Privacy Policy

1. Who is responsible

FastPing L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, licence number 2655235.01 issued by Meydan Free Zone, Dubai, United Arab Emirates, is the controller of the personal data described in this policy. The exception is the data of status-page subscribers, for which the customer who runs the page is the controller (see Status pages and subscribers). For any privacy question or request, write to privacy@fastping.app.

2. Visiting the website

When you open a page on fastping.app, your browser connects to Cloudflare, which passes the request on to our server. Cloudflare and our web server process your IP address, the time, the address of the page, the page you came from and your browser’s user agent. Our web server keeps these details in an access log, which we use to run the site, investigate errors and stop abuse. The application’s own log records errors and background tasks without IP addresses; a message about an email that could not be delivered can include the address.

We do not use analytics, advertising or tracking scripts. Our pages load nothing from other companies: fonts, icons and scripts come from our own server.

Legal basisOur legitimate interests in operating and protecting the website (GDPR Art. 6(1)(f)).

3. Your account

To create an account you give us your name, your email address and a password, or you sign in with Google. We store your name and email address, a hash of your password (scrypt; never the password itself), your language, your role, the name of your organisation, whether you confirmed your email address, when you accepted the Terms and whether you want product news. We also keep the state of your getting-started checklist, the API keys you create (name, first characters, a hash and when each was last used) and the domains you verify.

Each sign-in creates a session: a random token in the fp_session cookie, of which we store only a hash, together with when you signed in, how (password, Google, sign-up, invitation or password reset) and when you last confirmed your identity in that session. A session lasts 30 days or until you sign out. We do not store your IP address or browser details with your account or your sessions.

One-time links for confirming your email address (valid 72 hours), resetting your password (2 hours) and joining a team (7 days) are stored as hashes and deleted once used or expired. An invitation also stores the invited email address.

Legal basisPerformance of our contract with you (GDPR Art. 6(1)(b)).

4. Signing in with Google

If you choose “Continue with Google”, Google asks you to sign in and to share your basic profile with FastPing. From what Google shares, we use only your Google account ID, your email address and whether Google has verified it, your name and, for Google Workspace accounts, the organisation’s domain; we ignore the rest, such as your profile picture. We store the Google account ID and the Google email address with your FastPing account, and a new account starts with the name Google gives us, which you can change. We use the domain only to decide whether an existing FastPing account with the same address may be connected automatically, and we do not store it.

We never receive your Google password. Google’s access and ID tokens are used once during sign-in and are not stored or logged. While you sign in, the fp_oauth cookie holds an encrypted, single-use record of the request for up to 10 minutes (30 minutes while you finish creating an account). You can disconnect Google under Settings. Google handles your Google account under its own privacy policy.

Legal basisPerformance of our contract with you (GDPR Art. 6(1)(b)); signing in with Google is your choice.

5. Monitors, alerts and results

You tell us what to monitor (URLs, hostnames, IP addresses, ports, game servers and check options) and whom to alert: email addresses, Discord and Slack webhook URLs, Telegram bot tokens and chat IDs, and your own webhook URLs. Our server in Helsinki then contacts those targets at the interval you chose, identifying itself with the user agent FastPing-Monitor/1.0 (+https://fastping.app). We store the results: status, response times, error messages, incidents and details such as certificate dates or player counts. Heartbeat monitors record when your systems last called their URL.

This information is mostly about systems rather than people, but it can include personal data, for example a colleague’s email address used as an alert channel. When you set up Discord, Slack, Telegram or a webhook, we send alert content (monitor name, status and details) to that service on your instruction.

Legal basisPerformance of our contract with you (GDPR Art. 6(1)(b)).

6. Status pages and subscribers

Status pages show what our customers choose to publish. Status pages, their feeds, badges and widgets set no cookies, and their requests appear in our web server’s access log like any other. A status page can remember your theme and a paused automatic refresh in your browser’s storage, as the Cookie Policy explains. Status pages on fastping.app are reached through Cloudflare. Pages on a customer’s own domain are served by our server directly, and the TLS certificate for that domain is issued by a public certificate authority, which lists it in public Certificate Transparency logs.

Visitors can subscribe to a status page by email. We store the address, the language for the emails, the page and when the subscription was confirmed. A subscription starts only after the subscriber clicks a confirmation link sent to that address, valid for 48 hours; unconfirmed requests are deleted 1 day after the link expires. Every notification has a link to unsubscribe in one click, and unsubscribing deletes the address at once.

For subscriber data, the customer who runs the status page is the controller and FastPing is its processor: we use the addresses only to send that page’s notifications, under the processing terms in our Terms of Service. Subscribers who want to use their rights can contact the page owner, or write to us and we will pass the request on.

7. Emails we send

• Account emails: confirming your address, password resets, team invitations and security notices when a sign-in method changes. These are always sent.
• Alerts: sent to the addresses in your alert channels. Down alerts are always sent; recovery, warning and change alerts to your own address can be switched off under Email notifications in the dashboard.
• Welcome email: sent once, after you create your account.
• Weekly report: a summary of your organisation’s uptime, sent once a week to members who confirmed their address. It is on by default. You can stop it with the unsubscribe link in every report, which works in one click (including from your mail app’s own unsubscribe button), or under Email notifications.
• Product news: only if you ticked the box when you signed up or turned it on later. We record when and where you gave or withdrew that consent, and every product news email has an unsubscribe link.
• Support emails: the confirmation of your request and our replies.
• Status-page emails: sent on behalf of the page owner, as described above.

So that the welcome email and each weekly report are never sent twice, we keep a log of them: the type of email, the week it covers, whether it was sent, the number of attempts, any delivery error and the times. Weekly-report records are deleted after 400 days; the welcome-email record stays as long as your account. Emails are delivered through our email provider (see Who receives personal data).

Legal basisPerformance of our contract with you for account emails, alerts and support (GDPR Art. 6(1)(b)); our legitimate interests in helping you use the Service for the welcome email and the weekly report (Art. 6(1)(f)); your consent for product news (Art. 6(1)(a)).

8. Support requests

When you write to us through the contact form, the Help button or by email, we store your name, your email address, the topic, your message and our replies, the ticket number and, for messages sent with the Help button, the page you wrote from. If you are signed in, the request is linked to your account, and requests from organisations with the Priority support add-on are marked as priority. We send a confirmation to you and a copy to our support team by email. Support conversations are kept for 2 years after the last message.

Legal basisPerformance of our contract with you, or our legitimate interests in answering your question if you have no account (GDPR Art. 6(1)(b) and (f)).

9. Free tools

The free tools send the requests you ask for (ping, traceroute, DNS lookups, HTTP requests and others) from our server in Helsinki and show you the result. We do not store what you enter or the results. To stop abuse, we count requests per IP address and per target in memory, never on disk, for 10 minutes. The latency test sends small requests from your browser straight to our server, without Cloudflare, to measure the round trip.

Legal basisOur legitimate interests in providing the tools and preventing their abuse (GDPR Art. 6(1)(f)).

10. Payments

Payments are processed by Fungies Inc., our merchant of record, which takes card payments through Stripe. Fungies collects your payment and billing details directly, as an independent controller under its own privacy policy; we never see or store your full card number. We keep what we need for your subscription and our accounts: the plan, the amounts, the payment status and the renewal date.

Legal basisPerformance of our contract with you (GDPR Art. 6(1)(b)) and our legal duty to keep accounting records (Art. 6(1)(c)).

11. Cookies and browser storage

The website uses a few strictly necessary cookies (your session, a security token, your cookie choice, one-time messages and the Google sign-in check) and, only with your consent, a language cookie and two browser storage entries for your theme and animation settings. The Cookie Policy lists each one.

Your cookie choice is stored only in your browser, in the fp_consent cookie, with a version number and the time you chose. We do not keep a copy on our server.

Legal basisStrictly necessary cookies are needed for the service you ask for (GDPR Art. 6(1)(b) and (f)); preference cookies and storage need your consent (Art. 6(1)(a)).

12. Who receives personal data

These providers process personal data for us, under our instructions:

Services you choose to use receive what that feature needs, under their own terms: Google when you sign in with it, and Discord, Slack, Telegram or the webhook addresses you add as alert channels. Fungies Inc., our merchant of record, receives what it needs to sell you a subscription and take the payment, under its own privacy policy.

We may also share personal data with professional advisers bound by confidentiality, with competent authorities where the law requires it, and with a successor in a merger, acquisition or reorganisation, which must respect this policy. Inside FastPing, only authorised staff can access account data, and only to run the Service, answer support requests, handle billing and protect the Service. We do not sell or rent personal data, and we do not share it for advertising.

13. International transfers

FastPing L.L.C-FZ is based in the United Arab Emirates and our server is in Finland. Cloudflare and our email provider are companies based in the United States and may process data outside your country. Where the law that applies to you requires safeguards for such transfers, we rely on the safeguards in our providers’ data processing terms, such as the European Commission’s standard contractual clauses, or on another ground the law allows. Contact us if you would like more information.

14. How long we keep it

Expired sessions and links are removed by an hourly clean-up. We do not keep backup copies, so data deleted from our database cannot be restored.

15. Security

Connections to FastPing are encrypted with TLS. Passwords are hashed with scrypt, and session tokens, API keys and one-time links are stored only as hashes. The session cookie cannot be read by scripts, forms are protected against cross-site request forgery, and our checks refuse to reach private networks. Access to the server is restricted to FastPing. No system is completely secure: if a personal data breach affects you, we tell you and the competent authorities where the law requires it.

16. Your rights

Depending on the law that applies to you, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time without affecting what happened before. We do not make decisions based solely on automated processing that significantly affect you.

You can do much of this yourself. Settings in the dashboard lets you change your name, language and organisation name, download all your data as a JSON file and delete your account. Email notifications lets you choose which emails you receive, and the Cookie settings link at the bottom of every page changes your cookie choice. To change your email address, or for anything else, write to privacy@fastping.app from the address on your account. We answer within 30 days and may first need to confirm your identity.

You can also complain to a data protection authority: in the UAE, the UAE Data Office; in the EU, the EEA, the UK or Switzerland, the authority where you live or work.

17. Children

FastPing is not meant for anyone under 18, and we do not knowingly collect their personal data.

18. Changes to this policy

We post changes on this page and update the date at the top. If a change is material, we tell account holders by email before it takes effect.

19. Contact