Stackbrace is run by Vincent Jacobs, trading as Code & Vin, in South Africa, and Vincent Jacobs, trading as Code & Vin is responsible for the personal information it holds under the Protection of Personal Information Act (POPIA). To ask about anything here, write to Vincent@codeandvin.com.
What Stackbrace collects
- Your login: your email address, your name if you give it, and your password as a one-way hash, never the password itself. If you turn on two-factor login (we advise it), the key your authenticator app shares with Stackbrace is kept encrypted, and your recovery codes only as hashes. We email you when two-factor login is set up or moved to a new phone, when a recovery code is used, when new codes are made, and when someone gets your password right but the code wrong.
- What you record in the registry: who holds each account, who can make changes, and where logins are kept, such as “the finance team’s vault”. These entries can name people, such as your developer or IT lead. Stackbrace never asks for, and has nowhere to store, a password for any website you monitor.
- What Stackbrace finds about your sites: the results of its checks and scans, which only use what anyone can see of a site from outside.
- What people in your account do: an activity log of changes, with the name of whoever made them, and the email addresses of people you invite.
- GitHub, if you connect it: the names of the GitHub accounts and repositories you let Stackbrace read, the access each person in your account has to them, which site each repository is for, and the packages and versions listed in each repository’s lockfiles. Stackbrace reads nothing else in a repository and keeps no GitHub login: the access GitHub gives it is used once and handed back.
- Payments: handled by Dodo Payments. Stackbrace receives the subscription’s status, the amounts paid, and the name and email address given at checkout. It never sees card details.
- The public check: the domain you enter, and the general result, kept for a day so the same site is not checked again and again. Your internet address is used, without being stored, to limit how often one visitor can check.
- The Agency waiting list: the email address and answers you leave on the form, used only to tell you when Agency is ready.
- Visits to the public pages: on the front page, pricing, help, the check, the samples and these policies, which page a visitor opens, the site they came from and any campaign tag in the address, and whether a check was started. Stackbrace counts these itself, to see which pages bring people to it; no other company is involved and no cookie is set. One visitor’s pages in a day are tied together by a code made from their internet address and browser for that day only, which cannot be turned back into either, and the internet address itself is not kept. Visits by someone logged in are not counted, and nothing inside Stackbrace is: none of its other pages, nor anything about your sites.
Why
To run the service you signed up for: to watch your sites, tell the right people when something breaks, keep the record of who controls what, and send the summaries you receive. Stackbrace does not sell personal information, does not use it for advertising, and does not track you across other websites.
People you record
When you record other people in your account, your organisation decides what is recorded and why, and is responsible for it under POPIA. Vincent Jacobs, trading as Code & Vin holds and processes it on your behalf, only to run Stackbrace for you, and keeps it secure and confidential.
Who else handles it
Stackbrace uses a few other services to do its job. Some of them are outside South Africa; sending information to them is needed to provide the service you signed up for.
- Hetzner Online, whose server in Helsinki, Finland, in the European Union, runs Stackbrace and stores everything.
- Resend, which delivers Stackbrace’s emails, so it sees the email addresses they go to.
- Dodo Payments, which sells and bills subscriptions as the merchant of record. What you give at checkout is also covered by Dodo’s own privacy policy.
- Slack, if you connect it, which receives your alerts in the channel you chose.
- GitHub, if you connect it, which is asked for the lockfiles of the repositories you linked and about the versions of the packages in them. GitHub knows who connected Stackbrace, as it does for any app you install there.
- A heartbeat service, if you set one, which is called once a minute and is sent nothing else.
- A webhook address, if you set one, which is sent each alert: the site, what failed, who the registry says holds the login for that layer, and the first steps written for it.
- Google Web Risk and WordPress.org, which are asked about your sites’ addresses and software, and Team Cymru, which is asked about your sites’ internet addresses. None of these is sent anything about you.
- Wordfence, CISA (the US Cybersecurity and Infrastructure Security Agency), endoflife.date and Retire.js, whose lists of known vulnerabilities and unsupported software Stackbrace downloads whole once a day. None of them is sent anything: not which sites you watch, nor anything about you.
How long it is kept
For as long as your account exists, except the result of each individual uptime, certificate and domain check, which is kept for 90 days; outages, findings and the registry stay. Deleting your account removes everything recorded in it at once; copies in backups are gone within 30 days. Deleting your login removes your personal details, though the activity log of an account you belonged to keeps your name against what you changed. Records of payments received from Dodo Payments are kept after an account is deleted, for accounting. The Agency waiting list is kept until Agency is ready or you ask to be taken off it.
Cookies
Inside Stackbrace, only the cookies it needs: those that log you in and keep you logged in, and one that lasts ten minutes while you connect Slack or GitHub. The public pages set none: visits are counted without one. No advertising cookies, and nothing that follows you to other websites.
How it is protected
Every connection is encrypted. Logging in takes your password and a code from your phone. Passwords are stored only as hashes, and the tokens you save on the settings screen are sealed with a key kept apart from the database. Specifics about a site, such as usernames and versions, are shown only to someone who has proved they control its domain.
Your rights
You can see, correct, download or delete the personal information Stackbrace holds about you, and object to how it is used. You can download your data and delete your login yourself from the Team page, and delete a whole account from Settings. For anything else, write to Vincent@codeandvin.com. If you are not satisfied with the answer, you can complain to the Information Regulator.
Changes
If this policy changes in a way that matters, everyone with an account is told by email before it takes effect.