Privacy Policy

Effective date: April 5, 2026

TriggerDeck provides an iOS app for secure mobile access to Zabbix environments, plus a public website at triggerdeck.io.

This Privacy Policy explains what data TriggerDeck handles, why it is handled, and what choices users have. Unless a stricter legal notice is provided elsewhere, the publisher and controller for the services described here is TriggerDeck.

Contact

For privacy questions or requests, contact [email protected].

Scope

This policy covers:

• the TriggerDeck iOS app
• the optional TriggerDeck alert-gateway used for APNs push delivery
• the triggerdeck.io website and documentation

This policy does not cover a customer’s Zabbix server or other third-party systems operated by the customer.

How TriggerDeck is designed

TriggerDeck is designed to keep customer monitoring credentials on-device:

• the iOS app connects directly to the customer’s Zabbix API
• customer Zabbix API tokens are stored in the iOS Keychain only
• the TriggerDeck alert-gateway is optional and is used only for push notification registration and delivery
• the alert-gateway does not request or store customer Zabbix API tokens

Data handled on-device in the iOS app

When you configure TriggerDeck, the app stores:

• Zabbix API token in the iOS Keychain
• server display name and server URL in local app storage
• push registration secrets in the iOS Keychain, such as the local installation identifier, APNs device token, and server-specific UNIQUE_UID values issued by the alert-gateway

This information is used to authenticate to the customer’s Zabbix server, remember configured servers, and support optional push notifications.

Crash reports, diagnostics, and product analytics

The TriggerDeck iOS app uses Sentry for limited technical monitoring of the app itself.

Sentry is used only to collect:

• crash reports
• app stability diagnostics
• technical diagnostic data needed to investigate failures, hangs, and performance issues

TriggerDeck does not use Sentry to collect user profiles or behavioral analytics. Sentry is configured not to collect personal user data, screenshots, view hierarchy snapshots, customer API tokens, or customer monitoring content for this purpose.

The iOS app also uses Firebase Analytics for product usage measurement.

Firebase Analytics is used only to measure coarse product usage such as:

• screen views
• navigation between major app sections
• feature usage such as filters, search, refresh, chart opening, and dashboard interaction
• connection setup and notification-permission flow outcomes

TriggerDeck does not send server URLs, API tokens, problem names, host names, or remote Zabbix identifiers to Firebase Analytics. Analytics payloads are limited to local technical identifiers such as local server_id, local dashboard or widget IDs, booleans, enums, and coarse counters needed to understand product usage.

Data sent to the TriggerDeck alert-gateway

If push notifications are enabled, the app sends the following data to the TriggerDeck alert-gateway during device registration:

• installation ID
• APNs device token
• local server ID
• app bundle identifier
• APNs environment
• locale
• time zone
• previously issued UNIQUE_UID, when re-registering an existing server on the same device

This data is used only to:

• register the device for push delivery
• route incoming Zabbix webhook events to the correct iOS device and server context
• support secure re-registration and revocation
• troubleshoot delivery failures and protect the service against abuse

Data processed by the alert-gateway

The alert-gateway may store or log:

• push registration records
• hashed UNIQUE_UID values and short suffixes used for operator troubleshooting
• registration attempt audit records
• webhook processing audit records
• IP-based abuse prevention and rate-limit metadata
• APNs delivery status codes and invalid-device-token outcomes

The alert-gateway is designed so that UNIQUE_UID values authorize webhook routing, but customer Zabbix API tokens stay outside the hosted backend.

Data received from customer systems

When a customer configures Zabbix webhook delivery to TriggerDeck, the alert-gateway receives event payloads chosen by the customer’s Zabbix configuration, such as:

• event ID
• problem ID
• host ID
• host name
• problem name
• severity
• status
• trigger time
• tags

This data is used only to construct and deliver APNs notifications to the registered device.

Website data

The public TriggerDeck website may process limited technical data such as IP address, browser metadata, and request logs through hosting and CDN infrastructure.

The website uses a basic cookie-consent flow for Google Analytics. For visitors in GDPR-covered regions, TriggerDeck shows a consent banner before Google Analytics loads. Google Analytics is loaded only after the visitor accepts analytics cookies in those regions. Outside the GDPR-covered region, the website may load analytics without showing the consent banner.

The website may also use necessary storage for site operation, security, and remembering the visitor’s consent memory. When analytics are enabled, Google Analytics may be used to understand aggregate website traffic and documentation usage.

The website may also send a Google Ads conversion event when a visitor clicks an App Store link on the TriggerDeck website. This event is used only to measure whether Google Ads traffic leads to App Store handoff clicks from the website and does not change the iOS app privacy posture described in this policy.

The iOS app includes Firebase Analytics for limited product usage measurement. The iOS app does not use advertising SDKs, ATT tracking, cross-app tracking, or third-party tracking SDKs.

Legal bases and purposes

TriggerDeck processes data to:

• provide the app and website
• operate the website and remember cookie preferences
• measure App Store outbound clicks from the website when website analytics are enabled
• register devices for optional push notifications
• deliver notifications requested by customer-configured webhook events
• maintain service security, rate limiting, and abuse prevention
• troubleshoot operational failures
• understand aggregate iOS product usage
• understand aggregate website usage when analytics cookies are accepted or regional rules do not require the consent banner

Sharing and service providers

TriggerDeck uses infrastructure and service providers to operate the service, including:

• Apple, for APNs push delivery
• Cloudflare, for website delivery, DNS, WAF, and email routing
• hosting and database providers used for the alert-gateway deployment
• Sentry, for crash reporting and limited app diagnostic telemetry
• Google Firebase, for limited product analytics in the iOS app
• Google, if Google Analytics or Google Ads conversion measurement is used on the website

TriggerDeck does not sell personal data and does not use the iOS app for cross-app or third-party tracking.

Data location

TriggerDeck stores and processes service data in the European Union.

This includes:

• the TriggerDeck alert-gateway and its supporting infrastructure
• Sentry crash reports and diagnostic data collected for the TriggerDeck iOS app

TriggerDeck is operated with the intent that the data covered by this policy remains stored in the EU.

Retention

TriggerDeck keeps data only for as long as needed for service operation, security, and troubleshooting. Retention periods can vary by environment and deployment, but the goal is to minimize stored data while maintaining reliable notification delivery and auditability.

Customer-controlled data on the iOS device remains on the device until the user removes the configured server, revokes push registration, clears the app, or deletes the app, subject to iOS platform behavior.

Your choices

You can:

• choose not to enable push notifications
• remove configured servers from the app
• revoke push registration by removing the server from the app
• reject analytics or later reopen Cookie settings from the website footer to change your decision
• contact TriggerDeck at [email protected] regarding privacy questions or requests

Security

TriggerDeck uses system and industry-standard security controls appropriate to the product design, including HTTPS transport, iOS Keychain storage for secrets, APNs token-based authentication on the backend, and server-side rate limiting and audit logging for the alert-gateway.

No method of storage or transmission is completely secure, but TriggerDeck is designed to minimize trust and reduce unnecessary data sharing.

Changes to this policy

This Privacy Policy may be updated as TriggerDeck evolves. Material changes will be reflected on this page with an updated effective date.