Privacy
What LastPing stores, how long we keep it, how to delete it, and how we protect it. Last updated: 2026-07-17.
What we collect
LastPing collects the minimum required to run a monitoring service:
- Account data — email address (confirmed via opt-in), used for authentication and alerts. No name, no phone number, no payment information.
- Monitor configuration — the names, schedules, grace windows, and alert routes you configure. This is your data; we store it to provide the service.
- Ping records — every HTTP request received at
ping.lastping.dev: timestamp, source IP, HTTP method, path, and any failure detail body you POST to/fail(up to 64 KB, plain text). Source IPs are stored as part of the ping record and are not separately logged. - Incident history — when monitors go down and recover, the times, causes, and any failure detail attached.
- Alert delivery records — whether an alert was sent and whether delivery succeeded, without storing the alert content long-term.
We do not run advertising. We do not sell data. We do not embed third-party trackers on any page. The only third-party services in the request path are our cloud provider (AWS) and our transactional email provider for alert delivery.
Retention
Retention periods are enforced by a nightly prune job:
| Data type | Retention | Notes |
|---|---|---|
| Ping records | 90 days | Pruned nightly. Older pings are deleted; monitor status and current incident are not affected. |
| Incident history | 1 year | Closed incidents older than 1 year are pruned nightly. |
| Monitor configuration | Until deleted | Retained while your account is active. Deleted on account deletion. |
| Account data (email) | Until deleted | Retained while your account is active. Deleted on account deletion request. |
| Failure detail bodies | With the incident (1 year) | Stored as part of the incident record. Pruned when the incident is pruned. |
Infrastructure and hosting
LastPing is hosted on AWS EU-West-1 (Frankfurt, Germany). All data at rest is stored in Frankfurt. Pings are received and processed in the same region; no data transits outside the EU for core monitoring functions.
Alert delivery (email, Slack, Discord, Telegram, webhook) reaches the
destination configured on your account. Outbound webhook delivery is
SSRF-guarded: the delivery service resolves destination
hostnames against a blocklist that excludes RFC 1918 private ranges, loopback,
link-local, and cloud metadata addresses (including
169.254.169.254). Alerts cannot be routed to internal
infrastructure even if the destination URL resolves to one.
Deletion
You can delete individual monitors and their associated ping history and incidents from the console at any time. To delete your account and all associated data, email hello@lastping.dev from the address on the account. We will delete all data within 14 days and confirm by email.
Cookies and analytics
The marketing site (lastping.dev) uses no analytics cookies
and no third-party tracking scripts. The app (app.lastping.dev)
uses a single session cookie for authentication. No persistent tracking
cookies are set.
Alert channel security
Email channels require confirmed opt-in before any alerts are delivered. Outbound webhooks include an HMAC signature header so you can verify delivery origin. Telegram, Slack, and Discord destinations are linked via their respective OAuth or bot-token flows and can be unlinked from the console at any time.
Changes to this policy
Material changes will be announced via the email address on your account with at least 14 days notice before taking effect. The date at the top of this page is updated on any change.
Contact
Questions, data requests, or deletion requests: hello@lastping.dev.