Privacy Policy

Last updated: 17 October 2026

This policy explains what personal data You Up? collects, why, who we share it with, how long we keep it, and the rights you have. It covers the Marketing site at uup.dev, the dashboard at app.uup.dev, the notifications You Up? sends, and the public status pages our customers publish.

It is written to meet Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). Where they differ, you get the rights of the law that applies to you.

Who is responsible for your data

The data controller is Sevcan Yorulmazlar (Vookie Labs), a sole proprietorship in Türkiye.

Address: İstanbul, Türkiye
Email: support@uup.dev

What we collect, and why

When you visit the Marketing site

We use Google Analytics to learn how people find and use the Marketing site, so that we can improve it. It runs for every visitor to the Marketing site, on every page except the probe identity page at uup.dev/probe and the page at uup.dev/sms that shows how a phone number opts in to our texts. There is no consent step and no regional exception. A short notice on the site tells you that it uses cookies for analytics; closing the notice does not turn analytics off.

Google Analytics collects:

The pages you view, the page you came from, and how long you stay.
Your browser, operating system, device type, screen size and language.
Your approximate location (country and city), which Google works out from your IP address. Google Analytics 4 does not log or store your IP address itself.
Clicks and scrolls that the Google Analytics script records on its own.

It sets these cookies on uup.dev:

Cookie	What it is for	How long it lasts
`_ga`	Tells one visitor’s visits apart from another’s, with a random ID	2 years
`_ga_<ID>`	Keeps the state of your current visit	2 years

Google keeps this data for 2 months. You can stop it by blocking cookies for uup.dev in your browser, or with Google’s opt-out browser add-on. Closing the cookie notice is remembered in your browser’s local storage, not in a cookie, and is never sent to us.

Our legal basis is our legitimate interest in understanding how people use the Marketing site, so that we can improve it (GDPR Article 6(1)(f), KVKK Article 5(2)(f)).

The Marketing site collects nothing else, beyond what the Down checker below needs. It has no account.

When you use the Down checker

The Down checker at uup.dev/tools/website-down-checker/ checks one website address you type, once from each of our locations, and shows what each one saw. Cloudflare Turnstile checks that you are a person on every check. To keep the checker from being misused, it counts the checks from your IP address and the checks of the website you typed for at most one day, and then forgets them. The answer is shown again to anyone who checks the same address within five minutes. Nothing else of a check is kept, and nobody is shown what the website sent back.

Our legal basis is our legitimate interest in keeping the checker from being used against other people’s websites (GDPR Article 6(1)(f), KVKK Article 5(2)(f)).

When you create an account and use the dashboard

Your account: your name, your email address, and whether you have proven it. If you sign in with a password, we store only a hash of it, never the password itself.
Google sign-in: if you sign in with Google, Google tells us your name, email address and profile picture, and that it has confirmed the address. We ask for nothing more and never for offline access to your Google account.
Two-factor sign-in: if you turn it on, the secret for your authenticator app and your backup codes, stored so that only our servers can read them.
Your sessions: for each signed-in session, the IP address and browser it came from, so that you can see your sessions and sign out of one you do not recognise. The cookie that keeps you signed in is set for uup.dev and its subdomains, so your browser also sends it to the Marketing site and the Docs, which never read it. The dashboard sets one other cookie, sidebar_state, which remembers for 7 days whether you keep the side menu open. It sets no analytics cookies.
Your Organization and Projects: their names, who is a Member and in what role, and the email addresses of people invited to join.
What you monitor: the addresses of your Monitors and their settings. Results of each check, such as response codes, timings and errors. When a check fails, we keep a short piece of the response your server sent, and what each location saw is kept with the Incident.
Where alerts go (Channels): email addresses you add as recipients; Slack, Discord and Microsoft Teams webhook addresses; Telegram chats; phone numbers for SMS and WhatsApp; and your own webhook addresses. Webhook addresses, chats and phone numbers are stored encrypted. We keep a record of each notification we send and what the provider answered.
Billing: your plan, your subscription status, and what you paid. Our payment provider, Creem, is the merchant of record: it collects your card details and billing address and issues your invoices. We never see your card number.
Messages you send us: if you write to us, your message and our reply.

Our staff can look up accounts in our back office, to answer your support request, to look into abuse, or to keep the service running. To see a problem as you see it, they can open your dashboard in a view that cannot change anything. They can also act on an account: for example end its sessions, turn off two-factor sign-in when you have lost your device, change its plan or Credits, or suspend it for abuse. Every time staff open your dashboard, and every action they take on your account, is recorded. Looking an account up in the back office is not.

We process this data to provide You Up? under our contract with you (GDPR Article 6(1)(b), KVKK Article 5(2)(c)), to meet legal duties such as tax records (GDPR Article 6(1)(c), KVKK Article 5(2)(ç)), and to keep the service secure and free of abuse, which is our legitimate interest (GDPR Article 6(1)(f), KVKK Article 5(2)(f)).

When someone adds you as an alert recipient

A customer can add your email address or phone number to a Channel so that you receive their alerts. If you are not a Member of their Organization, the first email we send you says who added you. Every alert email has a link that stops that customer’s alert emails to you at once. A phone number receives nothing but a confirmation code until its owner has typed that code back.

When our probes check a website

Our probes send requests to the addresses our customers ask us to monitor. They say who they are in every request, and uup.dev/probe explains this traffic. We do not collect personal data from the sites we check, beyond what a server sends back in its response.

Public status pages

A customer can publish a status page that shows the state of their services. Its content is the customer’s. A visitor to a status page is not asked to sign in. A status page sets no cookies, loads nothing from other sites, and we do not log who visits it.

Text messages

You Up? texts a phone number only for two things: the one-time code that confirms the number, and alerts about the monitors of the Project whose Channel it is. No marketing is ever texted.

How a number opts in: a customer gives the number in their dashboard, where the form says what the number’s owner agrees to. We text it a one-time code. Only when that code is typed back into the dashboard does the number start getting alerts from that Organization. Until then it gets nothing but codes.
How often: it depends on the monitors’ events: a text when a monitor goes down or comes back up, and, if the customer turned them on, reminders while it stays down. Msg & data rates may apply.
STOP and HELP: In the United States and Canada, our texts come from a phone number. Reply STOP to any of them and no more texts reach your number from us. Reply HELP for help, or write to support@uup.dev.
Stopping texts from uup: everywhere else, our texts come from the name uup, which cannot take a reply. To stop them, ask the customer to remove the number from their Notifications, or write to support@uup.dev. The customer can delete the Channel in any country, which stops its texts at once.

Mobile numbers and SMS consent are never shared with third parties or affiliates for marketing or promotional purposes. Twilio, which sends our texts, processes the number only to deliver them.

Who helps us process your data

We share personal data only with the providers we need to run You Up?:

Provider	What they do for us	Data they process
Creem	Payments, as merchant of record	Your name, email address, card and billing details
Resend	Sends every email	Email addresses and the content of the email
Twilio	Sends SMS and WhatsApp messages	Phone numbers and the content of the message
Google	Sign in with Google; Google Analytics on the Marketing site	Your Google account details; Marketing site visit data
Cloudflare	Serves our DNS and hosts the Marketing site and the Docs; Turnstile tells people from bots on some dashboard forms and on the Down checker	IP address of every visitor to the Marketing site and the Docs; browser signals
Slack, Discord, Microsoft Teams, Telegram	Deliver alerts to the Channels you add	The content of the alert
UpCloud	Hosts our servers and our database	Everything listed above
Backblaze	Stores our database backups, in the EU	Everything listed above

Some of these providers are in the United States or elsewhere outside Türkiye and the EU. Where a provider is in the United States, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

We do not sell your personal data, and we do not use it for advertising.

How long we keep it

Check results: each result for 30 days; hourly summaries for 396 days; daily summaries with no fixed end. The short piece of a failed response is kept for 7 days.
Incident detail: what each location saw when an Incident opened is kept with the Incident, for as long as its Project exists.
Records of notifications we sent: who each one went to and what the provider answered, for as long as the Project exists.
Webhook delivery details: the request and every attempt for 30 days; after that only the delivery’s status and times, for as long as the Project exists.
Invitations: expire after 7 days. The invitation, with the invited email address, is kept until its Organization is deleted.
Your account: until you delete it. Deleting your account removes your user, your sessions and your sign-in methods at once. Channels and Monitors you created stay with the Project they belong to, because they belong to the Organization, not to you. If you own an Organization, you need to transfer it or delete it first.
A deleted Organization: its subscription ends at once, and its Monitors, Channels, status pages and Credits are deleted. We keep its name and its Projects’ names, so that old records still say what they belonged to, and its billing records.
Billing records: your plan, payments and the payment notices Creem sends us are kept for at least 10 years, as Turkish tax and commercial law requires.
What our staff do on your account: each thing our staff do on your account, such as viewing it or ending your sessions, is recorded, and the record is kept for three years. It keeps your email address for those three years, even after you delete your account.
Marketing site analytics: see above.
Down checker: the counts of checks for at most one day; an answer for five minutes.
Backups: our database backups are kept for 30 days, so data you delete stays in them for up to 30 days more.

Your rights

Under KVKK Article 11 and GDPR Articles 15 to 22, you can ask us:

whether we process your personal data, and for a copy of it;
why we process it, and whether we use it for that purpose;
which third parties in Türkiye or abroad we share it with;
to correct it if it is wrong or incomplete;
to delete it, or to restrict how we use it;
to tell the third parties we shared it with that it was corrected or deleted;
to give it to you in a portable format;
to stop processing it on the basis of our legitimate interest;
to object to a result against you that comes only from automated processing;
for compensation if unlawful processing caused you damage.

You can delete your account yourself in the dashboard. For anything else, write to support@uup.dev. We answer within 30 days, free of charge, as KVKK Article 13 requires.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, if you are in the EU, to the data protection authority where you live or work.

Security

We encrypt traffic to every part of You Up?. Passwords are stored only as hashes, and webhook addresses, chats and phone numbers are stored encrypted. Two-factor sign-in is available on every plan.

Children

You Up? is a service for businesses and developers. It is not meant for children, and we do not knowingly collect data from anyone under 18.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use the data of existing customers, we will tell them by email before it takes effect.

Contact

Sevcan Yorulmazlar (Vookie Labs), İstanbul, Türkiye, support@uup.dev.