Privacy policy
What we collect, how long we keep it, and how to take it back.
Draft · 25 August 2026
This is a draft. No lawyer has read it. Every fact below was read out of the source code, not written from a template. It may still be wrong, and it may change before the service opens to the public. Ask if a clause matters to you.
1. The short version
- The collector sends machine measurements. It never sends the contents of your files, your logs, your environment variables, or your network traffic.
- Measurements are kept for 31 days, then dropped.
- Account data is kept until you delete the account. An account that never confirms its email address is deleted after 7 days.
- You can export your account data and delete everything, over the API, on your own. The export leaves out your password hash and the raw measurements.
- Your data is not sold, and it is not used to train a model.
2. What the collector sends
The collector pushes one batch of measurements at a time, in InfluxDB line protocol, over HTTPS. Each line is a measurement name, a few labels, some numbers, and a timestamp. The list below is read from a recorded batch and from the queries this service runs. The collector is open source, so you can read its source yourself and confirm it.
| Measurement | What it carries |
|---|---|
obs_cpu | Core count; the busy, user, system, iowait, steal, and idle shares as percentages; and the user, system, idle, nice, iowait, irq, softirq, and steal totals as cumulative seconds. |
obs_load | The 1, 5, and 15 minute load averages. |
obs_mem | Total, used, available, free, cached, and buffered memory in bytes, and the used percentage. For swap: total, used, and free bytes, and the used percentage. |
obs_disk | Per filesystem: the device name, the filesystem type, the mount path, total, used and free bytes, the used percentage, and the inode counts. |
obs_diskio | Per device: bytes and operations read and written, and the time spent on them. |
obs_net | Per interface: the interface name, bytes and packets sent and received, and the error and drop counts. |
obs_host | The hostname, the CPU architecture, the kernel version, the operating system, the platform and its version, the uptime, the boot time, and the process count. |
obs_agent | The collector's version, its start time, and whether it is up. |
obs_update | The result of the collector's last self-update check, and the host's role label if you set one. |
obs_docker_* | Per container: the container name, the image name, whether it is running, its CPU and memory use, its memory limit, its restart count, and its network bytes. |
The mount path, the device name, the interface name, the hostname, the container name, and the image name are text your machines chose. If you name a machine or a container after a customer, that name reaches this service. Nothing else in the list is free text.
The collector reads no file contents, no process command lines, no environment variables, and no packet payloads.
3. What the service stores about you
| Data | Why | Kept for |
|---|---|---|
| Your email address | To sign you in and to send account mail. Alert mail is built and not reachable yet. | Until you delete the account. |
| A hash of your password | To check it at sign-in. The password itself is never stored. | Until you delete the account. |
| Passkeys you register | To sign you in without a password. | Until you remove one, or delete the account. |
| A linked GitHub, Google, or GitLab identity | To sign you in with that provider. | Until you unlink it, or delete the account. |
| Session records, with the browser's user agent and IP address | To keep you signed in, and to let you end a session you do not recognise. | Until the session ends, or you delete the account. |
| Device sign-in requests, with the requesting IP address and the client name | So the approval screen can show you where a request came from before you approve it. | 90 days after the request expires, whatever its outcome. |
| Token records: a name, a kind, its scopes, and a hash | To authenticate a machine and to let you revoke it. | Until you delete the account. |
| Host records | To show the fleet. | Until you delete the account. A host that goes silent is marked forgotten after a day, and its row is dropped once it has been silent for 90 days. |
| Lifecycle and change events | To show what changed. | 90 days, then dropped. |
| Findings | To tell you what is wrong. | An open finding stays while the condition holds. A resolved finding is dropped 90 days after it cleared. |
| Metric samples | To draw the charts and run the rules. | 31 days, then dropped. |
A token is stored only as a sha256 hash. A lost token cannot be read back out of the database, by anyone, including James.
The service also writes ordinary server logs. A log line can hold an IP address and a request path. Logs are not part of the export.
4. Cookies
Five cookies exist. Every one of them is set by this service for sign-in or for security. None of them tracks you.
| Cookie | What it is for | Lives |
|---|---|---|
observant_session | Keeps you signed in. httpOnly, Secure, SameSite=Lax. | The session. |
observant_csrf | The cross-site request forgery guard. | 12 hours. |
observant_stepup | Records that you proved a passkey or your password for a dangerous action. | 5 minutes. |
observant_oauth_state | Ties a GitHub, Google, or GitLab sign-in back to the browser that started it. | 10 minutes. |
observant_webauthn | Carries the challenge of one passkey ceremony. | 5 minutes. |
There is no analytics cookie, no advertising cookie, and no third party script on this site. The fonts are served from this domain, so your browser makes no request to a font host.
5. Who else sees your data
| Third party | What it sees |
|---|---|
| The email provider | Your email address and the text of the mail sent to you: an alert, a verification link, a password reset, or a device sign-in approval. |
| GitHub, Google, or GitLab | Only if you choose that sign-in door. The provider learns that you signed in to this service, and this service learns the email address and the account identifier the provider returns. |
| The hosting provider | The servers, the database, and the metric store all run on one rented virtual private server. The provider can reach the disk it lives on. |
PLACEHOLDER — James names the hosting company here. This repository records the machine only by its internal name, so this page does not guess at the company.
PLACEHOLDER — no email provider is configured today. The service speaks plain SMTP and no SMTP host is set, so it writes mail to its own log instead of sending it. Resend is the chosen provider and it is not connected yet. Name it here once it is.
There is nobody else. No analytics service, no advertising network, no data broker, and no AI provider receives your data.
6. Where the data lives
All of it lives on one server, in one place. Nothing is copied to a second region. The database is backed up. The metric store is not backed up, because it holds 31 days of measurements and they are treated as replaceable.
7. Getting your data out
Call GET /api/v1/account/export, or use the account
screen. The export holds the account, your user record, your linked
identities, your passkeys, your tokens, and your hosts. It does not
hold your password hash, and it does not hold raw metric samples.
8. Deleting your data
Call DELETE /api/v1/account, or use the account screen.
It removes your metric series first, then your account row, and every
row that hangs off it follows.
The delete needs a signed-in browser session and a fresh proof: a passkey or your account password. That is on purpose. Deletion cannot be undone, so a stolen token must not be able to do it.
Removing the collector from a server does not delete anything. Delete the account, or wait 31 days for the measurements to expire.
9. Security
Passwords are hashed with argon2id. Tokens are stored as hashes. An ingest token can only write measurements: every route that returns fleet data refuses it. A revoked token stops working immediately, not after a cache expires. Traffic to the service is HTTPS.
The service runs on one server with no redundancy. Read the terms of service before you rely on it.
10. Children
The service is for people who run servers. It is not directed at children, and no account should be created by anyone under 16.
11. Changes to this policy
This policy can change. The date at the top of this page shows the last change. A change that widens what is collected is announced by email before it takes effect.
12. Contact
PLACEHOLDER — James decides the contact address to publish here, and the governing law.