What we keep, and why.

SIGNING IN WITH GOOGLE

When you sign in with Google we receive and keep your email address, your name and your Google account id. We ask only for the openid, email and profile scopes. We never see your Google password and we do not read your mail, contacts or files.

Sign-in is invite-only. If you sign in without an invite, we keep your email address and name as an access request so we can answer it.

COOKIES

We set two cookies, both needed for sign-in: a session cookie that keeps you signed in for up to 30 days, and a short cookie that protects the Google sign-in step and expires after 10 minutes. We store only a hash of the session id. If you press the light/dark button, a third cookie, av_theme, remembers that choice for a year; it holds only the word light or dark. We set no advertising cookies.

On our public pages only (home, the guide, pricing, bot policy, this page and public status pages), Microsoft Clarity may set its own first-party and third-party cookies, such as _clck and _clsk, to tell a returning visitor from a new one. Clarity never runs on the sign-in pages, the dashboard or the admin panel. You can block these cookies in your browser; the site works the same without them.

HOW WE SEE HOW THE SITE IS USED

We use Microsoft Clarity to see how visitors use our public pages: clicks, scrolling and mouse movement, shown to us as heatmaps and session replays. We use this only to make the pages clearer. Clarity masks what you type into forms. This data is collected with first-party and third-party cookies and similar technologies. For how Microsoft collects and uses this data, see the Microsoft Privacy Statement.

We also count page views on the same public pages with Cloudflare Web Analytics, which sets no cookies.

The free lookup (the public search and the MCP server without a key) counts requests per IP address for one minute, to stop abuse. We do not store the address.

WHAT YOUR TEAM STORES

The monitors your team creates (names, target addresses, request headers, canary questions and expectations), the results of each check, state changes, claims, and your alert settings: a Telegram chat id and a webhook address with its signing secret. API keys are stored only as a hash.

Check results are deleted after 30 days and alert records after 90 days. Sessions are deleted when they expire or when you sign out.

WHO PROCESSES IT

Cloudflare hosts the service and its database, runs the judge model that reads canary replies (Workers AI), and counts page views on our public pages (Web Analytics). Microsoft records how our public pages are used (Clarity). Google handles sign-in. Telegram delivers alerts if you set a chat id. A canary question is sent to the AI endpoint you configured, and an alert is posted to the webhook address you configured.

We do not sell your data, we do not show ads, and we do not use your data to train models.

YOUR CHOICES

Write to support@agentviva.dev to see the data we hold about you, to correct it, or to have your account and your team's data deleted. You can delete monitors and replace your API key yourself in the dashboard at any time.

If this policy changes, we will update the date at the top of this page.