Privacy

Last updated 27 October 2026.

This page explains what RunLookout ("we", "us") stores, why, and how to delete it.

What we store

• Your Telegram chat id and the name on your Telegram profile, so the bot can send you alerts and sign-in links.
• If you sign in by email, your email address, so we can send you sign-in links. We also keep a count of links sent per hour, under a one-way fingerprint of the address and of your IP address, to stop abuse. Those counts are deleted after two hours.
• If you sign in with Telegram on the website, Telegram shares your user id, name and username with us. We don't store your photo or phone number.
• For each client server you add: its name, its address, its time zone and its n8n API key. The key is encrypted with AES-GCM before it is stored. How we handle API keys.
• What we learn from checking those servers: workflow names, which runs failed or finished with nothing, error messages, open alerts, and one status per hour for the last 7 days. Hourly status older than 7 days is deleted automatically.
• If you turn on email alerts, the address they go to. We also keep a log of the alert emails we send to you (the time, the subject and whether it went out) for 30 days, to apply a daily limit and to check that emails arrived.
• If you connect Slack, the Slack webhook address for your channel, encrypted the same way. You can remove it on the Alert channels page.
• If you join the Make waitlist, your email address. We use it once, to tell you when Make support ships.
• A sign-in cookie in your browser, so you stay signed in. There are no tracking or advertising cookies and no third-party analytics.
• Simple visit counts for our public pages: how many views each page got in a day, and which site the visitor came from. They are plain totals. We don't store IP addresses, browser details or anything that identifies a visitor.

Who else handles it

• Cloudflare runs the app and the database. Its Workers AI writes the short note in each alert. The AI sees the alert type, the workflow and step names, the time and the first 500 characters of the error message. It never sees API keys.
• Resend delivers sign-in and alert emails. It sees your email address and the email we send.
• Telegram delivers the bot's messages. If you connect Slack, Slack delivers a copy of each alert to your channel.
• Dodo Payments runs the checkout page. Card details never reach us. We see your payment email, the amount and your account code in our Dodo account, so we can match the payment to your account.
• We don't sell your data and we don't show ads.

How long we keep it

Everything stays until you delete it. Deleting a client server deletes its key and its history. Deleting your account deletes everything listed above.

After an account is deleted we keep one thing: a scrambled fingerprint of the Telegram chat, made with a one-way function. It can't be turned back into your chat id or your name. It only stops the same chat from getting a second free beta.

Your choices

• Delete a client server from its page in the dashboard.
• Delete your whole account with Delete my account, at the bottom of the dashboard sidebar.
• To get a copy of your data, correct something or ask a question, email hello@runlookout.me or use the contact page.