Privacy notice
Last updated 15/10/2026
SEC Watch keeps only what it needs to run your account and send your alerts. There's no advertising, no tracking and no selling of data.
Who runs SEC Watch
SEC Watch is run by Kyle Torbett, based in Scotland, United Kingdom, who decides how your information is used. For anything about your information, email support@secwatch.app.
What's collected, and why
| Information | Why it's needed |
|---|---|
| Your email address | To sign you in, send invitations and password links, and tell you about important changes to your account |
| Your password, stored only in scrambled (hashed) form | To check it's you signing in. Nobody can read your password, including the people who run SEC Watch. |
| The companies and people you follow, your alert rules and your appearance settings | To decide which alerts to send you, and how the site looks for you |
| Your alert topic and the alerts sent to you | To deliver alerts and show your recent ones |
| When your account was created, when you last signed in, and for each signed-in device when that sign-in started and was last used | To keep you signed in, sign you out after inactivity, and let you sign out other devices |
| If you change your email address: the old and new address | So the old address can undo a change you didn't make, for 7 days |
| Feedback you send from the Feedback page: its type, title and description, and any reply | To fix what's broken, plan changes, and show you the reply. Only the person who runs SEC Watch can see it. |
| Invite requests: your email address | To invite you when there's a place |
| Your IP address, held in the server's memory and not saved by SEC Watch. The secure front end that handles connections may record it in an error log if something goes wrong. | To limit repeated failed sign-ins and other requests, so nobody can guess passwords or flood the service |
| Server logs of what SEC Watch is doing, such as which account an alert was sent to, or that an email couldn't be delivered (with the address) | To keep the service working and fix problems |
The legal basis is that this information is needed to provide the service you asked for (contract), and, for request limits and logs, the legitimate interest of keeping the service and its users safe.
Who else handles it
A few services help run SEC Watch, each handling only what it needs:
- Hetzner Online, which hosts the server in Germany, where all account data is stored
- Resend, which delivers SEC Watch's emails from its EU region
- ntfy.sh, which delivers alerts to the ntfy app on your phone. Alert text passes through its servers, which also see your phone's IP address when the app connects. Anyone who knows your topic name can read your alerts, so keep it private.
- Cloudflare, which provides the domain's DNS and forwards mail sent to support@secwatch.app
Your information is never sold or shared for marketing. Where a provider is based outside the UK, SEC Watch relies on the safeguards UK data-protection law provides for that, such as adequacy decisions and standard contractual clauses.
Cookies and storage
SEC Watch uses one cookie, which keeps you signed in and can't be read by the page's scripts. Your browser also remembers your theme and colour choice. There are no advertising or analytics cookies, so there's no cookie banner.
How long it's kept
- Account information: until you delete your account
- Sign-ins: until they expire or you sign out (at most 30 days)
- Feedback tickets: until you delete your account
- Invite requests: until you're invited, or for 12 months, whichever is sooner. A short note of each new request is also emailed to the support mailbox, and deleted when it's no longer needed.
- Records of an email address change: 7 days
- Server logs: limited in size, with the oldest entries removed as new ones are written, and cleared when SEC Watch is rebuilt
- Backups of the whole server: 7 days, so deleted information disappears from backups within a week
Your rights
You can see, correct, download or delete your information, object to how it's used, or ask for its use to be limited. Most of this you can do yourself under Account: change your email address, download your data, or delete your account and everything in it. Copies in logs and backups disappear as those are replaced. For anything else, email support@secwatch.app.
If you're unhappy with how your information is handled, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
SEC Watch is served only over encrypted connections, passwords are stored with a deliberately slow scrambling method, and sign-in attempts are limited. If you find a security problem, please email support@secwatch.app.
Changes
If this notice changes in a way that matters, you'll be told by email before the change takes effect.