Privacy Policy

Last updated: November 5, 2026

This Privacy Policy explains what information SecureShield ("we," "us," "the Service") collects, why we collect it, and the choices you have. It's written to reflect exactly what the product does — not a generic template.

1. What SecureShield is

SecureShield is a website security and uptime monitoring service. For any domain you add and verify ownership of, we regularly check whether it's online, the status of its SSL certificate, and the strength of its HTTP security headers, and we scan for a small set of commonly exposed sensitive files (like .env or .git/config).

2. Information you give us directly

• Account information: name, email address, and either a securely hashed version of your password, or — if you sign up or log in with "Continue with Google" — your Google account ID and the name/email Google shares with us. We never store or have access to your plain-text password, and we never see your Google password.
• Websites you add: the domain name, and the DNS/file-based proof you provide to verify you own or control it.
• Optional settings: an alert webhook URL (e.g. a Slack or Discord endpoint) if you choose to receive notifications there, and an API key if you generate one for programmatic access to your own account.

3. Information we generate by monitoring your verified domains

Once you've verified a domain, we automatically collect and store, for that domain only:

• Uptime status and response history from periodic checks
• SSL certificate expiration data
• A security header grade and the specific headers found or missing
• Any commonly-exposed sensitive file paths we find publicly reachable
• The hosting platform your site appears to run on (detected from public response headers — e.g. Vercel, Netlify, Render, Cloudflare)
• The approximate geographic location (city/country) of your site's server, based on its public IP address — this is about your server's location, not your visitors'

None of this monitoring begins until domain ownership is verified, and it only ever targets the domain you've added — never any other site.

4. How we use your information

• To operate your account and authenticate your login
• To run the monitoring checks you've requested for your verified domains
• To send account-related and alert emails, such as email verification, password reset links, and downtime/threat notifications
• To send alert notifications to a webhook URL you've configured, if any
• To maintain the activity log shown on your dashboard
• To improve the reliability and security of the Service

5. What we don't do

We don't sell your personal information. We don't monitor or access any domain until you've verified you own or control it. We don't use tracking or advertising cookies.

6. Data retention

We retain your account, website, and activity data for as long as your account is active. If you remove a website, its associated monitoring history and detected-threat records are deleted along with it. If you delete your account, all associated data is removed from our systems within a reasonable timeframe.

7. Cookies

We use a single essential session cookie to keep you logged in securely. We don't use tracking or advertising cookies of any kind.

8. Third-party services we rely on

We use a small number of infrastructure providers to operate the Service: a hosting platform to run our servers, a managed PostgreSQL database provider to store data, and a transactional email provider to send account and alert emails. Each only receives the data necessary to perform its specific function, and none of them are permitted to use your data for their own purposes.

9. Your rights

You can update your account information at any time from Settings, generate or revoke your own API key, and configure or remove your alert webhook. You can remove a monitored website at any time, which deletes its associated data. You can request full account deletion, or ask what data we hold about you, through the contact options available in your dashboard.

10. Children's privacy

SecureShield is a business/developer tool and is not directed at children. We don't knowingly collect information from anyone under the age of 16.

11. Changes to this policy

We may update this Privacy Policy from time to time as the Service changes. Material changes will be reflected by updating the date at the top of this page.

12. Contact

Questions about this policy can be sent through the contact options available in your dashboard.