Privacy policy

Effective 1 October 2026. Applies to calert.net, operated by APPS34.

Who is responsible

The data controller is APPS34, SARL, 48 Rue Claude Balbastre, 34070 Montpellier, France (RCS Montpellier 944 081 553). Contact for anything in this policy: info@calert.net. The full legal notice is on ctlogs.dev/about.

What the service does

CAlert watches the public Certificate Transparency (CT) record, through the index that ctlogs.dev (also operated by APPS34) builds from the public CT logs, and tells you when a certificate for one of your domains appears. Certificate data (domain names, issuer, validity dates) is published by certificate authorities, is public by design and is not information about you; the domains you choose to watch and where alerts go are your configuration, described below.

Your account

Sign-in. You sign in with GitHub or Google. We receive from the provider your account identifier and your verified e-mail address, and nothing else; we do not receive your password. We store the e-mail address and the provider identifiers to recognise you next time and to link both providers to one account.

Cookies. A session cookie (strictly necessary, first-party, valid for 30 days) keeps you signed in; signing out deletes the session. A second first-party cookie lives for ten minutes during the sign-in redirect to protect it against forgery. There are no other cookies.

What the dashboard stores. The domains you watch and their settings; the alert channels you add (e-mail addresses, webhook URLs and the signing secret of each webhook); the alerts raised for your domains (the certificate's names, issuer, validity dates and when it was first logged); and, for each alert, the deliveries made and every attempt with its status, response code, error and duration. You can delete domains and channels from the dashboard at any time.

Retention. Alerts are deleted 30 days after the certificate they concern expires; the dashboard shows the last 30 days (Free) or the last year (Team, Business). Delivery records and attempts are deleted after 90 days.

Deleting your account. Write to info@calert.net from the address you signed in with; alerts stop at once and the account and its data are erased within 30 days.

Alert e-mails and webhooks

E-mail. Alerts are sent from our own mail relay (mail.calert.net) to the addresses you add. An address receives alerts only after its owner confirms it by clicking the link we send, and every alert carries a one-click unsubscribe link. The relay's standard mail logs (recipient, time, delivery result) are rotated after about four weeks.

Webhooks. Alert payloads are sent to the HTTPS URLs you configure, signed with the secret shown to you when the webhook is created. What the receiving service does with them is under your control.

Visiting the website

IP addresses are used transiently to rate-limit sign-in attempts and confirmation e-mails; they are not stored by us. Visitor statistics are counted by a self-hosted Plausible Analytics instance (plausible.apps34.com) that APPS34 runs on its own infrastructure: no cookies, no cross-site tracking, aggregate counts only, nothing shared with third-party analytics providers.

Who else sees data

We use these providers, each of which sees only what its role requires:

• Hetzner Online GmbH (Germany) hosts the application and its database; UpCloud (data centre in Frankfurt, Germany) hosts the mail relay. All stored data lives in the EU.
• Cloudflare serves the site and terminates TLS; it sees standard request metadata including your IP address.
• Google Fonts serves the web fonts; your browser requests them directly from Google.
• GitHub and Google act as sign-in providers; their own policies apply to your account with them.
• Your e-mail provider and the webhook endpoints you configure receive the alerts you asked for.

We do not sell data, do not run advertising, and do not share personal data with anyone else unless the law requires it.

Legal basis and your rights

We process account, configuration and alert data on the basis of the contract you enter by creating an account; rate-limiting data and visitor statistics on the basis of our legitimate interest in operating and securing the service; and correspondence on the basis of our legitimate interest in answering you and of our legal obligations.

Under the GDPR you may ask for access to, rectification or erasure of your personal data, ask us to restrict or object to its processing, and receive a copy in a portable format. Write to info@calert.net; we answer within one month. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

Changes

We will update this page when the service changes. The effective date at the top tells you which version you are reading.