Privacy Policy

1. Introduction & Ownership

ChangeWatch is an autonomous web monitoring service developed and maintained by Aayush Srivastava. We are committed to strict data privacy, minimal data retention, and absolute transparency. This Privacy Policy governs the collection, processing, and storage of information when you access or use ChangeWatch.

For any privacy inquiries or data rights requests, please contact Aayush Srivastava directly at aayush@aayushsrivastava.com.

2. Information We Collect

We adhere to the principle of strict data minimization:

• Account Information: When you register, we collect your email address and timezone. Passwords are never stored in plaintext; they are securely salted and hashed using bcrypt.
• Monitoring Configurations: Target public URLs, check intervals, CSS watch/ignore selectors, and keyword filters you explicitly configure.
• Encrypted Alert Destinations: Webhook URLs (such as Discord channels) and notification email addresses. All destination URLs and webhook secrets are encrypted at rest using symmetric 256-bit Fernet cryptography.
• Public Snapshot Evidence: Text excerpts and screenshots of public pages you configure us to monitor. Under our Store-on-Change Policy, unchanged check runs do not store any screenshot or DOM files.

3. Cookies & Local Browser Storage

ChangeWatch does not use third-party advertising cookies, cross-site trackers, or behavioral profiling tools. We utilize only:

• Essential Session Cookies: Cryptographically signed HTTP cookies used solely to maintain authenticated user sessions and validate CSRF security tokens.
• Local Browser Storage (localStorage): Used strictly on your device to persist UI preferences, specifically:
  • cw_theme: Saves your preferred visual theme (light or dark mode).
  • cw_motion: Saves your Windows reduced-motion optimization preference.
  • cw_cookie_consent: Stores your cookie banner acknowledgment.

4. Public-Only Scraping & SSRF Safety

ChangeWatch is built strictly for public web surveillance. Our automated headless browser agents do not log into third-party sites, do not store third-party credentials, and actively block all attempts to monitor private, internal, or cloud metadata endpoints.

5. Data Retention & User Control

You retain full ownership of your data. When you delete a monitor or alert destination, all associated historical versions, snapshots, and alert event logs are immediately and permanently removed from our active database and artifact stores.

6. Contact Information

If you have questions regarding this Privacy Policy, please reach out to: