Legal & Compliance

Privacy Policy

Last updated: November 5, 2026 • Effective immediately

1. Introduction

ExpiryHawk ("we", "our", or "us"), accessible at https://expiryhawk.com/, provides automated SSL/TLS certificate monitoring, domain expiration tracking, and multi-channel notification services.

We respect your privacy and are committed to protecting any personal data you share with us. This Privacy Policy explains what information we collect, why we collect it, how it is handled, and your rights regarding your personal information.

2. Information We Collect

We only collect information strictly necessary to provide and secure our monitoring services:

  • Account Credentials: When you register an account, we collect your name and email address. For traditional password registration, passwords are cryptographically salted and hashed using standard bcrypt; we never store plaintext passwords.
  • Third-Party Authentication (OAuth): When you sign up or log in using Google or GitHub, we receive basic profile details including your name, verified email address, provider ID, and avatar image.
  • Monitored Endpoints & Target Hosts: Hostnames, domain names, IP addresses, and network ports that you submit for automated TLS diagnostics and WHOIS monitoring.
  • Alert Destination Data: Contact channels you configure to receive expiration alerts, such as alert email addresses, Telegram chat identifiers, Webhook endpoints, or Web Push subscription tokens.
  • Technical Logs & Diagnostic Data: IP addresses (temporarily used for public rate-limiting), browser user agents, and diagnostic connection results needed to maintain operational uptime and security.
3. Google API Services & OAuth User Data Policy

If you choose to authenticate via Google ("Sign in with Google"), our application requests access solely to your basic profile information under the standard openid, email, and profile scopes.

  • How Google data is used: We use your Google account information exclusively to authenticate your identity, create your user session, verify your email address, and dispatch urgent certificate expiration alerts.
  • No secondary use or sale: We do not sell, rent, lease, or transfer Google user data to data brokers, advertising platforms, or any external third parties.
  • No AI Model Training: Google user data is never used to train generalized artificial intelligence or machine learning models.
  • Google Limited Use Requirements: ExpiryHawk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

We process your information strictly for the following purposes:

  • Executing recurring TLS certificate handshakes and DNS/WHOIS expiration checks on your registered endpoints.
  • Sending automated downtime warnings, renewal reminders, and certificate replacement notices via your selected alert channels.
  • Enabling frictionless account authentication via passwords, Passkeys (FIDO2/WebAuthn), and OAuth providers.
  • Protecting against malicious activity, denial-of-service attempts, and automated abuse.

5. Data Sharing and Third-Party Processors

We do not sell, trade, or monetize your personal information. We only share information with reputable infrastructure providers strictly necessary to operate ExpiryHawk:

  • Transactional Email Services: Used solely to transmit email verification links and expiration alert notifications.
  • Security & Abuse Prevention (Cloudflare Turnstile): Used on public diagnostic forms to verify legitimate human requests without tracking user identities.
  • Webhook & Messaging Endpoints: Outgoing alerts are delivered to endpoints (e.g. Telegram, custom Webhook URLs) explicitly designated by you.

6. Data Security & Storage

All communication between your browser and our servers is encrypted using modern TLS protocols (TLS 1.2 and TLS 1.3). Sensitive credentials such as webhook secrets, session tokens, and passwords are encrypted and hashed using industry-standard cryptographic primitives.

7. Your Rights and Account Deletion

You have full ownership and control over your account data:

  • Access & Export: You can view and manage all monitored domains, credentials, and notification channels in your dashboard at any time.
  • Revoking Third-Party Access: You can revoke ExpiryHawk's access to your Google account at any time via your Google Account Permissions page, or via your GitHub Authorized OAuth Apps settings.
  • Account Deletion: You may request the deletion of your account and all associated domain monitoring data by contacting our support team or deleting your monitored items from your dashboard.

8. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to us at:

ExpiryHawk Privacy & Security Team

Website: https://expiryhawk.com/

Email: [email protected]

Also see our Terms of Service.