Cyclopes is an error, log and uptime monitor. You point your application at it, it stores what your application sends, and it wakes somebody up when that stops looking healthy. This page says what it holds, why, for how long, and how to make it stop.

Two different things are described below and it is worth keeping them apart. The account is what we hold about you: an email address and who you work with. The telemetry is what your application sends us about the people using it. The telemetry is yours. We hold it to run the service for you and for no other purpose, we do not decide what goes into it, and you can have it deleted at any time.

Who we are

SUPERDARKCODELABS PVT LTD, operating Cyclopes at https://cyclopes.localhost.co.zw. Write to cyclopes@localhost.co.zw about anything on this page, including a request to see, correct or delete what we hold. A person reads it, and replies within one working day.

What we collect

Your account

• Your email address, and your name if you give one.
• Your password, stored only as a salted hash. We cannot read it, and neither can anyone who takes a copy of the database.
• Which organizations you belong to and what role you hold in each.
• API tokens the companion app has been issued. Stored as hashes, the same way passwords are, so a leaked database does not hand anyone a session.

People you have asked us to wake up

• Alert contacts: a name, and an email address, phone number or WhatsApp number, for each person an alert should reach. These are often not Cyclopes users, which is the point of them, so you are responsible for having told them they are on the list.
• A record of pages sent to them: when, by which rule, on which channel, and whether it was delivered and acknowledged.
• Push notification tokens for handsets the app is signed in on. A token identifies a device to Apple or Google, not a person, and it is rotated by the operating system rather than by us.

What your application sends

All of this arrives because your code called our SDK. What is in it is your decision, not ours.

• Errors: the exception, the stack trace, and whatever context your SDK was configured to attach, which typically includes the request path, the release, the environment, and a user or session identifier if you set one.
• Log lines: the message, level, timestamp and any attributes you attached.
• Activity: screen and action names, session identifiers, and the user identifier you chose to pass. We never see your users' names or email addresses unless you put them in the payload yourself.
• Monitor checks: the URL we check, and the result and response time of each check.

Please do not send us payment card numbers, health records, government identifiers or passwords. Nothing here needs them, and the terms forbid it. Redact at the SDK, before it leaves your process.

Running the service

• A session cookie and a CSRF cookie while you are signed in. Both are strictly necessary; there are no advertising or analytics cookies on this site, and no third-party trackers on any page of it. Your theme choice is kept in your own browser and never sent to us.
• Your IP address, briefly, to rate-limit sign-in and pairing attempts, and in an audit record when an administrator acts on an account.
• If you buy credit: the amount, the currency and the transaction reference. Card and mobile-money details are handled by our payment provider and never reach our servers.

Why we are allowed to hold it

• To perform our contract with you: your account, your organizations, your telemetry, and the alerts you configured.
• Our legitimate interest in keeping the service up and not being abused: rate limiting, audit records, and security logging.
• Your instruction, for anything optional you switch on.

We do not sell data, we do not share it for advertising, and we do not use your telemetry to train anything. There is no profiling and no automated decision-making that has any effect on you.

How long we keep it

Telemetry ages out on its own, every night, whether or not you ask. These are the defaults; a paid plan may extend the first one, and your organization's settings are the authority for your account.

• Errors and their events: 90 days.
• Log lines: 30 days.
• Activity and journeys: 90 days.
• Monitor check results: 90 days.

Your account and organizations are kept until you delete them. Billing records are kept for as long as the law requires us to keep them, which is longer than everything above.

Who else touches it

Only these, only to deliver the service, and none of them for their own purposes.

• Our hosting and database provider, where the service runs.
• Our SMS and WhatsApp delivery partner, which receives the phone number and the text of a page when an alert is sent that way.
• Apple and Google, which carry push notifications to handsets. They receive the notification and the device token.
• Our email provider, which carries sign-in, alert and account mail.
• Our payment provider, which handles card and mobile-money details directly so that we never hold them.

We may also disclose data if the law requires it. If that happens we will tell you, unless we are forbidden from doing so.

Where it lives

On servers in Zimbabwe, operated on our behalf by our hosting provider.

The delivery partners above may carry a message outside that region, because that is where the recipient's phone is.

What you can ask for

• A copy of what we hold about you.
• A correction, if it is wrong.
• Deletion. There is a button for it: delete your account. It is not instant on purpose. We wait 7 days, and signing in again at any point in that window calls the whole thing off, which is what stops a stolen phone from being able to erase you.
• A machine-readable export, or a restriction on what we do with it.
• To object to processing we do on the basis of our legitimate interest.

Ask at cyclopes@localhost.co.zw. We do not charge for any of it. If you are unhappy with our answer you can complain to your local data protection authority.

If you are one of our customer's users and you have arrived here because you saw Cyclopes named in an app, we hold your data on their instructions and not our own. Ask them, and we will help them answer.

Keeping it safe

• Everything travels over TLS. Nothing is served unencrypted.
• Passwords and API tokens are stored only as hashes.
• Every query is scoped to the organization that asked it. An account cannot address another organization's data even by guessing an identifier: it is answered as though it does not exist.
• The companion app is read-only. Nothing it can do changes anything on the server except your own account.

If a breach affects you, we will tell you and the relevant authority within the time the law allows, and we will say what actually happened.

Children

Cyclopes is a tool for people who run software, and is not intended for anyone under 16. We do not knowingly hold an account for a child. If you believe we have one, write to us and it goes.

Changes

If this page changes in a way that matters, we will email account holders before it takes effect rather than quietly moving the date at the top.

See also the terms of service and the support page.