Privacy policy

Who runs Connect

Checkmate Connect is an optional cloud service for self-hosted Checkmate. It is run by Bluewave Labs, based in Canada. This policy covers checkmateconnect.io, connect.checkmate.so, relay.checkmate.so, the server addresses we issue under checkmateconnect.io and any custom domains you connect.

The self-hosted Checkmate software, its mobile app and checkmate.so are covered by the Checkmate privacy policy.

We decide how your Connect account data is used. For the monitoring data and user accounts inside your own Checkmate server, you remain in control and we only carry or store that data on your instructions.

What we collect

• Your account: your name, email address and a hash of your password.
• Sign-in sessions: the IP address and browser details of each session, kept so you can stay signed in and so we can protect your account.
• Your servers: the name you give each server, its installation ID and random address, a hash of its credential, any custom domain you connect, its Connect version, and when it was last seen.
• Heartbeats: each enrolled server reports its installation ID, version and tunnel state once a minute. Heartbeats contain no monitors or results.
• Watchdog history: when an outage started and ended, and when we emailed you about it.
• Backup records: the size, type, checksum and timestamps of each backup, and a one-way fingerprint of the recovery key that sealed it.

What passes through remote access

Traffic is encrypted between your browser and our relay, and between our relay and your server. Remote access is not end-to-end encrypted. The relay decrypts each request to route it, then passes it through an encrypted message channel to your server.

That means requests and responses, including your Checkmate login and dashboard data, are briefly in the memory of our relay while they are delivered. We don't save request or response bodies. Our hosting provider records operational metadata such as IP addresses, paths and timestamps.

How backups are protected

Your server encrypts each backup with AES-256-GCM before uploading it, using a recovery key created on your server. We store only the encrypted file and never receive the key. We can't read your backups, and if you lose the key we can't restore them for you.

Cookies and analytics

The Connect dashboard uses cookies only to keep you signed in. We don't use analytics, advertising or tracking cookies on checkmateconnect.io or in the dashboard.

How we use your data

We use your data to provide Connect, keep it secure and send you service email: watchdog alerts, password resets and email change confirmations. We don't send marketing email, sell your data or share it with advertisers.

Where the GDPR applies, we rely on our contract with you to provide the service and on our legitimate interest in keeping it secure.

Who processes your data for us

• Vercel: hosting, the relay and encrypted backup storage (United States)
• Supabase: the account database (Canada)
• Upstash: the message channel that carries remote access traffic and presence records
• Resend: email delivery

These providers may process data in the United States and other countries. Connect is free during the beta and we hold no payment details. We will update this policy before we start taking payments.

How long we keep it

• Your account, servers and watchdog history stay until you remove them or delete your account.
• We keep the number of backups your plan allows and delete older ones. Backups sealed with a replaced recovery key are kept for 30 days and then deleted.
• Password reset links expire after one hour.
• Deleting your account removes your stored backups and the account data above from our systems.

Your rights

You can change your email address or password and delete your account from the Connect dashboard. Depending on where you live, including under the GDPR, UK GDPR, PIPEDA and the CCPA, you may also have the right to access, correct, export or delete your data and to object to how we use it. Email us and we will help. You can also complain to your local data protection authority.

Security and children

We store machine credentials and passwords only as hashes and use HTTPS for every connection. If you find a vulnerability, please email us. Connect is not directed at children and we don't knowingly collect data from anyone under 13.

Changes and contact

If this policy changes we will update this page and the date above, and email you about material changes. Questions and requests go to Bluewave Labs at hello@bluewavelabs.ca.