Your data in IndexLatch.
IndexLatch is operated by Hearthworks, LLC, United States. It offers a free, one-time page checker and a limited free monitoring pilot. Paid subscriptions are not open. For privacy questions, contact hello@hearthworks.dev.
One-time checks
We fetch the public URL you enter and return HTTP status, redirects and selected page signals. The target website receives our server’s IP address and monitoring user agent. Use public pages you are authorized to check. Do not submit passwords, private access links or sensitive information in URLs.
The one-time checker does not save submitted URLs, full HTML or individual reports in its database. Your browser displays the result and may retain the last URL in session storage to suggest it when you open monitoring. Daily aggregate counters measure use. A hash derived from your IP address limits requests; these records expire within an hour and are removed on the next limited request.
Monitoring accounts
We store your email address, a salted password hash, account and verification state, and hashed session and recovery tokens. Passwords are not stored in plain text. A session cookie keeps you signed in for up to 30 days; recovery and verification links expire after one hour.
For pages you save, we store their URLs, labels, check times, selected signals, the latest and confirmed observations, and changes. We do not store full page HTML. Free accounts retain change history for seven days. Latest observations and account details remain until you remove the page or delete your account. A new account that has never verified its email is deleted after 24 hours; an established account is retained if you later change its email.
Transactional email
Resend processes the sender, recipient and message content to deliver account links and monitoring alerts. The application removes queued message content after provider acceptance, expiry or cancellation. Delivery identifiers, outcomes and other queue metadata are retained for up to seven days. Provider retention is governed by Resend’s privacy policy.
A permanent rejection or spam report pauses delivery to that account. You can change and verify a different email in your dashboard. We use your address for requested account and monitoring messages, not marketing campaigns.
Infrastructure and backups
The service runs on Hostinger infrastructure. Vercel provides DNS. Amazon Web Services provides private backups and operational alerts. Normal application and proxy access logging is disabled. Service error logs may contain technical request metadata for diagnosing failures; infrastructure providers may separately process connection information.
Daily database backups have a seven-day retention policy on the host and in private AWS S3 storage. Deleted records may remain in those backups until they expire. Operational alerts contain service and queue status rather than customer message contents.
Your controls
The dashboard provides a data export, page removal, email changes and account deletion. Deletion removes live account data, saved pages, change history, sessions, tokens and associated message records. See the backup retention above. We do not use advertising trackers or sell account or checker data. Paid checkout remains unavailable and we do not collect payment details in this pilot.