Privacy Policy

1. Who We Are and What This Policy Covers

OnCallAlert ("we", "us", "our") operates oncallalert.dev and provides the OnCallAlert self-hosted software ("Software"), the OnCallAlert mobile app ("Mobile App"), and a push relay and license server ("Hosted Services").

This policy explains what personal data we process when you visit our website, buy a subscription, run the Software, or use the Mobile App, and the choices you have. Terms not defined here have the meaning given in our Terms of Service.

2. Data in Your Self-Hosted Instance

When you run the Software, everything it stores (alerts, incidents, services, schedules, escalation policies, users, phone numbers, email addresses, integration keys, and logs) lives in your own database on infrastructure you control. We do not host it, receive it, or have any access to it.

For that data, your organization is the data controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023), and we are neither its controller nor its processor. Requests about that data, such as access or deletion, should go to the organization that runs the instance. We cannot fulfil them because we do not hold the data.

3. What We Don't Collect

• No usage analytics, telemetry, or crash reports are sent to us from the Software, the web interface, or the Mobile App.
• No alert content (summaries, details, service names, or payloads) passes through or is stored by our Hosted Services.
• No names, phone numbers, or email addresses of your on-call users are sent to us by the Software.
• No advertising cookies are set on our website. Google Analytics sets first-party cookies only if you accept them (see 4.4).
• No full card numbers or bank details. These are handled only by Dodo Payments.

4. What We Collect

4.1 When you buy a subscription

Checkout is run by Dodo Payments, our Merchant of Record. Dodo collects your name, email, billing address, tax details, and payment details to process the payment and issue invoices, under Dodo's privacy policy. From Dodo we receive what we need to issue and manage your license: your email address, the organization ID you enter at checkout, Dodo customer, subscription, and payment identifiers, the product and plan bought, and billing dates and status.

4.2 License checks from the Software

Once a day (and when you first enter a key), the Software sends the following to our license server. This is the only information the Software sends to us for licensing, and we use it only to validate your license and apply your plan limits.

Your instance's IP address is used briefly to rate-limit requests and is not stored by us. Our hosting provider, Cloudflare, may keep short-lived request logs as part of running its network.

4.3 Push relay (plans with the Mobile App)

To wake a phone when an alert fires, your instance sends our relay a trigger containing only a device ID and an alert ID (random identifiers). The relay forwards those IDs to the phone through Google Firebase Cloud Messaging (which uses Apple Push Notification service on iPhones). The Mobile App then fetches the alert's details directly from your instance, not from us.

To do this, the relay stores, for each paired phone: the device ID, its Firebase push token, the platform (Android or iOS), the instance it belongs to, and timestamps. It does not store alert IDs, alert content, or the user's name or phone number. A phone's record is deleted when it is unpaired or when Firebase reports the token is no longer valid.

4.4 Our website

Our website uses Google Analytics 4 to count visits and to see which pages and links bring people to us. We ask first: Google Analytics sets its first-party cookies (named _ga) only after you click Accept in our cookie banner. Until then, and if you click Decline, it uses no cookies and sends Google only basic, cookieless signals about the visit. With or without cookies, Google receives the pages you view, the page that referred you, and your browser, device, and approximate location. Google Analytics 4 does not log or store IP addresses. We do not use it for advertising, and we never send it your email address or form answers. You can change your choice at any time with Cookie settings at the bottom of every page. Fonts are loaded from Google Fonts, so Google receives your IP address and browser details when you load a page (Google's privacy policy). Like any website, our hosting provider processes your IP address to serve pages and protect against abuse.

4.5 The waitlist

When you join the waitlist we collect your email address, name, company (optional), team size, and your optional answers about plans, tools, features, and pain points. We also record the link or campaign that brought you to our site (for example a utm_source tag or the referring page), so we know which posts work. This is stored in Zoho CRM, which also loads a small form-analytics script from Zoho when you open the waitlist form. We use it to email you about the launch and the early-bird offer, and to decide what to build. You can unsubscribe from any email, or ask us to delete your entry at contact@oncallalert.dev.

4.6 When you contact us

If you email us for support, sales, or a refund, we keep the emails and the details you include so we can respond and keep a record of the conversation.

5. Features You Control

Some Software features send data to third parties only if your administrator turns them on. In those cases data goes from your instance directly to the provider you choose, under your own account with them, and not to us:

• SMS, voice, and email providers you connect for notifications (for example Twilio or an SMTP server);
• webhooks and integrations you configure; and
• an optional Google Analytics setting inherited from the open-source GoAlert project. It is off by default; if your administrator enters a Google Analytics ID, usage events go to that administrator's own Google Analytics account. We never receive them.

The Mobile App stores your server address, session token, settings, and a cache of data it has fetched from your instance on your phone. It talks only to your instance and to Firebase Cloud Messaging. It has no analytics or crash-reporting SDK.

6. How We Use Personal Data

We do not sell or rent personal data, share it for advertising, or use it to build marketing profiles. We will only send you marketing emails if you ask for them, and you can unsubscribe at any time.

7. Who We Share Data With

We share personal data only with providers that help us run the service, and only as needed:

• Dodo Payments: Merchant of Record for checkout, payments, taxes, invoices, and refunds.
• Cloudflare: hosting for our website, push relay, license server, and their databases.
• Google Firebase Cloud Messaging (and Apple Push Notification service on iOS): delivery of wake-up notifications to phones.
• Our email provider: sending and receiving email with you.
• Zoho CRM: storing waitlist signups and sending waitlist emails.
• Google Analytics: counting visits to our website.

We may also disclose information if required by law or a valid legal request, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy will continue to apply to the data transferred.

8. How Long We Keep Data

• License and instance records: while your subscription is active, and up to 12 months after it ends (so you can renew or reactivate), then deleted or anonymized.
• Paired phone records: until the phone is unpaired, the push token becomes invalid, or the instance's license record is deleted.
• Billing and tax records: as long as tax and accounting laws require.
• Emails: as long as needed to handle your request and for a reasonable period afterwards for our records.
• Waitlist entries: until you unsubscribe or ask us to delete them, and at most 12 months after launch if you don't become a customer.

9. Security

We use reasonable technical and organizational measures to protect the data we hold, including encrypted connections (HTTPS), storing License Keys and API keys only as hashes, signed license tokens, rate limiting, and limiting who can access our systems. No system is completely secure. If a breach affecting your personal data occurs, we will notify you and the authorities where the law requires.

The security of your self-hosted instance, including its database, backups, and network, is your responsibility.

10. Your Rights

Depending on where you live (for example under India's DPDP Act, the EU/UK GDPR, or California law), you may have the right to:

• access the personal data we hold about you, and get a copy;
• correct inaccurate or incomplete data;
• have your data deleted, where we do not need to keep it for legal reasons;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• nominate another person to exercise your rights if you die or become unable to (India); and
• complain to a data-protection authority.

To make a request, email contact@oncallalert.dev from the address linked to your subscription. We will respond within 30 days. We will not treat you differently for exercising your rights. For data held in a self-hosted instance, please contact the organization that runs it (see Section 2).

11. International Transfers

We are based in India, and our providers (Cloudflare, Dodo Payments, Zoho, Google, Apple) may process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the providers' standard contractual clauses. Business customers who need a data processing agreement for the push relay can request one by email.

12. Children

OnCallAlert is a business product and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy, for example when the Software changes what it sends to us. We will update the date at the top and, for material changes, notify customers by email before they take effect.

14. Contact and Grievance Officer

For privacy questions, requests, or complaints, contact our Grievance Officer at contact@oncallalert.dev. We will acknowledge complaints within 48 hours and aim to resolve them within 30 days.