Privacy policy
Automation Patrol, an app for monday.com, provided by QQuark Apps ("we"). Last updated: 16 October 2026.
This policy says what Automation Patrol reads from your monday.com account, what it keeps, for how long, where, and who else is involved. It covers the app and this website.
What the app does
Once an account admin connects it, Automation Patrol checks the account every hour for automation runs that failed or ran out of retries and for outside connections that stopped working, and sends a monday.com bell notification to the people the admin chose, plus a daily summary. If the admin sets an automation-action allowance, it also counts the account's billed automation actions against it and warns before the allowance runs out. Its Inventory page shows what automations and outside connections the account relies on, who owns each, and which are at risk — for example a connection created by someone who has since left the account.
What the app reads from monday.com
- Failed and retried-out automation runs: their id, state, start time, board, step number and error reason.
- The account's outside connections: their id, provider (for example "gmail"), state, and the monday.com id of the person who owns the connection. When an admin opens the Inventory page, the app also reads each connection's display name and the owner's name, live, to show them — never kept. A display name can be an email address.
- Board ids and names; people's monday.com ids and names (to let the admin choose who gets alerts); the connecting person's id, admin role, and the account's id and web address.
- Which people have left the account (their monday.com ids), to flag connections they created.
- The account's automation runs and their billed action counts, for the allowance watch, and the failure counts of each automation and workflow, for the Inventory page.
The app does not ask for item names, column values, updates or files. The permission to read boards would allow more; the app does not use it for more. Connection display names (which can be email addresses) and people's names are read live for the Inventory page and shown, never kept.
What the app keeps, and for how long
| What | Why | How long |
|---|---|---|
| The account's monday.com access token | To run the hourly check while nobody is signed in | Until the app is uninstalled (deleted at once) or monday.com stops accepting it (deleted at once) |
| The admin's settings: chosen people (ids), boards (ids), quiet hours, time zone, summary hour, automation-action allowance, warning levels and the day of the month the allowance resets on | To do what the admin asked | Until the app is uninstalled |
| The account's summed automation-action count, the billing cycle it belongs to (by the admin's reset day), and which warning levels were already sent, with times. A 12-character fingerprint of each run already counted (not the run's id), at most 10,000 at a time; for at most 50 runs whose action count monday.com has not settled yet, the run's id itself, to ask again | To write the daily summary's allowance line, to count each run once, and to warn once per level per billing cycle | While the cycle it belongs to is current. Fingerprints only while the part of the cycle being read could return that run again: normally about two hours, longer while a first cycle or a missed stretch is read. A run's id: until its count settles, or it is given up (after three failed lookups, a day, or 10 days after it started). The marks close when the allowance is cleared or the cycle passes |
| The account's id and web address, and the id of the admin who connected the app | To know which account a check belongs to, and who gets alerts if nobody is chosen | Until the app is uninstalled |
| Problems found: board id and name, step number, a reason category from a fixed list (for example "a column the automation uses was deleted"), times and counts | To group repeats into one alert and write the daily summary. At most 150 problems are kept one by one; more at once are counted together | About two days after the problem was last seen; up to 10 days while a check catches up on missed hours |
| A 12-character fingerprint of each automation run already counted (not the run's id itself); for at most 50 runs whose failing step monday.com could not yet say, the run's id itself, to ask again | So a run is counted once | While monday.com could return that run again: normally about a day, up to 10 days while a check catches up. In a very busy account the oldest may be removed sooner; that can make a count in the summary too high, never send an alert twice. A run's id kept to ask about its step: until monday.com answers, after three tries, or 10 days at most |
| Outside connections that are not working: id, provider, state, owner's id | To alert once when a connection breaks, and again only after it was fixed and broke again | Until the connection works again |
| The automation inventory: each connection's id, provider, state and owner's id (and whether that person has left the account), and each failing automation's or workflow's id and failure count, with times | To show the Inventory page, and to alert once when a connection still depends on a person who has left, and again only on a new change. Connection and owner names are read live from monday.com when an admin opens the page, never kept | The snapshot of every connection is replaced each hour while the app is installed; a closed flag's record is dropped within about two days of closing |
| In Cloudflare D1 (below): the account's id, random ids of its installations and of each admin's connection with its stage (being set up, in use, ended), a mark made from each uninstall's time, times (installed, connected, uninstalled, changed, connection refused, last checked, removed, sign-in link asked for), how many sign-ins have begun and the number of the one in use, and the random id of the hourly check that is checking it. No content from your account: no token, names, boards, settings or problems | So that several copies of the app running at once agree which accounts are installed, check each account once an hour in turn, and clean up after an uninstall | Until the app is uninstalled; then the ids and times for one day (longer only until the app's hourly cleanup has finished with them, and at least a day after the last sign-in link), and an ended connection's id, stage and times for 30 days |
| Alerts waiting to be sent: recipient's id, problem, times; the alert's text only while a send is being retried | To send each alert once, even after an interruption | Until sent; one that cannot be sent for 7 days is dropped |
| A record of each alert sent, and of any alert that may not have arrived after an interruption: recipient's id, problem and times, not the text | Never to send an alert twice, and to say in the daily summary when one may be missing | 2 days |
Never kept by the app: the text of error messages (the app reads it once to choose a category from a fixed list, then drops it), step titles, item names, column values, email addresses, connection display names, connection account identifiers (which can be email addresses), user names, passwords. The Inventory page shows connection and owner names by reading them live from monday.com at that moment, never from storage. Board names are kept because they make an alert readable; they are your account's own labels, and a board may be named after a person or client.
If monday.com stops accepting the app's access and nobody reconnects it, everything else kept for the account is deleted 7 days later. The same holds in the rare case that monday.com's notice of an uninstall does not say when it happened: the app then deletes nothing straight away, monday.com stops accepting its access, and the rest goes 7 days later. If an admin installs and connects the app again before an earlier uninstall notice arrives, the new connection is kept and everything from before it is deleted.
Email to support is separate from the app: if you write to [email protected], we keep your address and what you wrote in the support mailbox as long as needed to answer and follow up, and delete it sooner if you ask.
Where it is kept, and how it is protected
- Everything the app keeps, the access token included, is in monday.com's own secure storage for apps ("monday code" secure storage), which is encrypted and private to the app, except the coordination record above (ids and times only), which is in a Cloudflare D1 database that only the app uses. The app runs on monday.com's own hosting ("monday code"). Nothing is kept in any other database, file or service.
- All traffic uses HTTPS (TLS 1.2 or higher).
- Every request to the app is checked: settings requests must carry monday.com's signed session token for that account; only an admin can change settings or connect; monday.com's signed tokens are required for uninstall events and for the hourly check.
Logs
The app writes a short log to monday.com's own app log (monday code), for example "account checked: 2 new failures, 1 alert sent". Log lines hold account ids, counts and error codes only: no tokens, names, board names, email addresses or error text. Each request to the app adds one line with which of the app's routes it used and the answer's status, never the rest of the address or anything sent with it. The app cannot delete lines from monday code's logs; monday.com keeps them for the period it sets for its app hosting, which it has not published.
Other companies involved
| Who | What for |
|---|---|
| monday.com Ltd. | The platform the app works in: monday.com's API (reading runs and connections, sending notifications), hosting (monday code) and secure storage. monday.com may also email a notification to a person, depending on that person's own monday.com settings. monday.com's privacy policy applies to monday.com itself. |
| Cloudflare, Inc. | Hosts this website (including the how-to-use page shown inside the app). Cloudflare sees ordinary web requests to this website, such as the visitor's internet address. Cloudflare also passes on email sent to [email protected]. And Cloudflare runs the app's coordination database (Cloudflare D1), which holds only the account ids, installation ids and times described above, no customer content; the app sends Cloudflare nothing else. |
| Google LLC (Gmail) | Holds the support mailbox: email sent to [email protected] is delivered to a Gmail inbox, where we read and answer it. The app itself sends no data to Google. |
We do not sell, rent or share data with anyone else, and we use no advertising, analytics or tracking.
Cookies
The app and this website set no cookies and use no tracking technologies.
Your choices and rights
- Uninstalling the app deletes at once everything the app itself keeps for your account. The account's id and a random id of that installation are kept for one day afterwards (longer only until the app's hourly cleanup has finished with them), so that anything a request already under way writes back is deleted again. Two things the app cannot delete: lines already written to monday code's logs (ids and counts; see "Logs") and notifications already delivered to people in monday.com, which they can delete there.
- You can ask us what we keep about you, or ask us to correct or delete it, at [email protected]. We answer as soon as we can, and within 20 working days (the limit New Zealand's Privacy Act 2020 sets), or sooner where the law that applies to you requires it.
- If you are in the European Economic Area or the United Kingdom, the account's admin decides why data is processed and we process it on the account's behalf. You may also complain to your data protection authority.
Changes
If this policy changes in a way that matters, we update the date above and publish the new version on this page at least 30 days before it takes effect, unless a change is needed sooner for legal or security reasons; then we say so on this page when it takes effect.
Contact
QQuark Apps, [email protected].