Privacy policy
Last updated: 26 Oct 2026
This English text is a courtesy translation. In case of discrepancy the Italian version prevails.
This notice explains which personal data DownFeeds (https://downfeeds.com) processes, why, for how long and what your rights are, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Data controller
Atomicini S.r.l., single-member company, registered office [registered office], VAT no. [VAT number].
For any privacy request: [privacy email].
2. Data we process
- Account data: email, name (optional), language, time zone, sign-up date and date you accepted the terms. Passwords are never stored in clear text: we only keep a cryptographic hash (scrypt) from which the password cannot be recovered.
- Access and security data: IP address and browser type of each login session. The IP address is also used for a few minutes, in memory only, to limit login attempts and abuse.
- Content you enter: addresses and hosts to check, check settings (including any HTTP headers or credentials you choose to configure), incident notes, status pages, maintenance windows, API keys (stored as hashes only).
- Notification channels: recipient email addresses, Telegram chat IDs, webhook URLs (Slack, Discord or your own). For push notifications: the device identifier provided by your browser and the browser type.
- Check results: status codes, timings, headers and a short excerpt of the checked pages. They contain personal data only if such data appears on pages you choose to monitor.
- Public "Check a site" tool: the checked address is not stored; the requester's IP stays in memory for one minute only, to limit abuse.
- Public status pages: visitors are not asked for any data, no cookies are set and the application does not log their IP addresses.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, running checks, sending alerts, publishing status pages | Performance of a contract (Art. 6(1)(b)) |
| Service messages: password reset, notices about changes to the terms or the service | Performance of a contract (Art. 6(1)(b)) |
| Service security, abuse and fraud prevention, backups | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations, requests from authorities, defence of legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
We do not use your data for advertising or marketing, we do not sell it, and we do not profile you or take decisions based solely on automated processing that produce legal effects concerning you (Art. 22).
Email and password are required to create an account; all other data is optional.
4. Recipients
Data is processed by authorised staff of the controller and, on its behalf, by the following processors (Art. 28):
- Server infrastructure: [hosting provider], servers in Italia.
- Email delivery: [email provider].
- Check nodes in several countries, used to confirm outages: they only receive the configuration of the checks to run, not your account data.
If you connect Telegram, Slack, Discord or your own webhook, alert texts are delivered to those services, which process them as independent controllers under their own policies. Push notifications pass, encrypted, through your browser's push service (Google, Apple, Mozilla or Microsoft), which cannot read them.
Data is disclosed to authorities only when required by law. It is never made public.
5. Transfers outside the European Union
Data is stored on servers in the European Union. A transfer outside the EU can only happen if you use external services such as those in section 4, or choose check nodes located outside the EU. Such transfers rely on an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework) or on standard contractual clauses (Art. 46).
6. Retention
| Data | Retention |
|---|---|
| Account, monitors, channels, status pages, incidents | Until the account is deleted |
| Individual check results | 35 days, then only hourly and daily aggregates are kept |
| Login sessions (IP and browser) | Until the session expires, at most 30 days |
| Notification delivery log | 90 days |
| Backups | Up to 30 days, then overwritten |
When you delete your account, data is removed from the database immediately; backups containing it are overwritten within 30 days.
7. Your rights
You may at any time request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and object to processing based on legitimate interest (Art. 21).
- In Settings you can edit your profile, download all your data as JSON and delete your account.
- For any other request write to [privacy email]: we reply within one month.
- You can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority of the country where you live or work.
8. Security
Traffic is always encrypted (HTTPS); passwords, API keys and session tokens are stored as hashes only; server access is restricted and protected by cryptographic keys; security updates are installed automatically and the database is backed up daily. If a personal data breach is likely to put you at risk, we will inform you as required by Articles 33 and 34.
9. Minors
The service is reserved for adults.
10. Cookies
We only use technical cookies required for the service to work: see the Cookie policy.
11. Changes
The date of the last update is shown at the top. Material changes are announced by email or in the app before they take effect.