Privacy
What LastPing stores, how long we keep it, how to delete it, and how we protect it. Last updated: 2026-10-17.
On this page
What we collect
LastPing collects the minimum required to run a monitoring service:
- Account data: email address (confirmed via opt-in), used for authentication, alerts, and occasional onboarding and product-help emails about your own account, which you can unsubscribe from at any time (unsubscribing never stops your alerts). You can sign in with GitHub, Google or email. When you sign in with Google or GitHub, we store the account's email address, whether the provider verified it, and the provider's stable account id. Nothing from your Google profile is stored. No name, no phone number, no payment information.
- Monitor configuration: the names, schedules, grace windows, and alert routes you configure. This is your data; we store it to provide the service.
- Ping records (every HTTP request received at
ping.lastping.dev): timestamp, source IP, HTTP method, path, and any failure detail body you POST to/fail(up to 10,000 bytes, plain text). Source IPs are stored as part of the ping record and are not separately logged. A start ping from the Claude Code hook also carries the session id, a project label (the name of the folder that holds the git repository the session works in, or the folder's name when it is not in a repository; a name, never a path) and the hook's version number, and we store those with the ping. If you turn it on, a run nothing else titled is titled when it finishes with a short title Claude Code generates from the conversation, which can repeat words from your prompt; off unless you turn it on at setup (LASTPING_AUTO_TITLE=1at the top of~/.claude/lastping-report.sh). - Incident history: when monitors go down and recover, the times, causes, and any failure detail attached.
- Sign-up source: when you create an account, which kind of site your first visit came from (a category such as search engine, AI assistant or MCP directory, worked out from the referring site's host name and never stored as an address), the path of the page you first landed on (for example
/pricing, never a query string), and, if you signed up while connecting an AI assistant, which kind of assistant (Claude, Claude Code, ChatGPT, Cursor or another MCP client). It comes from thelp_srccookie described under Cookies and analytics, and we use it only to learn which channels bring people to LastPing. - Assistant tool use: the API tool-call labels a connected assistant or any API client sends with its requests, recording which LastPing tool was called, when, whether it succeeded, and the kind of assistant (Claude, Claude Code, ChatGPT, Cursor or another MCP client, when it connected by signing in). No tool arguments or results are stored. Our MCP server also logs one line per message it handles (the method, the tool name and a short prefix of the project id, with no content), kept 30 days.
- Alert delivery records: whether an alert was sent and whether delivery succeeded, without storing the alert content long-term.
- Agent telemetry: the traces, metrics and logs your agents export over OpenTelemetry (span timings and names, token counts, API cost, the services a call reached, and error text). Prompt, command and tool content is dropped at ingest unless a monitor's owner opts in. Secret-shaped values are redacted at ingest either way.
We do not run advertising. We do not sell data. The only third-party script on any page is Google Analytics, on the marketing site and the app's public pages, under the consent rules in Cookies and analytics. The only third-party services in the request path are our cloud provider (AWS) and our transactional email provider for alert delivery. GitHub and Google are in the request path only while you sign in with them.
Retention
Retention periods are enforced by a nightly prune job:
| Data type | Retention | Notes |
|---|---|---|
| Ping records | 90 days | Pruned nightly. Older pings are deleted; monitor status and current incident are not affected. |
| Claude Code run labels | 90 days | The project label (the name of the folder that holds the git repository a Claude Code session works in, or the folder's name when it is not in a repository; a name, never a path), the session id, the hook version and the run's title (Claude's own title, or, if you turned it on at setup, a short title Claude Code generates from the conversation, which can repeat words from your prompt), kept with the run's pings. Pruned nightly with those pings. The monitor keeps only the latest hook version it saw, so the console can say when set-up needs re-running; that goes when the monitor is deleted. |
| Run steps | 90 days | Progress markers reported inside a run (the step label you send and the time it arrived). Pruned nightly on the same window as pings, because a run's timeline is reached through that run's ping. |
| Incident history | 1 year | Closed incidents older than 1 year are pruned nightly. |
| Alert delivery records | 90 days | The stored copy of an alert that was delivered: its event type, cause and the payload sent to your destinations. Pruned nightly once delivered. An alert still waiting to be delivered is never pruned, at any age. |
| Monitor configuration | Until deleted | Retained while your account is active. Deleted on account deletion. |
| Account data (email) | Until deleted | Retained while your account is active. Deleted on account deletion request. |
| Sign-up source | Until deleted | The source category, landing path and assistant kind recorded once when the account is created. Deleted with the account. |
| Failure detail bodies | With the incident (1 year) | Stored as part of the incident record. Pruned when the incident is pruned. |
| Failure signatures | Until deleted | A one-way hash of a failure body plus a scrubbed 512-character excerpt with timestamps, IDs, IP addresses, file paths and numbers removed. Kept so repeat failures stay recognisable after the ping is pruned. Deleted when the monitor is deleted. |
| Trace metadata | 30 days | The spans your agents send: timings, names, token counts, API cost and the dependencies a call reached. Pruned nightly. A run's summary totals (span count, tokens, cost) are kept 90 days, on the same window as pings. |
| Prompt, command and tool content | Not stored by default; 30 days if opted in | Dropped at ingest unless the monitor's owner opts in. When opted in, it is stored with every secret-shaped value (keys, tokens, passwords) redacted at ingest, before it is queued, and pruned with the span or log event it belongs to. |
| Error text from failed tool calls | With the span or log event (30 days) | Kept by default, because it says why a call failed, but cut to 512 characters after redaction. With content opted in, the 512-character cut does not apply; secret-shaped values are still redacted. |
| Agent log events | 30 days | Log records your agents send over OpenTelemetry. The same content and redaction rules apply as for traces. Pruned nightly. |
| Dependency and usage aggregates | 90 days | Daily totals: calls per dependency, token and cost usage per model, and each project's daily span count. Pruned nightly. |
| Discovered trace sources | 90 days after last seen | A trace source that matched no registered agent, listed on the Agents page so you can adopt it. Pruned 90 days after it was last seen unless adopted; an adopted source becomes an agent and is kept until deleted. |
| Ingest diagnostics | 7 days | A record of each telemetry export: accepted, or refused with a reason code, so the console can show why data is not arriving. No key and no request body is stored. Pruned nightly. |
| Assistant tool use | 90 days | The API tool-call labels a connected assistant or any API client sends: which LastPing tool was called, when, whether it succeeded, and the kind of assistant (such as Claude or Cursor). No tool arguments or results are stored. Used to improve the tools. Pruned nightly. |
| Connected app access tokens | 1 hour | The short-lived token an app you connect with sign-in (such as Claude) uses to call LastPing for you. Stored only as a hash. Removed a day after it expires. |
| Connected app refresh tokens | Up to 90 days | Lets a connected app get a new access token without asking you to sign in again. Stored only as a hash. Removed when you disconnect the app. |
| Sign-in authorization codes | 60 seconds | The one-time code handed to an app during sign-in and exchanged for its tokens. Removed within a day. |
| Registered app records | Until 30 days after last use | The name and return address an app registers before you connect it. Removed 30 days after it was last used when no account is connected to it. |
Infrastructure and hosting
LastPing is hosted on AWS eu-central-1 (Frankfurt, Germany). All data at rest is stored in Frankfurt. Pings are received and processed in the same region; no data transits outside the EU for core monitoring functions. Edge services (the CDN, its certificate and the web application firewall) are AWS global services administered from us-east-1; monitor data, pings and incidents are stored only in Frankfurt.
Alert delivery (email, Slack, Discord, Telegram, webhook, ntfy,
Pushover, Microsoft Teams, Google Chat) reaches the destination
configured on your account. Outbound webhook delivery is
SSRF-guarded: the delivery service resolves destination
hostnames against a blocklist that excludes RFC 1918 private ranges, loopback,
link-local, and cloud metadata addresses (including
169.254.169.254). Alerts cannot be routed to internal
infrastructure even if the destination URL resolves to one.
Deletion
You can delete individual monitors and their associated ping history and incidents from the console at any time. To delete your account and all associated data, use the delete-account option in Settings: deletion is self-serve and takes effect immediately. If you cannot sign in, email hello@lastping.dev from the address on the account as a fallback, and we will delete all data within 14 days and confirm by email.
Cookies and analytics
The marketing site (lastping.dev) and the app's public pages
use Google Analytics in consent mode. Until you choose Accept on the
banner it sets no cookies and sends only cookieless measurements; Accept
lets it set its analytics cookies, and Decline keeps them off. Your choice
is kept in your browser's local storage, not in a cookie.
Both the site and the app set one first-party cookie of our own,
lp_src, once you choose Accept on the banner, so that if you later
create an account we know which kind of site sent you (see Sign-up source
above). It holds only the referring site's host name (for example
google.com, never the full address you came from), a
campaign tag if the link you followed carried one, and the path of the
page you first landed on in that visit. Until you choose, those details
are held only in that browser tab's session storage, which is cleared
when the tab closes. The cookie holds no identifier, later pages never overwrite
it, it is sent to lastping.dev and its subdomains, and it
expires after 30 days. We use it only when an account is created, and
never read it again for that account. If you decline analytics on the
banner, the cookie is not set and the held details are discarded; if you
never choose, it is not set either. Either way we record no source for you.
When you decline, we set one more cookie, lp_src_off, which
holds only the fact that you declined, so that the site and the app both
respect your choice; it expires after a year, and choosing Accept on the
banner later removes it.
The app (app.lastping.dev) also uses a session cookie for
authentication, and short-lived cookies that keep sign-in and forms
secure.
That session cookie ends after 7 days without use, and after 30 days in any case. We store only a one-way hash of it, never the value your browser holds, and expired sessions are deleted within the hour.
Alert channel security
Email channels require confirmed opt-in before any alerts are delivered. Outbound webhooks include an HMAC signature header so you can verify delivery origin. Telegram, Slack, and Discord destinations are linked via their respective OAuth or bot-token flows and can be unlinked from the console at any time.
Changes to this policy
Material changes will be announced via the email address on your account with at least 14 days notice before taking effect. The date at the top of this page is updated on any change.
Contact
Questions, data requests, or deletion requests: hello@lastping.dev.