Privacy Policy

This Privacy Policy explains how updates.page ("we", "us") collects, uses, and shares information when you use our website, applications, and services (collectively, the "Service").

Information we collect

• Account information — your name, email address, and password (stored as a salted hash) when you create an account.
• Content — announcements, images, and other content you publish through the Service.
• Billing information — payments are processed by Stripe. We never store your full card details; we retain only a payment method reference, card brand, and last four digits.
• Usage data — log data such as IP addresses, browser type, pages visited, and, for published changelogs, anonymous page-view counts (impressions) that we collect on behalf of the account that owns the changelog.
• Changelog subscribers — if an account enables the email subscription form on its changelog, we store the email address (and name, if given) submitted by anyone who subscribes, on that account's behalf. We do not attach an IP address to that subscription record; requests are still subject to the general log data described above.
• Connected app credentials — if an account connects a third-party tool, we store the API credential it provides, encrypted at rest.

How we use information

• To provide, maintain, and improve the Service.
• To process payments and manage subscriptions.
• To send transactional email such as password resets and billing notices.
• To protect the Service against abuse, fraud, and security threats.

We do not sell your personal information.

Product analytics

We use PostHog to understand how this website and the updates.page dashboard are used. On both, we record page views: the page address, the site you arrived from, and standard details your browser sends such as its type and approximate location by IP. In the dashboard we also associate those page views with your account, so we can see which parts of the product are used. On neither do we record clicks, form input, keystrokes, session replays, or surveys.

PostHog does not run on changelogs hosted on the Service. Our analytics stop at our own domains — updates.page and app.updates.page — and no cookie or tracker of ours is set on a customer's changelog, whether it is served on a subdomain or on their own domain. Analytics on those pages are described below.

Visitors to hosted changelogs

If you visit a changelog hosted on the Service (for example, a customer's subdomain or custom domain), we collect basic page-view analytics on behalf of the account that owns that changelog. The account owner is the data controller for that data; we process it on their behalf.

The same applies if you subscribe for email updates on a hosted changelog. Your address is stored for the account that owns that changelog, and that account decides what is sent to you and when — we do not send you marketing email, and we do not use subscriber addresses for our own purposes. Beyond the subprocessors listed under "Service providers" below, which host and operate the Service, we share them only with the tools that account has connected. If the account has connected a third-party email tool, your address is passed to that tool when you subscribe, and it is then also held under that tool's own privacy policy.

To unsubscribe or have your address removed, contact the account that runs the changelog you subscribed to; they can delete it at any time. You may also contact us at the address below and we will pass the request on.

Service providers

We share data with a small number of subprocessors that help us run the Service:

• Render (application and database hosting)
• Amazon Web Services (file storage)
• Stripe (payment processing)
• Vercel (website hosting)
• Sentry (error monitoring)
• PostHog (product analytics)

Cookies

We use cookies for authentication and session management, and PostHog sets a cookie holding a random identifier so repeat visits can be recognised as the same browser. That cookie is scoped to the individual site that set it — updates.page or app.updates.page — and is not shared between them or with any changelog hosted on the Service. We do not use advertising cookies, and we do not use third-party tracking cookies.

Data retention and deletion

We retain your data for as long as your account is active. You can request deletion of your account and associated data at any time by emailing hey@updates.page.

Security

All traffic to the Service is encrypted in transit with TLS. Passwords are hashed, and access to production systems is restricted.

Changes to this policy

We may update this policy from time to time. We will post any changes on this page and update the "Last updated" date above.

Contact

Questions about this policy? Email hey@updates.page.