Privacy policy

The app: data that stays on your iPhone

Duskwatch shows your DigitalOcean account on your iPhone. The app reads it directly from DigitalOcean's API, under your own agreement with DigitalOcean. Most of what it reads is held only in memory while the app runs. Some data is stored on your iPhone so the app works; it stays on the device, and we cannot see it.

• Your sign-in: the DigitalOcean permission you approved, to view and, if you enable actions, to act, in the iOS Keychain, set to this device only. It is never synced to iCloud, never moved to another phone and never sent to us.
• Recent lists for offline use, such as droplets, apps, databases and this month's spend, kept for at most 24 hours. Private IP addresses, database hosts and users, and deploy authors are removed before anything is saved.
• Your pins, recent searches, spend budget and settings.
• A small snapshot for the widgets, with names, statuses and spend but no IP addresses or hosts, and Spotlight entries for your resources, which expire after 30 days.
• If alerts are on: the names of the teams and resources they cover, so your iPhone can name a notification that arrives with IDs only, and your quiet hours and mutes. Also the alerts you acknowledged on this iPhone, for a day, and any "I'm on it" or snooze taps still waiting to reach our server, as IDs and times only.
• For the open-alerts widget, Siri and Live Activities: a short list of open alerts as IDs and codes, with whether each is muted, the short names of resources that have a Live Activity running, and your Live Activity settings, including whether names show on the Lock Screen. iOS keeps a Live Activity's own data, as IDs, codes, counts and times, for at most 12 hours, and the app keeps its update token for about as long.
• For the first-launch intro: whether you have seen it and whether you sent the optional survey. If your survey answers could not be sent yet, the app keeps them, as fixed choices with no identifier, until they are sent, for at most 14 days.

How long data stays on your iPhone

This data is excluded from iCloud and computer backups. Signing out of a team deletes that team's data from the iPhone, and signing out of the last team also removes the widget and Live Activity files. Deleting the app removes the rest, and the app clears any sign-in left in the Keychain the next time it is installed.

The app never stores database passwords or connection strings.

The app: alerts (optional)

Alerts are off until you turn them on, and they are part of Duskwatch Pro. To watch your team while the app is closed, our alert server asks DigitalOcean for a separate, read-only permission, which you approve on DigitalOcean's page. It can see status but cannot change anything. Your own sign-in never reaches the server.

Notifications and Live Activity updates carry only IDs. Your iPhone adds the team and resource names, so neither our server nor Apple's push service sees them.

If you turn alerts on, the alert server keeps:

• Installation: an ID for your app installation and a one-way hash of a secret only your iPhone holds; the app version and when the app last checked in.
• Push token: your iPhone's push token from Apple, and whether the build is a development or production one.
• Team: your DigitalOcean team's ID, never its name, and a keyed one-way fingerprint of your account ID, never the ID itself, so your iPhones on the same account share one set of alerts.
• The read-only permission: encrypted, with the permissions it grants, its status and the time and code of its last error.
• Alert settings: your alert rules, mutes and spend budget, and how often each iPhone repeats urgent alerts. A mute is kept as what it covers and when it ends, never who set it or why.
• Alert scope (optional): if you choose to get alerts only for selected resources, the IDs of the resources (up to 500) and DigitalOcean projects (up to 20) you pick, and the IDs of the resources DigitalOcean lists in those projects, which the server reads again every hour with the read-only permission. Never their names, tags or environments. Alerts outside your scope are still recorded in the alert history, without a notification.
• Alert state and history: the last known status of what you watch, as IDs, including generic markers such as which kind of sensitive port a firewall opened (never the port or an address) and the time of the newest failed payment (never its amount); the alert history, as IDs (an app component by its position in the app, never its name), with when an alert was acknowledged (never who acknowledged it), snoozes, and markers for alerts that keep going down and up or reopen; and alert groups, as IDs, times and a member count, never names or a list of members. When an open problem gets more urgent, for example an app that restarts a few times and then keeps crashing, it stays one alert whose code changes; nothing else is stored about it.
• Live Activity tokens: while a Live Activity that follows an alert or an action runs, the update token Apple gives it, with its kind, IDs, times and a fingerprint of the last state sent.
• Subscription state: see "The Duskwatch Pro subscription" below.

Alerts: purpose, legal basis and retention

• Purpose: to check your team for problems while the app is closed and send you push notifications and Live Activity updates.
• Legal basis: providing the service you asked for when you turned alerts on (GDPR article 6(1)(b)).
• Retention: alert history is kept for 30 days, and alert groups are deleted 30 days after they open. A Live Activity's token and state are deleted at most 12 hours after it starts, 30 minutes after it ends, or sooner if Apple reports it gone. A resource mute is deleted within a day after it ends, or when you unmute it; one set to "Until I turn it back on" stays until you unmute it. The alert scope is deleted when you switch back to all resources. Everything for a team is deleted within 24 hours when you turn its alerts off, sign out of it, DigitalOcean rejects the permission, or you ask us. An installation that has not checked in for 60 days is deleted with its data. If your Duskwatch Pro subscription ends, checks pause and the alert data is kept for 30 days so alerts can resume; you get a notice 7 days before it is deleted. Deleted data can remain in encrypted database backups for up to 7 days.

What the alert server never keeps

• Your name, email address or password
• The names of your teams and resources
• IP addresses, logs, metrics or database credentials
• Who acknowledged an alert, or what a notification or Live Activity says
• A permission that can change things. If one ever reaches the server, it is rejected; the server keeps it, encrypted, only until DigitalOcean confirms it is revoked, and never more than 24 hours.

Where the alert server runs

The alert server, its database and its queue run on DigitalOcean's App Platform in Frankfurt, Germany. The database is encrypted at rest, and the read-only permission is encrypted again with its own key. The server's logs never contain IP addresses, tokens or names, and are kept for at most 14 days.

The app: the Duskwatch Pro subscription

• Purpose: to sell Duskwatch Pro, verify purchases, and check that your subscription is active before the alert server works for you.
• Data: Apple handles payment, and we never see your card or Apple Account details. When you open the Duskwatch Pro screen, including the last page of the first-launch intro, buy or restore a purchase, or turn on alerts, and at later launches after that, the app contacts RevenueCat, which verifies App Store purchases for us. RevenueCat receives an anonymous ID the app creates, your App Store transactions and receipts, your App Store country, the app and iOS versions and your IP address. It never receives anything from your DigitalOcean account, your email address, or a device or advertising identifier. If you use alerts, our server also keeps the anonymous ID, encrypted, with a one-way hash to find it, when your subscription expires, when it was last checked, and whether it comes from a TestFlight test purchase. When a subscription changes, RevenueCat notifies our server; the server only uses the notice to ask RevenueCat for the current status, and does not keep it.
• Legal basis: performing the contract when you subscribe (article 6(1)(b)).
• Retention: on our server, the subscription data is deleted with your installation's alert data. RevenueCat keeps purchase records while it provides this service to us. If you never open the Duskwatch Pro screen or the last page of the first-launch intro, restore a purchase or turn on alerts, the app never contacts RevenueCat.

The app: "Add my IP"

• Purpose: to add your current public IP address to a managed database's trusted sources, when you ask for it.
• Data: the app asks our server which public IPv4 address your request comes from. The server answers and forgets it. The app then sends the address to DigitalOcean with the change you confirm.
• Legal basis: providing the feature you asked for (article 6(1)(b)).
• Retention: none. The address is never stored or logged. To limit abuse, the server counts requests per address with a salted one-way hash, kept only in memory for about a minute.

The app: following a DigitalOcean incident

• Purpose: to show a DigitalOcean incident on your Lock Screen, when you ask for it.
• Data: if you tap Follow on Lock Screen for a DigitalOcean incident, the app asks our server for the public broadcast channels of open DigitalOcean incidents and picks the one you follow, so the server never learns which one it is; the request carries no identifier and we store nothing. The answer is public status information.
• Legal basis: providing the feature you asked for (article 6(1)(b)).
• Retention: none. Your IP address is never stored or logged. To limit abuse, the server counts requests per address with a salted one-way hash, kept only in memory.

The app: the optional survey

• Purpose: to understand, in aggregate, who uses Duskwatch and how they find out about incidents today, so we can decide what to build next.
• Data: when you first open the app, a few optional questions with fixed choices: your role, the size of your team, which DigitalOcean products you use, and how you hear about incidents today. The app sends your answers once, with the app version. There is no free text, and you can skip any question or the whole survey; if you skip them all, nothing is sent. If the app cannot send your answers right away, it keeps them on your iPhone and tries again later.
• Anonymous: the answers are sent without your installation ID, push token, DigitalOcean account or team, purchase ID or any other identifier, and we store only the day they arrived, not the time. Your IP address is used only in memory, as a salted one-way hash, to limit abuse; it and your browser or device details are never stored or logged. We cannot link an answer to you.
• Legal basis: once stored, the answers are anonymous and are not personal data. Handling your request on its way to us, including the abuse limit, relies on our legitimate interest in understanding our users in aggregate and keeping the server safe (article 6(1)(f)).
• Retention: answers are deleted after 24 months. Answers waiting on your iPhone are dropped after 14 days if they cannot be sent.

The app: Apple, the App Store and TestFlight

Apple delivers push notifications using your iPhone's push token and the IDs-only notification, and Live Activity updates: for your own alerts and actions through the activity's update token, with IDs and counts only, and for a DigitalOcean incident you follow through a public broadcast channel that carries only DigitalOcean's status codes. Apple also runs the App Store, TestFlight and in-app purchases under its own privacy policy.

If you choose to share analytics with app developers in your iPhone's settings, or send feedback or a crash report in TestFlight, Apple passes us the crash reports and the feedback you send. We use them to fix problems, based on our legitimate interest in a working app (article 6(1)(f)), and delete them when they are no longer needed for that.

When you visit the website

• Purpose: to deliver the pages to you and keep the site secure and working.
• Data: your IP address, browser and device details, the page you asked for and the time. Our host, Vercel, processes this with every request, as any web host does.
• Legal basis: our legitimate interest in running a secure website (GDPR article 6(1)(f)).
• Retention: request logs are visible to us for 1 hour on our current Vercel plan. Vercel may keep its own records under its privacy notice.

Counting visits

We use Plausible to count visits. It sets no cookies and stores nothing in your browser.

• Purpose: to see how many people visit, which pages they read and which links brought them here.
• Data: the page address, the referring site and campaign tags such as ?ref=, your browser, operating system and device type, and an approximate location derived from your IP address. We also count four kinds of events: a waitlist signup (and which form was used), a signup error (its type only, such as an invalid address), each step of the optional questions you reach, and a finished set of questions (how many you answered). None of them include your email address, name or answers.
• How visitors are counted: Plausible makes a daily identifier from a hash of a daily salt, the website, your IP address and your browser details. The salt is deleted every 24 hours, so visits cannot be linked across days. Plausible never stores your raw IP address.
• Legal basis: our legitimate interest in understanding, in aggregate, whether the site and the waitlist work (article 6(1)(f)).
• Retention: we see only aggregate statistics, which we keep while the site runs.

The waitlist

You can join the waitlist with your email address. It is added to the list when you submit the form; we do not send a confirmation email. We email you once when Duskwatch is on the App Store, plus anything else you opt into, and you can unsubscribe at any time.

After you sign up, a short dialog lets you add more, all optional: your first name, answers to four survey questions, and whether you want a TestFlight beta invite or monthly build notes. Everything is saved with your address at our email provider, EmailOctopus. It is not anonymous, and it is separate from the survey in the app.

The emails have open and click tracking turned off: no tracking pixels and no redirected links. Every email has a one-click unsubscribe link.

Each purpose is listed below with the data, the legal basis and how long we keep it.

How long we keep data, at a glance

• Alert history and alert groups: 30 days.
• Resource mutes: until a day after they end, or until you unmute. Alert scope: until you switch back to all resources.
• All alert data for a team: deleted within 24 hours of turning its alerts off, signing out of it or asking us; 30 days after a subscription ends; 60 days after an installation stops checking in.
• Live Activity tokens: at most 12 hours.
• Duskwatch Pro status on our server: with your alert data.
• Survey answers in the app: 24 months.
• "Add my IP" and incident-channel requests: not stored.
• Server logs: at most 14 days. Database backups: up to 7 days.
• Waitlist: until 30 days after the launch email, or until you unsubscribe from build notes.
• Website request logs: 1 hour at our host.

Who processes your data

These companies process data for us. We do not sell your data, share it with anyone else or use it for advertising.

• DigitalOcean, LLC (United States) hosts the alert server, its database and its queue in Frankfurt, Germany. When the app reads your own DigitalOcean account, DigitalOcean acts under your agreement with it, not for us.
• Cloudflare, Inc. (United States) runs the network edge of DigitalOcean's hosting service. It handles connections to the alert server, "Add my IP" and the survey, including your IP address and the request contents in transit.
• Apple Inc. (United States) delivers push notifications and Live Activity updates, and runs the App Store, TestFlight and in-app purchases.
• RevenueCat, Inc. (United States) verifies App Store purchases of Duskwatch Pro, as described above.
• Vercel Inc. (United States) hosts this website and runs the signup function. The signup function is set to run in Frankfurt, Germany. Pages are served from the Vercel location closest to you, which may be outside the EU. Vercel is certified under the EU-U.S. Data Privacy Framework. Its data processing agreement, with the EU standard contractual clauses, covers its Pro and Enterprise plans. While this site runs on Vercel's free Hobby plan, Vercel handles request data under its own privacy notice.
• EmailOctopus (Three Hearts Digital Ltd, London, United Kingdom) stores the waitlist and sends the emails. It stores the data with Amazon Web Services in Ireland (EU), and its sending servers are in the EU. The United Kingdom has an EU adequacy decision. EmailOctopus says its staff and service providers may process data outside the UK and the EEA; its data processing agreement allows this only with the safeguards data protection law requires.
• Plausible Insights OÜ (Tartu, Estonia) provides the cookie-less visit counts. Plausible says the data is processed and stored in the EU, on servers in Germany, and does not leave the EU.

Transfers outside the EU

The alert server keeps its data in the EU. Some of the companies above are based in the United States or the United Kingdom, or reach data from there. Where a company processes data outside the EU, the transfer relies on the safeguards the GDPR requires, such as an adequacy decision, the EU-U.S. Data Privacy Framework or the EU standard contractual clauses. You can ask us for a copy of the safeguards that cover a transfer.

Cookies and browser storage

This website sets no cookies. Plausible sets none either.

The waitlist survey keeps the price it shows you in your browser's session storage, so the price stays the same while the tab is open. The browser clears it when you close the tab. It is never sent anywhere except with your survey answer.

If you choose a light or dark appearance, that choice is saved in your browser's local storage, only on your device. Clear your site data to remove it.

Your rights

Under the GDPR you have the right to:

• access the data we hold about you and get a copy
• correct data that is wrong
• have your data deleted
• withdraw your consent at any time, which does not affect what we did before
• object to processing based on our legitimate interest
• restrict processing in some cases
• receive the data you gave us in a common, machine-readable format (portability)
• complain to a supervisory authority. In Romania this is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro). You can also contact the authority where you live or work.

How to use your rights

In the app, Settings > Alerts has "Export my alert data", which gives you a copy of everything the alert server holds about your installation in a machine-readable format, and "Delete my alert data", which deletes it and revokes the server's read-only permission.

Turning a team's alerts off, or signing out of the team, also deletes its alert data within 24 hours. You can revoke either permission on DigitalOcean's side at any time, and the alert server stops and deletes the data within 24 hours.

To stop waitlist emails, use the unsubscribe link at the bottom of any email. It works in one click.

The app does not tell us who you are, so we cannot find app data from an email address alone. If you write to us about it, we will help you do it from the app. Survey answers cannot be linked to anyone, so we cannot find, export or delete one person's answers.

For anything else, such as a copy of your waitlist data or deleting it, write to hello@duskwatch.app. We may ask you to confirm the request from the address on the list, so that nobody else can get your data. We answer within one month.

Giving us data is voluntary

No law or contract requires you to give us any data. If you do not give your email address, the only consequence is that we cannot email you. The name, the waitlist survey and the extra emails are all optional.

In the app, alerts, Duskwatch Pro, "Add my IP", following a DigitalOcean incident and the survey are all optional. Without them, the app sends us nothing. The incident request carries no identifier, and the survey is anonymous.

No automated decisions

We make no decisions about you by automated means, and we do not profile you. The price in the waitlist survey is picked at random for each browser session. It is a research question, not an offer, and it does not change anything for you.

Children

Duskwatch is a tool for people who run cloud services, and it is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to hello@duskwatch.app and we will delete it.

Changes to this policy

If we change this policy, we update this page and the date below. If a change materially affects how we use your data, we tell you in the app or by email before it applies, and we ask for your consent again where the law requires it.

Contact and effective date

For any question about this policy or your data, write to hello@duskwatch.app.

Last updated: 20 October 2026. The waitlist consent text is version 2026-10-01.