Privacy Policy

This policy explains what personal data okokumo collects, why, and your rights over it. For customers acting as GDPR data controllers, see also our Data Processing Agreement.

What we collect

  • Account data: email address, hashed password (bcrypt — never stored or logged in plaintext), optional name.
  • Organization data: organization name, member roles.
  • Alert-channel configuration: destination email addresses, webhook/Slack URLs you configure.
  • Billing data: handled directly by Stripe as an independent processor/controller — we never see your card details.
  • Signup attribution: if you reach us through a campaign link, we record the campaign that brought you — the utm_source, utm_medium, utm_campaign and utm_content values carried in the link, our own placement code, the host of the site that referred you (never the page, never its query string), and the path of the first page you landed on (never its query string). It is stored once, on your organization, at the moment the account is created. We do not record your IP address, your browser or device, any advertising click identifier (such as gclid or fbclid), or anything that would let us or anyone else recognise you on another site. We use it only to count which placements produce signups, in aggregate, and we never share it.
  • Connected apps: if an owner or admin connects an app such as an AI assistant to okokumo through the browser sign-in (OAuth), a record of that connection, described in Connected apps below.
  • Usage analytics: via Matomo, which we run ourselves on our own server in France — no analytics company receives your data, because there is no analytics company involved. What this does and does not mean is set out below.

Analytics, precisely

"Privacy-friendly analytics" is a phrase that hides more than it explains, so here is what our setup actually does.

  • No cookie is set. Not a tracking cookie, not an analytics cookie, none at all — which is why you have never seen a cookie banner here and never will.
  • Your IP address is truncated before it is stored. The last two bytes are dropped, so an address like 82.67.14.203 is written to disk as 82.67.0.0. We keep the country, and nothing that identifies a household or a connection.
  • It is pseudonymous, not anonymous — and the difference matters. To tell two pages read by one person from two pages read by two people, Matomo computes a short-lived identifier from your truncated IP address and your browser's user-agent string. It is not a cookie and it is not stored on your device, but it is a fingerprint, and calling that "anonymous" would be overstating it. It changes every day and it cannot be reversed into an address.
  • That identifier is never shared between our sites. Cross-site fingerprinting is switched off, so a visit to okokumo.com and a visit to another site on the same server cannot be joined into one person.
  • Do Not Track is honoured. If your browser sends the header, nothing about your visit is recorded at all.
  • The server makes no outbound calls. It does not phone home, check for updates, or send us usage reports about itself. Nothing leaves the machine.
  • It runs on our own Scaleway box in France, on the same infrastructure as the rest of okokumo. This is a stronger claim than a hosted analytics product can make: there is no third party in the chain at all, so there is nobody to trust but us.
  • Analytics logs are deleted after 760 days, purged monthly. Reports aggregated from them (visits per week, which pages, which sources) are kept.
  • We do not track outbound links or downloads, and we do not run any other analytics, advertising, or session-recording script anywhere on this site.

We also count a handful of product milestones — an account created, a first check created, an alert delivered — so we can tell whether people get the product working. Those carry no personal data beyond what is described above.

Connected apps

An app — typically an AI assistant using our MCP server — can connect to okokumo through a browser sign-in instead of an API key, once an owner or admin of your organization approves it on a consent screen. For that we store:

  • The app's registration: the name the app gives itself and the addresses it may send you back to after sign-in (its redirect URIs). This describes the app, not you. Until anyone has approved a registration, we also keep the network it was created from — the IP address, or the /64 prefix of an IPv6 address — only to limit how many unapproved registrations one network can create. That is erased at the first approval, and a registration nobody approves is deleted after a day.
  • The connection: which user approved which app, for which organization, when it was approved, when it was last used, and when it was revoked.
  • Tokens: the access and refresh tokens the app uses, and the one-time code it exchanges for them, stored only as SHA-256 hashes — never the tokens themselves — with their expiry times.

Why: to let the app act for the person who approved it, with that person's role; to check every request it makes; to show your organization which apps are connected, by whom, and when they were last used; and to answer a support question about an app that was disconnected.

How long: a connection is kept until it is revoked, even if the app stops being used — it stays listed so you can see it and revoke it. After revocation its record is deleted 30 days later. Tokens and codes are deleted a day after they expire or are revoked. Clean-up runs daily, so each deletion happens on the day it falls due or the day after, never before. If the user who approved a connection, or the organization, is deleted, the connection and its tokens are deleted with it.

How to revoke: in the dashboard, Account → Connected apps lists every app connected to your organization; an owner or admin can revoke any of them there, and the app is refused from its next request. A password reset, a suspended account or removal from the organization revokes every app that person connected.

Why we process it

To provide the Service (account access, monitoring, alerting), to bill you for paid plans, to respond to support requests, and to improve the product via aggregate, non-identifying usage analytics.

Cookies and browser storage

We use no advertising cookies and no cross-site tracking, and there is no cookie banner because there is nothing on this site to consent to. Matomo, our analytics server, stores nothing on your device at all — no cookie and no browser storage. It instead derives a short-lived identifier from your truncated IP address and user-agent string, which is described in Analytics, precisely above; nothing is written to your machine either way.

Two things are kept in your browser. A session cookie signs you in to the app — it is strictly necessary for a service you asked for, and it needs no consent. And if you arrive through a campaign link, the campaign itself is held in your browser's storage so it survives the step from this site to the signup form. It contains no identifier of any kind, it is never sent anywhere except along with your own signup, it is deleted the moment your account is created, and it expires on its own after 13 months if you never sign up.

Where it's stored

On Scaleway infrastructure located in France. See our Security & data page for the full list of sub-processors and technical measures.

How long we keep it

For the lifetime of your account, then deleted or anonymized within a reasonable delay after account deletion — except where French or EU law requires longer retention (e.g. invoicing records, generally 10 years under French commercial law).

Monitoring data has limits of its own that run without you asking. Individual check results are deleted after 90 days. Output your job attaches to a failed heartbeat ping is deleted after 30 days, while the incident record itself — down at this time, back up at that one — is kept. Each of those is a floor rather than an exact date: deletion happens on the day it falls due or shortly after — within a week for a check result, within a day for captured output — and never before. Both windows apply on every plan, free included. The Security & data page explains them in full, including why the numbers are 90 and 30.

Signup attribution is erased from your organization 25 months after the organization was created, whether or not the account is still active — it serves no purpose beyond that point.

Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request erasure ("right to be forgotten").
  • Request a portable export of your data — available at any time from your account settings.
  • Object to or restrict certain processing.
  • Lodge a complaint with your national data protection authority (CNIL in France).

To exercise any of these rights, contact us using the details in our legal notices.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to active account owners in advance where reasonably possible.