Privacy Policy

Short version: your API key is stored only as a hash, your feed content is processed in memory and never written to disk, and we do not sell or share your data with anyone.

Last updated: 16 October 2026

What we store, and for how long

Data	Form	Kept for
API key	SHA-256 hash only — the plaintext is shown once at creation and never written anywhere	Until you delete the key or the service restarts
Monitor URLs	Plaintext, in memory	Until you delete the monitor
Feed content	Never stored — parsed in memory, diffed, then discarded	Seconds
Detected changes	Delivered to your webhook, then discarded	Seconds
Error messages	Plaintext, in memory (e.g. “upstream returned HTTP 403”)	Until the next successful check
Server access logs	Request path, status, IP, timestamp — no request bodies	As configured on the host

Three things worth calling out

Your API key is never stored in plaintext

When you create a key, the response contains it exactly once. From then on we keep only SHA-256(key) and compare against that. Even someone with full read access to our server’s memory cannot reconstruct your key from what we hold.

The trade-off is honest: we cannot show you a lost key, and we cannot email it back to you. If you lose it, you create a new one.

Feed content is not written to disk

When we check a feed, the response body is parsed in memory, compared against the previous snapshot, and dropped. There is no database, no file, no cache. We do not build a shadow copy of the internet.

Monitors do not survive a restart — which cuts both ways

Because everything is in memory, a restart clears all monitors and keys. That is good for privacy and bad for reliability. Persistent storage is planned for the next version; when it arrives, this policy will change and you will be told before it does.

What we send to third parties

Party	When	What is shared
The feed you monitor	Each check	Standard HTTP request metadata — your API key is never sent onward
Your webhook URL	When a change is detected	The change payload plus an HMAC signature
Slack / Discord	If you enable it	Only the message you configured

We do not use advertising networks, analytics trackers, or third-party data brokers.

Payments

Payments are handled entirely by our payment provider. We receive confirmation that a charge succeeded and the plan that was bought — never your full card or bank details.

Security measures

• Webhooks carry an HMAC-SHA256 signature so you can verify we sent the payload, and can reject anything forged.
• The Node service binds to 127.0.0.1 only; TLS terminates at the reverse proxy.
• All outbound fetches go through an SSRF guard with DNS pinning and per-hop revalidation, so the service cannot be used to reach private networks or cloud metadata endpoints.
• Feed bodies are capped at 10 MB, and XML entity expansion is structurally bounded.

Your rights

You can, at any time:

• Delete any monitor you created
• Ask what data we hold about you — and the answer will be short, because there isn’t much
• Request deletion of your account data

Because everything is in memory and there is no database, deleting your account is effectively a restart plus invalidating your key. We will do it for you on request.

Children

FeedWatch is a developer tool and is not directed at anyone under 16. We do not knowingly collect information from children.

Changes

Material changes will be posted here with an updated date. We will not apply them retroactively to data collected under an earlier version.

Contact

Questions about this policy, or a deletion request? Email bruceonline2018@gmail.com — we reply within 1 business day.