/<hostname>; that visit is then covered by the website-checker and server-log terms below.

The IsItDown.now browser extension's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Browser data is used only to provide the extension's disclosed website-failure feature, is not transferred for advertising or profiling, and is not made available for humans to read.

Everyone

• A session cookie, set only once you do something that needs one - Signing in, submitting a form that carries a cross-site request token, or looking up a website, where it counts the free lookups you have used today. It is HTTP-only, SameSite=Lax and contains no personal information.
• Standard web server logs for the requests you make, retained short-term for operational and abuse-prevention purposes.

If you report a problem

• Which service, which problem type, and the time.
• The country and region you optionally typed in. This is what you told us; we do not derive location from your IP address.
• A salted SHA-256 hash of your IP address. The address itself is never written to the database. The hash exists only to enforce the rate limit, cannot be reversed, and becomes meaningless if the salt is rotated.

A report is not linked to an account even if you are signed in.

If you use the website checker

• The hostname you checked and the result. Not the path, not the query string.
• Your IP address, visible only to staff for abuse investigation, and a salted hash used for rate limiting and distinct counts. Both leave the live-check table after seven days.

The lists of recently checked hostnames shown on the homepage and checker page contain hostnames only, with no association to who checked them.

If you sign in with Google

• Your email address, display name and avatar URL, received from Google's OpenID Connect endpoint.
• A stable Google subject identifier, used to recognise you on return.
• The IP address and country you signed up from, and those of your most recent sign-in. The country comes from our network provider, Cloudflare, not from you. We keep these to spot abuse such as mass account creation, and they are visible only to staff. They are replaced at each sign-in (the sign-up record excepted) and deleted with your account.
• Your comments, votes and the services you have chosen to watch.

We never receive your Google password. We request only the openid, email and profile scopes, we cannot read your mail or contacts, and we cannot post anything anywhere on your behalf.

If you buy a paid plan

• Stripe processes the payment and stores your card and billing details. IsItDown.now never receives or stores your card number.
• We store Stripe's customer and subscription identifiers, your chosen plan, billing period, subscription status and renewal date so the site can provide the service you bought.
• Stripe's payment script is loaded only when you open secure checkout. It is used to display Stripe's card form and complete the payment, not for advertising or cross-site analytics.

What is deliberately not stored

• Raw IP addresses for ordinary page views or problem reports. The website checker is the narrow exception: its requester address is retained for seven days so staff can investigate abuse.
• Location inferred from IP addresses for anyone who has not signed in, and any location history for members beyond the two sign-in records above.
• Cross-site tracking identifiers, advertising cookies or fingerprinting of any kind.
• Any third-party analytics that sets cookies. The only optional third-party scripts are Google sign-in and Stripe checkout, used when you explicitly open those services.

Who it is shared with

We do not sell, rent, trade or share personal data with advertisers, data brokers or partners. Google receives the information needed for sign-in only if you choose Google sign-in. Stripe receives the billing and payment information needed to process and manage a paid subscription only if you choose to subscribe. Their respective privacy policies govern what they do at their end.

Cookies

One, and only when it is needed: The session cookie described above. There are no analytics cookies, no advertising cookies, and no consent banner, because there is nothing to consent to.

Your rights

If you have an account, you can see everything attached to it on your account settings. To delete your account and every comment on it, email us from the address you signed up with and it is done within seven days. To request a copy of what we hold, ask the same way.

Reports and on-demand checks cannot be attributed back to an individual, so they cannot be selectively deleted on request - There is no way for us to know which were yours, which is rather the point of hashing.

Children

This site is not directed at children and we do not knowingly collect data from anyone under 13. Signing in requires a Google account, which carries its own age requirements.

Changes

If this policy changes materially, the change will be described here rather than buried in a version bump. The review date at the top of this page reflects the last substantive revision.

10 October 2026: Website checks now retain the requester IP address for seven days, visible only to staff, so repeated and abusive automated checking can be investigated. The existing salted hash remains the identity used for rate limits.

29 September 2026: For signed-in members we began recording the IP address and country of sign-up and of the most recent sign-in, to protect accounts from abuse. Members who joined before this date have no sign-up record; their details are recorded from their next sign-in.