Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data ChangeGist collects, why, and what you can do about it. We keep it short because we collect very little.
Who we are
ChangeGist ("we", "us") is run by an independent developer, based in the United Kingdom. We are the data controller for the personal data described here. You can reach us at [email protected].
What we collect
- Account details: your email address and a scrambled (hashed) version of your password. We can't see your actual password.
- What you ask us to watch: the web addresses you add, the names you give them, and copies of the public text on those pages so we can spot changes.
- Billing details: if you subscribe, Stripe handles your payment. We receive your plan, payment status and a Stripe customer reference. We never see or store your card number.
- Technical data: basic server logs (such as IP address and time of a request) kept for security and troubleshooting.
We don't use advertising trackers or analytics cookies, and we don't sell your data.
Why we use it (and our legal basis)
- To run the service you signed up for: checking your pages, sending alerts, managing your account and billing (performance of a contract).
- To keep the service secure and prevent abuse, such as limiting repeated failed logins (legitimate interests).
- To meet legal obligations, such as keeping billing records (legal obligation).
Who we share it with
We use a small number of providers to run ChangeGist. They only process data on our instructions:
- Oracle Cloud (UK, London region): hosts our server and database.
- Cloudflare: delivers the website securely to your browser.
- Stripe: processes subscription payments.
- Anthropic: when a watched page changes, the changed text from that public page is sent to Anthropic's AI to write your summary. Your email and account details are not included.
- Our email provider: delivers alerts and account emails to you.
Some of these providers may process data outside the UK. Where they do, they use safeguards recognised under UK data protection law, such as standard contractual clauses.
How long we keep it
- Account and monitoring data: while your account exists. You can delete your account yourself from the Account page; it's removed straight away, and copies in our backups are gone within 7 days.
- Billing records: as long as the law requires (usually 6 years in the UK).
- Server logs: kept briefly for troubleshooting and deleted automatically as new logs come in.
Cookies
We use one cookie, which keeps you logged in. It's essential for the service to work, so we don't ask for consent. We don't use any other cookies.
Your rights
Under UK data protection law you can ask us to access, correct, delete or export your personal data, or object to how we use it. Email [email protected] and we'll respond within a month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If we change this policy in a meaningful way, we'll update the date above and email active customers.