Privacy

Last updated: November 11, 2026.

This page says what personal data imsu.io collects, why, who else sees it, how long it is kept, and what you can ask for. It covers the website and web app, monitors and alerts, status pages, the REST API and the MCP server.

imsu.io is run by Burak Sarıca, an individual based in Turkey, who decides how your data is used (the data controller). Write to [email protected] about anything on this page.

imsu.io's servers and database are in the European Union.

• We collect what the service needs: your email address, name and password (stored only as a hash), your monitors and their results, and the alert channels you connect.
• We don't sell personal data and don't use it for advertising.
• Google Analytics runs only if you accept it in the cookie banner.
• Apps you connect through MCP, and scripts that use your API keys, see what you allow them to see. What they do with it is up to them and their providers.
• You can ask for a copy of your data, a correction, or the deletion of your account by email.

• Email address, display name and password. To create your account, sign you in and contact you about it. The password is stored only as a salted hash (PBKDF2); nobody, including us, can read it.
• Sign-in times and email verification. When you signed up, last signed in and verified your address, to keep the account secure.
• Account membership and plan. Which account you belong to, your role, and the account's plan and limits.

• Monitor settings. Names, URLs, hosts and ports, intervals, keywords and the other settings you choose, to run the checks.
• Check results. For each check: when it ran, whether it was up, the status code, the response time and our own short error message (such as "timeout" or "unexpected status 503"). We don't store the response bodies of the sites we check.
• Heartbeat pings. When your job pinged its URL, and the run id and progress it sent. We don't store the IP address the ping came from.
• Incidents. When a monitor went down and came back, and why.
• Alert channels. Your alert email address, and the Slack webhook URL or the Telegram bot token and chat id you connect, to send alerts. Alerts carry the monitor's name, its target and the cause of the incident.
• Sent alerts. Who each alert went to, on which channel, and whether it was delivered.

The sites and ports we check see requests from imsu.io's servers (imsu.io bot lists their addresses and user agent). Any personal data in them is part of your own service; we act on your instructions when we check it.

• A status page you publish shows the names of its monitors, whether they are up, and their uptime over the last 24 hours to anyone with its link. It never shows the URLs, hosts or ports the monitors check.
• If you protect a page with a password, we store the password only as a salted hash.
• We don't keep a list of who visits a status page. A visitor who enters the password gets a cookie that keeps the page unlocked in that browser for 7 days (see Cookies).

• API keys. Each key's name, scopes, first characters, expiry and when it was last used. The key itself is stored only as a hash and is shown to you once, when you create it.
• Requests. We don't keep a log of API requests or their bodies. If a request sends an Idempotency-Key, we keep a hash of the request and our response for 24 hours, so a retried request gets the same answer.

When you connect an AI app (such as Claude, ChatGPT, Cursor or VS Code) to imsu.io through MCP, you sign in to imsu.io and choose what the app may do. Then:

• About the app. We store the app's name, website, return addresses and the other details it registered or published at its client ID URL. To read a published client ID URL, our server fetches it.
• About the connection. Who connected the app, to which account, with which permissions, when, and when it was last used. Access and refresh tokens are stored only as hashes. An access token works for 60 minutes and a refresh token for 30 days.
• Tool calls. We don't log the calls an app makes or their arguments. The results go to the app: your monitors' names, targets, settings and status, and heartbeat ping URLs. The app and its AI provider handle them under their own privacy terms, not ours. Connect only apps you trust, and disconnect them in Settings → Connected apps when you no longer use them.

We record each change to a monitor (created, changed, paused, resumed, deleted): when, what changed, and who made it: you on the website, which API key, which connected app, or imsu.io support. You see this on the monitor's page and under Settings → Connected apps. It lets you check what an app or a script did.

• Our web server logs each request: the IP address, time, requested address, status code, referring page and browser (user agent). Sign-in addresses that carry one-time values are logged with those values removed. We use the logs to keep the service running and secure, and to investigate abuse.
• To slow down abuse, we count recent requests per IP address, API key or connected app in memory. These counts are not stored.
• Sign-in and registration use Cloudflare Turnstile to tell people from bots (see Who else processes data).

Change your answer at any time with Cookie settings at the bottom of the home page and the docs. If you turn analytics off, we delete its cookies in this browser.

With analytics on, Google Tag Manager loads Google Analytics, which records the pages you visit, the device and browser, an approximate location from the IP address, and a few product milestones: an account was created, its first monitor was made, it reached five monitors. These events carry no email addresses, names or URLs. We use them to see how people find and use imsu.io.

We use these providers to run imsu.io. Each one gets only what its job needs.

Apps you connect through MCP, and the AI providers behind them, are not our providers: you choose them, and their own terms apply.

Some of these providers are based outside the European Union and Turkey, mostly in the United States. They process data under the safeguards their terms provide, such as the European Commission's Standard Contractual Clauses.

We share personal data with anyone else only if the law requires it.

Deleting a monitor stops its checks and alerts and hides it. Its raw checks and pings still age out on the schedule above; its settings and incidents stay until your account is deleted.

When you ask us to delete your account, we delete it and its data within 30 days, except what the law requires us to keep.

Under the EU and UK General Data Protection Regulation (GDPR) and Turkey's Law on the Protection of Personal Data (KVKK, No. 6698), we rely on:

• The contract with you, for your account, monitors, alerts, status pages, API keys and connected apps.
• Our legitimate interests, for server logs, security, abuse prevention, the record of changes, and the fonts the site needs.
• Your consent, for Google Analytics. You can withdraw it at any time with Cookie settings.
• Legal obligations, when the law requires us to keep or disclose data.

You can ask us for:

• a copy of your personal data, also in a machine-readable form;
• a correction of data that is wrong;
• the deletion of your account and data;
• a limit on, or an objection to, how we use your data;
• withdrawing your consent to analytics, which you can also do with Cookie settings.

Write to [email protected] from the email address of your account. We answer within 30 days. Much of your data you can see and change yourself in the web app: your monitors, alert channels, API keys and connected apps.

If you think we handle your data wrongly, you can complain to a data protection authority: in the EU, the one where you live or work; in Turkey, the Personal Data Protection Authority (KVKK).

Connections use HTTPS. Passwords, API keys, OAuth tokens and status page passwords are stored only as hashes. Monitors can only check addresses that are reachable from the public internet. Suspending or deleting an account, or removing someone from it, ends its API keys and connected apps at once.

imsu.io is not meant for anyone under 16, and we don't knowingly collect their data.

When we change this page, we update the date at the top. If a change matters to how we use your data, we tell account owners by email before it applies.