ISITDOWN.NOW PLUGIN PRIVACY POLICY

Effective and last updated: 10 October 2026

SCOPE AND SUMMARY

This policy covers the IsItDown.now plugin for ChatGPT and Codex and the
public MCP endpoint at https://mcp.isitdown.now. The plugin is anonymous and
read-only. It does not require an IsItDown.now account and does not receive
your OpenAI account identity or full conversation.


DATA CATEGORIES, PURPOSES AND RETENTION

1. Tool inputs

The plugin receives only the arguments needed for the selected tool: a website
address or service/search name, and optional outage-history day and result
limits. We use them only to return the requested availability or outage
information.

Inputs to get_service_status, list_down_services, recent_outages and
search_services are processed for the request and are not stored in the
application database.

2. Live website-check data

For check_website, we use the submitted address to run a reachability check.
The destination website receives a normal HTTP request from IsItDown.now. We
store the hostname, check time, measured state, HTTP status, response time and
requesting IP address. URL paths and query strings are not stored. The IP
address is visible only to staff for abuse investigation.

Live-check records are deleted after 7 days. Long-term aggregate availability
data is not associated with a person.

3. Network and rate-limit data

Our server processes the connection IP address to create a salted, one-way
SHA-256 hash used to prevent abuse and enforce request limits. The raw IP
address is stored with a live-check record for staff abuse investigation. A
short-lived in-memory rate-limit entry is also used.

In-memory rate-limit entries expire after 60 seconds. Lookup-ledger hashes are
deleted after 2 days. Raw addresses and hashes attached to live-check records
are deleted with those records after 7 days.

4. Operational request metadata

Infrastructure may record standard technical metadata such as request time,
endpoint, response status and user agent for security and reliability. MCP
JSON request bodies and tool arguments are not written to access logs.

Operational logs are truncated at least monthly, so they are retained for no
more than 31 days, and may be deleted sooner when a log reaches its size
limit.

5. Tool results and public outage data

The requested result is returned to the OpenAI client that invoked the tool.
Public service status, uptime and confirmed outage history are measurements
about websites and services, not user profiles.

Public, non-personal monitoring and outage history may be retained
indefinitely to provide historical reliability information.


DATA WE DO NOT COLLECT THROUGH THE PLUGIN

- No IsItDown.now sign-in, email address, display name or account profile.
- No OpenAI account identifier or complete ChatGPT or Codex conversation.
- No passwords, authentication secrets, payment-card information, government
  identifiers or health information.
- No advertising identifiers, cross-site tracking cookies or behavioral
  profiles.

Do not place personal, sensitive or confidential information in a website
address or service-search field. The tools do not need it.


RECIPIENTS

We do not sell, rent or share plugin data with advertisers or data brokers.
The following recipient categories may process the minimum data necessary:

- IsItDown.now, to operate the MCP server and return the requested result.
- Hosting, security and network-delivery providers, including Cloudflare,
  acting as infrastructure providers.
- The destination website, only when check_website makes the requested
  reachability check.
- OpenAI and the initiating client, which receive the tool response so it can
  be shown to you. OpenAI's handling of information is governed by its own
  terms and privacy policy.
- Authorities or professional advisers, only when disclosure is required by
  law or necessary to protect legal rights and service security.


YOUR CONTROLS

- You choose whether to invoke the plugin and which hostname or service name
  to submit.
- For a live check, submit only a public hostname such as example.com. Avoid
  personal data in paths or query strings.
- You may disconnect or stop using the plugin at any time.
- You may ask privacy questions or request access, correction or deletion at
  https://isitdown.now/contact or by emailing hello@isitdown.now.

The plugin is not linked to an IsItDown.now account. A live-check record does
carry the requesting IP address for up to seven days; other tool records use
only one-way rate-limit hashes. They are deleted automatically according to
the limits above.


SECURITY AND CHANGES

We use access controls, input validation, rate limits and restricted network
targets to protect the service. If this policy changes materially, we will
update the effective date and publish the revised policy at this URL.


CONTACT AND GENERAL WEBSITE POLICY

IsItDown.now is responsible for this plugin policy. Contact us at
hello@isitdown.now. The separate general website privacy policy at
https://isitdown.now/privacy covers accounts, comments, subscriptions and
other features used directly on isitdown.now.