myprojects.healthmyprojects.health
Log inStart free trial

Privacy Policy

Last updated 22 August 2026

myprojects.health is operated by ActivLife Hub LLC(“we”). This page says what we store, where it is, how long it stays, and how to get rid of it.

What we store

  • Your account. Your email address, and a phone number if you choose to add one for emergency alerts.
  • What you describe. Your projects and the services they use — names, providers, plans, costs, billing cycles, renewal dates, balances, usage, notes. Whatever you enter.
  • Credentials you connect. API keys for providers you ask us to check. See the section below — it matters more than the rest of this page.
  • What we observed. Check results, issues, incidents, and a record of every alert we sent you.
  • Billing. Subscription state and an identifier from our payment processor. We never see or store your card details.

Credentials — read this part

Reading your providers’ account state is the point of the product, and it means you may give us real API credentials for infrastructure you depend on.

  • They are encrypted at rest with AES-256-GCM, in a table separate from everything else.
  • They are decrypted only inside the component that runs a check, for the duration of that call.
  • The interface only ever shows a masked hint — the last few characters.
  • They are never included in an export, an API response, or an outgoing webhook.
  • Deleting a connection deletes the credential immediately and irreversibly.

Several providers do not issue read-only credentials at all. Where that is the case, the credential you give us is more powerful than the reading we do with it. We tell you so on the screen before you paste anything, and we only ever send read requests. As of today that applies to:

  • Vercel — Vercel does not issue read-only tokens. Any token you create carries your write access to the scoped team. We only ever send GET requests, but you are granting more than we use.
  • Neon — Neon API keys are account- or organization-scoped and carry write access. There is no read-only key. We only send GET requests.
  • Resend — Resend offers only "sending access" or "full access" — there is no read-only key. A full-access key can also send email and manage contacts. We only send GET requests.
  • fal.ai — fal keys are not scoped — the same key can run paid inference. We only read the balance endpoint. The balance endpoint itself is undocumented and may change without notice; if it does, this connector reports Unknown rather than Healthy.

The encryption key is held in the application’s environment, alongside the database. Someone who compromised our hosting account would have both. Separating them with a managed key service is planned and not yet in place. We would rather write that down than imply a guarantee we cannot make.

What we do not store

  • Card numbers.
  • Your customers’ data. We read provider metadata — quotas, deployment states, balances, delivery statistics — not the contents of your databases or your users’ records.
  • Advertising or tracking identifiers. There are no third-party analytics or advertising scripts on this site.

Where it lives, and who else sees it

The application and its database run on infrastructure in the United States. We use processors for three things only: sending email, sending SMS, and taking payment. Each receives only what it needs for that one job — an address and a message, a number and a message, or a subscription and a card. We do not sell data and we do not share it for advertising.

How long we keep it

  • Raw check results: about 42 days, then deleted automatically. Nobody needs a year of “03:05 OK”.
  • What actually happened: incidents, recoveries, alerts and daily summaries are kept while your account exists, because that is the history worth having.
  • After you cancel: your data stays exportable for about 30 days, and may then be deleted.

Your control

  • Export everything as JSON or CSV, for any period, from Settings. No request, no waiting.
  • Delete a credential from Connections — immediate and irreversible.
  • Delete everything from Settings: the account, every project, every incident and every stored credential, at once.
  • If you would like a copy of what we hold, or a correction, write to us and a person will do it.

Cookies

One: a sign-in session cookie. It is httpOnly and same-site, and exists so you do not have to click a sign-in link on every page. There are no analytics or advertising cookies.

Changes and contact

If this policy changes materially we will say so by email before it applies to you. Questions go to our contact page.