Privacy Policy

This policy explains what Cristiano Gonzales collects when you use WhoopsBot, and why. The contact for privacy requests is hello@whoopsbot.com.

What we collect

Account: name, email, a password hash if you set a password, and a session cookie. Launch check: the URL, the report, and an email if you ask for the full report. We store a hash of the IP address to enforce the hourly limit, not the raw address.

Flows: the site URL, the description you wrote, the steps (which may include test emails and passwords you typed into a fill step), run results, and a JPEG screenshot of the page at the end of the run. Screenshots can contain whatever was on the screen, including personal data your app showed.

Inbound test mail: the recipient address we generated, and the sender, subject, and text body of messages posted to the inbound webhook or recorded from the dashboard.

Billing: Paddle's customer id, subscription id, price id, status, and period end. We don't receive your full card number. Paddle does, under their policy.

Why

We use this to run the checks, show you the dashboard, send break alerts and the weekly report, enforce plan limits, and keep the launch check from being hammered. If you create an account or enter an email on a launch check, we add that address to our ActiveCampaign list “WhoopsBot Sign-ups”, tagged signup or launch-check, so we can email you about the product. If ActiveCampaign isn't connected, we keep the address locally and retry later.

Who else processes it

The app is built to run on Netlify, with Postgres (intended: Neon), Paddle for payments, Resend for outbound email when configured, an inbound email provider you connect, and ActiveCampaign for the mailing list. Each of those receives only what it needs to do that job. Until a provider is connected, that data stays in our database.

Cookies

We use a session cookie from Better Auth to keep you logged in. We don't set an advertising cookie, and this site doesn't ship a third-party analytics tag.

How long

Account data, flows, and screenshots stay until you delete the account or email us to delete them. Launch-check reports are kept so the link keeps working. Email us if you want a specific report removed. Marketing contacts stay in ActiveCampaign until you unsubscribe or ask us to delete them.

Your requests

Email hello@whoopsbot.com to access, correct, or delete your data, or to object to product email. You can delete the account yourself on the billing page. You can unsubscribe from marketing mail with the link in those messages once ActiveCampaign is sending them.

Children

WhoopsBot is not for children, and we don't knowingly collect their data.