Privacy Policy

Last updated: August 9, 2026

Acked is operated by Glasstack, LLC ("Acked", "we", "our", or "us"). Acked is an on-call alerting and incident response service: you send us signals, we route them to the right person, and we record what happened.

This policy covers the acked.dev website, the Acked web dashboard at app.acked.dev, the Acked API at api.acked.dev, and the Acked iOS and Android apps.

Two roles

Account data: we are the controller. Your email address, your name, your team's on-call configuration, your sign-in records. This policy describes how we use it.

Alert content: we are a processor. The title and body of an alert are whatever your systems send us. We do not control that content and generally do not know whether it contains personal data about your own end users. We store it, route it, and include it in notifications, on your instructions. We do not intentionally inspect alert content except as necessary to provide support, investigate abuse, comply with legal obligations, or maintain the service. To the extent alert content contains personal data, you are responsible for determining the purposes and means of that processing as its controller.

What we collect

• Account and organization. Your name, email address, your role, your organization and its plan, and the internal identifiers we assign to both.
• Network information. IP addresses and user-agent strings, which we receive with every request to our sites and API.
• Authentication and security records. Sign-in attempts and sessions, including the IP address and user-agent associated with them. Sign-in attempts are recorded even when the email address does not correspond to an Acked account, so that we can detect and investigate credential-stuffing, account takeover, and other abuse.
• On-call configuration. Schedules, rotations, overrides, and escalation policies. This describes who is reachable, and when, which can reveal a person's working pattern.
• Alerts, delivery, and audit records. The content of the alerts your systems send, how and to whom each was delivered, and the audit record of what happened.
• Devices and notifications. Devices you register, including the push notification tokens issued by Apple or Google, and your notification preferences.
• Phone numbers. A phone number you add for voice paging, and a record of each call placed to it.
• Credentials and integration settings. API keys, integration ingest tokens, and webhook destinations and credentials.
• Email deliverability. Addresses that hard-bounce or report spam, and the reason, so that we stop sending to them.
• Billing. Your plan and its status, and the identifiers our payment processor issues. Card details are held by the processor, not by us.
• Website and waitlist. Analytics for acked.dev, and anything you submit if you join the waitlist. We do not store your raw IP address for either.

What we do not collect

• No paging by text message. We never send an alert by SMS. The only text message we send is a one-time code confirming that a number you added is yours.
• No call recordings. We do not record, transcribe, or store the audio of a voice call.
• No postal addresses.
• No payment card data. We do not store payment card numbers or other payment credentials. Billing is handled by our payment processor.
• No social or third-party login. Acked signs you in with an emailed one-time code and nothing else, so no identity provider receives your data.
• No advertising trackers, and no third-party scripts in the dashboard or the mobile apps.

How we use information

• To provide the service. Route alerts, notify the right on-call person, escalate when nobody responds, and show you the history.
• To sign you in and keep your session valid.
• To keep the service secure. Detect and block brute-force and credential-stuffing attempts, and enforce rate limits.
• To operate and debug the service. Error tracking, performance monitoring, and delivery diagnostics.
• To email you about your account, alerts, and service changes. Alert and sign-in emails are part of the service and cannot be unsubscribed from while your account is active.
• To call you at a number you add, when an alert has not been acknowledged. You provide the number for that purpose, and you can remove it at any time. Voice paging is off for an organization until one of its administrators enables it.
• To bill you if your organization subscribes to a paid plan.
• To contact waitlist signups about availability.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Legal bases (EEA/UK)

• Performance of a contract. Account data, on-call configuration, alert routing and delivery, billing.
• Legitimate interests, including securing our services, preventing fraud and abuse, maintaining reliable operation, and preserving audit integrity. This covers security logging, including sign-in attempts for addresses that are not accounts.
• Consent. Waitlist signup and marketing email, which you can withdraw at any time.
• Legal obligation. Where we must retain or disclose information by law.

Where we act as a processor on your behalf for alert content, your instructions and our agreement with you govern that processing.

Who we share information with

We use third-party providers to operate Acked. The current list — including what each receives and where it processes data — is maintained at acked.dev/legal/subprocessors. Where we process alert content on your behalf, our Data Processing Addendum governs that processing.

We may also disclose information where required by law, or where necessary to protect our rights, our users, or the service.

If Acked is involved in a merger, acquisition, financing, or sale of assets, information described in this policy may be transferred as part of that transaction. We will notify account holders before their information becomes subject to a different privacy policy.

Destinations you choose

If you configure an outbound webhook, we send alert content to whatever URL you specify: Slack, Microsoft Teams, your own endpoint, or anything else. We sign the request, but we have no relationship with that destination and no control over what it does with the data.

Voice paging

Voice paging uses a telecommunications provider to place the calls and to send the one-time code that confirms a number belongs to the person who added it. That provider is listed as a conditional subprocessor and receives nothing about an organization that has not enabled voice paging. It is identified on the subprocessors page before an administrator can turn the feature on.

Monitoring

Our monitoring provider receives operational telemetry from our servers, and from the dashboard in your browser. It receives your user id, organization id, and role so we can trace a failing request back to an account. It does not receive your email address or name. Request URLs and query strings are removed before telemetry leaves our systems. Some diagnostic log entries can include an alert title, but we do not intentionally include alert bodies in diagnostic logs.

Website analytics

The acked.dev landing page uses first-party analytics. We do not store your IP address for analytics. At our edge it is passed through a one-way function to derive a pseudonymous visitor identifier, and only that derived identifier is retained. Alongside it we record the page URL, referrer, country, user-agent, network operator, and a bot score. An email address is never sent to analytics.

The landing page does not set analytics cookies. It stores a random session id in your browser's sessionStorage, which is discarded when you close the tab. The dashboard sets a session cookie that is strictly necessary to keep you signed in.

Where data is processed

Acked runs on Cloudflare's global network, so requests are handled at the edge location nearest you. Our database, email, and monitoring providers process data in the United States. If you are in the EEA or the UK, using Acked involves transferring your information to the United States; we rely on our providers' Standard Contractual Clauses and equivalent safeguards for those transfers.

Retention

We retain personal information for as long as your account is active. Alerts, delivery records, and audit history are retained for the data retention period applicable to your organization — determined by your plan, or by your agreement with us where it specifies a different period — after which they are deleted. Where we process alert content on your behalf, your instructions and our Data Processing Addendum govern that processing, including retention.

Operational and security records. Separately from the above, we retain records necessary to operate and secure the service. Sign-in records — the email address entered, the IP address, the user-agent, and the outcome — are retained as long as reasonably necessary for security and fraud prevention, including for addresses that do not correspond to an Acked account. Email deliverability records, such as hard bounces and spam reports, are retained for as long as we operate the service, so that we do not resume sending to an address that has bounced.

Voice call records. Where voice paging is enabled, we keep a record of each call placed — when it happened, how long it lasted, and what it cost — because it is what your invoice is built from. These are billing records and are kept on the same basis as our other financial records, which is longer than the retention period that applies to your alerts. The record does not contain your phone number: it refers to the stored number rather than repeating it, so deleting the number leaves the billing record intact and the number gone.

Backups. Deleting data from our live systems does not immediately remove it from backups. Backups may retain encrypted copies for a limited period until they expire in the normal course of backup rotation.

Different categories of information may be retained for different periods where required by law or necessary to establish, exercise, or defend legal claims.

Audit records

Acked keeps an append-only audit record of incident activity, written in the same transaction as the change it records. These records are designed to be immutable and are not altered or deleted during normal operation. They reference internal identifiers rather than names or email addresses, and once an account is erased those identifiers no longer resolve to a person.

Deleting your account

You can delete your account from the product. It is deactivated immediately and you can no longer sign in. Your name and email address are suppressed everywhere the product displays them — teammates see "Deleted user" — and your personal information is erased within 30 days, other than the operational and security records described above and copies held in backups until they expire. Certain billing and financial records may be retained where required by law. Once erased, the email address may be used to register a new account.

Your rotation slots resolve to nobody, and alerts that would have paged you escalate to the next step instead. Deletion is not available to the last remaining administrator of an organization; promote another administrator first.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. Residents of California and other US states with comprehensive privacy laws have equivalent rights, including the right not to be discriminated against for exercising them. We do not sell personal information, we do not share it for targeted advertising, and we do not share sensitive personal information for purposes that would require an opt-out under California law.

Acked does not make decisions producing legal or similarly significant effects using solely automated processing.

Contact support@acked.dev to exercise any of these. We will respond within the period required by applicable law. Two caveats:

• Audit records are immutable, as described above. We can remove or suppress identifying information but not the underlying record.
• If your organization put your personal data into an alert, that content belongs to them. We will refer the request to them as the controller.

If you are an end user of one of our customers and your information reached us through an alert, contact that organization directly.

Security

Data is encrypted in transit and at rest. Credentials and secrets are hashed or encrypted as appropriate to their use. Access to production data is limited to people who need it. Sign-in attempts are logged and rate-limited. Ingest tokens are kept out of our logs and monitoring.

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any applicable regulator as required by law, without undue delay.

Children's privacy

Acked is a business tool. It is not directed to children, we do not knowingly collect information from anyone under 16, and accounts are intended for use by employees or contractors of the organization that subscribes. If you believe a child has given us information, contact us and we will remove what we can.

Changes to this policy

We may update this policy. If we make a material change, we will update the date at the top and notify account holders by email before the change takes effect.

Changes to the providers who process data on your organization's behalf are handled separately, under section 11 of our Data Processing Addendum: we give notice — in advance, or promptly afterward where a provider has to be replaced urgently to keep alerts flowing — and your organization may object either way.

Contact

For questions about this policy, or to exercise any right described in it:

Glasstack, LLC
13950 Route 50 #3069
Chantilly, VA 20151
United States

support@acked.dev