Privacy notice

Last updated 13 October 2026

Who is responsible

ShadowGraph, Vienna, Austria.

Visiting the site

We do not use cookies and store nothing on your device for tracking. To count visitors we compute a daily anonymous fingerprint from your IP address and browser identifier, hashed with a secret that changes every day; neither the IP address nor the browser identifier is stored, and fingerprints cannot be linked across days. We store the pages viewed, the referring website, an approximate country and the device type. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). Aggregated counts are kept; daily fingerprints are not linkable to a person.

The hosting platform (Floot, running on Amazon Web Services) processes technical request data such as IP addresses in server logs to deliver the site and keep it secure, and counts page views without storing anything on your device.

Vendor Map scans

If you scan a vendor list on /vendors we store the list (vendor names, websites, functions, criticality), the scan results, the optional company name and work email you enter, and a one-way hash of your IP address for rate limiting. The results are reachable only through the unguessable link created for the scan and are deleted automatically after 30 days. Only public information about the vendors is read (DNS, network ownership, TLS certificates, domain registration data). Legal basis: providing the scan you requested (Art. 6(1)(b) GDPR); for the optional email, our legitimate interest in replying to you (Art. 6(1)(f) GDPR).

Free alerts

If you ask for a free alert we store your email address, the service you want to watch, the page you signed up on and the time of sign-up and confirmation. We only send the confirmation email until you click its link (double opt-in), then alert emails for that service. Every email has a one-click unsubscribe link; after unsubscribing we keep the address only as unsubscribed so we do not email it again. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing. Emails are sent through Amazon Simple Email Service via our hosting platform.

Paid plans

Payments are handled by Stripe. We receive your email address, the subscription status and the alert channels you configure (for example Slack or Teams webhook addresses); we never see your card details. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal retention duties for invoices.

Recipients and transfers

Processors: Floot (application hosting), Amazon Web Services (servers, content delivery, email sending), Neon (database), Stripe (payments). Some of them are based in the United States; transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.

Your rights

You can ask for access, correction, deletion, restriction, data portability and object to processing based on legitimate interest. You can also complain to a data protection authority, in Austria the Datenschutzbehörde (dsb.gv.at).

What we measure about other services

The outage radar probes public service endpoints of companies, not people. It does not collect personal data.