Privacy Policy

This Privacy Policy explains how Boxing Octopus Creative ("we", "us", or "our"), a company based in Ontario, Canada, collects, uses, and discloses personal information when you use SkinnyStatus at skinnystatus.app and related services (the "Service").

1. Who we are

SkinnyStatus is operated by Boxing Octopus Creative, based in Ontario, Canada. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy law. For contact details, see boxingoctop.us.

2. Information we collect

Depending on how you use the Service, we may process:

• Account data: name, email address, and password hash, or OAuth identifiers from providers such as GitHub or Google when you sign in that way
• Team and organization data: team names, membership, and invitations
• Status page and monitoring data: page content, services, check configurations (such as URLs and hosts), and incidents
• Host credentials: credentials you provide for publishing status pages (stored encrypted at rest)
• Subscriber emails: addresses end users submit on public status pages to receive notifications
• Operational data: logs and error monitoring information (including via Sentry when configured)
• Bot protection signals: Cloudflare Turnstile responses when that feature is configured on forms
• Cookies and session data: used for authentication and keeping you signed in
• Local preferences: theme preference may be stored in your browser

3. How we use information

We use information to:

• Provide, operate, and improve the Service
• Authenticate users and manage teams and invitations
• Run checks, render status pages, and publish to hosts you configure
• Send transactional and status-related email (including via Mailgun when configured)
• Protect against abuse and bots
• Monitor reliability and diagnose errors
• Communicate about the Service, security, and material policy changes

4. Consent and purposes

Under PIPEDA, we collect, use, and disclose personal information for purposes a reasonable person would consider appropriate in the circumstances, and with your knowledge and consent except where the law permits or requires otherwise. By creating an account, using the Service, or submitting information (such as a subscription email on a status page), you consent to the practices described in this Policy for the purposes listed above.

You may withdraw consent for optional uses, subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to provide some features. Where another region's privacy laws also apply to you, we will respect those requirements as well.

5. Sharing with service providers

We may disclose personal information to service providers that help us run SkinnyStatus, which may include Mailgun, Cloudflare (including Turnstile), OAuth providers, hosting and storage providers, and Sentry. These parties are expected to use the information only to provide services to us (or as otherwise required by law). We do not sell personal information.

6. Data retention

We retain account, team, and status-related data while your account is active and as needed to operate the Service. We may retain limited records after deletion or closure for security, dispute resolution, backups, and legal compliance, for as long as reasonably necessary. Subscriber emails are retained in connection with the status pages they subscribed to until they unsubscribe or the relevant data is removed.

7. Security

We use reasonable technical and organizational measures to protect information, including encryption for sensitive host credentials at rest and access controls on our systems. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials.

8. Your rights

Under PIPEDA and other applicable Canadian privacy law, you may have the right to access personal information we hold about you, to challenge its accuracy and completeness, and to request correction. You can often update or delete account information through account settings. Status page subscribers can unsubscribe via the links in notification emails or related unsubscribe flows. To make an access, correction, or other privacy request, contact us through boxingoctop.us. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

9. Cross-border transfers

Personal information may be processed and stored outside Canada, including by service providers in other countries, where privacy laws may differ. When we transfer personal information outside Canada, we take steps we consider appropriate in the circumstances (such as contractual and organizational measures) so that the information receives a comparable level of protection while it is being processed. By using the Service, you acknowledge that your information may be subject to the laws of those other jurisdictions, including lawful access by foreign authorities.

10. Children's privacy

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 without appropriate consent as required by law. If you believe a child has provided us information improperly, contact us and we will take appropriate steps to delete it.

11. Changes

We may update this Privacy Policy from time to time. We will post the updated policy with a revised "Last updated" date. Material changes may also be communicated through the Service or by email when practical.

12. Contact

Privacy questions: visit boxingoctop.us.