Privacy policy

This notice explains how CT Monitoring processes information for its public statistics and optional certificate monitoring.

Information processed

The public statistics contain aggregate technical measurements, not account details. If you use the contact form, we process the name, email address, subject and message you provide so we can respond. If you sign up for monitoring, we store your email address, selected DNS names, matching public certificate metadata, sign-in session records and digest preferences. We also retain available leaf certificates for live and historical matches; these certificates are public in CT logs.

Third-party services

We use Cloudflare to host, deliver and protect the site and store account and certificate data. Cloudflare may process request and network information such as IP addresses, traffic-routing data, browser or device information and security signals. Contact and sign-in forms are protected against automated abuse using Cloudflare Turnstile, which evaluates limited browser and network signals to distinguish people from bots. Further details are available in Cloudflare’s Turnstile Privacy Addendum.

We use AuthSMTP to send contact-form mail, service notices, sign-in links and certificate digests. AuthSMTP and recipient email providers process sender, recipient, subject and message content as needed to deliver mail.

Rate limiting

To prevent contact-form, sign-in and account abuse, the site temporarily stores keyed cryptographic hashes derived from request IP addresses, submitted email addresses and account identifiers. It does not store the original IP address in the application database. Expired rate-limit records are pruned regularly.

Storage and sharing

Digest and expiry send-attempt metadata is retained for up to 90 days; it contains no message body and is removed when your account is deleted. Private recovery backups age out under a rolling 90-day policy and may retain deleted account data until then; they are not used for routine access. Contact submissions are sent by email and are not stored in the site database. Account information is kept while your account exists. Sign-in, email-change and account-deletion links expire after 15 minutes; sessions expire after 30 days or 14 days of inactivity. Detailed certificate matches for free accounts are normally limited to the newest 1,000 per domain and one year, with a short grace period and extra retention for unsent digests. When details expire, daily counts remain until the domain or account is removed. Downloadable leaf certificates for free-only matches are normally removed after one year; a certificate shared with an API client may remain longer. Initial historical results are bounded separately. You can remove a domain, pause digests, change your verified email address, sign out all devices or request account deletion on the monitoring page. We do not sell personal data or use advertising cookies.

Legal basis and retention

We process monitoring account data to provide the service you request. We process enquiries and security data for our legitimate interests in communicating about and protecting the service. Correspondence is retained only as long as reasonably necessary for the enquiry, security, legal or record-keeping purposes.

Unsolicited advertising and promotion

CT Monitoring must not be advertised through unsolicited or unwanted communications. This restriction covers promotion of ctmonitoring.com, its links, services and content by email, SMS, instant or direct messages, social media messages, forum posts, comment spam or other individual or bulk messages.

We do not authorise affiliates, contractors, members or other third parties to send unsolicited promotions or present them as messages from us. We do not buy or rent mailing lists, or use third-party marketing lists to advertise CT Monitoring. Our replies and directly related follow-ups to contact enquiries are service correspondence, not advertising. Requested sign-in links and monitoring notifications are also service communications.

If you receive unwanted advertising promoting CT Monitoring, please report it through our contact form, including details that can help us identify the message and its source. Such promotion is not authorised by us. We will investigate reports and take reasonable steps to address misuse.

Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing. Submit a privacy request through the contact form.