Legal
Privacy
We store the email you submit, a password hash, an API key, the UDI-DIs and SRNs you watch, the last public snapshot of each watch, and the audit trail of real diffs. If you set a webhook, we store that URL and a signing secret. When you subscribe, Stripe stores the card. We store the Stripe customer id and subscription id, not the card number.
The session lives in this browser until you sign out. Signing out revokes it on the server. We do not set a tracking cookie. The hosting logs (including Cloudflare) may record IP addresses for security. Rate limits keep a short-lived count of requests per IP and then drop it.
Mail is sent only if an operator has configured SMTP: watch changes, and a password reset when you ask. We do not sell the list.
Public device pages repeat fields that are already public in EUDAMED. They are not your private watch list.
You can delete the account in the app. That removes the users, watches, events, and keys, and cancels a Stripe subscription. You can also write to [email protected] from the account address.