Privacy Policy

1. Data We Collect

When a visitor navigates a website instrumented with Tracabit, our lightweight edge ingestion endpoint collects aggregate, anonymized technical telemetry:

• Pageviews & Routes: Sanitized page paths (e.g. /pricing, /docs). Query parameters containing common PII keys (e.g., email, token, ssn) are automatically stripped at ingestion.
• Passive Session Hashes: Daily non-reversible mathematical hash of the IP address + User Agent + salt to compute 30-minute deduplication without setting client cookies.
• Technical Environment: Browser family, operating system class, and screen resolution bucket.
• Geo-IP Country: Extracted from edge CDN headers. The raw IP address is discarded immediately in memory.
• Performance & Web Vitals: Real User Monitoring (RUM) metrics including LCP, INP, CLS, TTFB, and FID.
• Unhandled Exceptions: JavaScript stack traces and error message fingerprints.

2. How We Use Telemetry Data

We process telemetry data solely to provide real-time observability and analytical dashboards to our customers. We do not:

• Profile individual users across different web domains.
• Sell, rent, or monetize analytics datasets.
• Integrate with third-party advertising exchanges or data brokers.

3. Data Retention & Automated Purging

Telemetry retention is strictly configured per tenant project. By default:

• Free Starter Tier: 1 year rolling raw event retention.
• Pro Tier: 2 years rolling retention.
• Enterprise VPC / Dedicated: Fully customizable retention schedule with automated daily purge logs.

4. Data Storage & Encryption

All event telemetry is stored in encrypted ClickHouse columnar instances (or self-hosted customer VPCs). All data in transit is encrypted using TLS 1.3. EU data residency clusters in Frankfurt (OVHcloud/Hetzner) ensure telemetry never transits outside the European Economic Area.

5. Third-Party Sub-Processors

We maintain an ultra-lean infrastructure footprint. Our production sub-processors are limited to:

• Cloudflare Inc. / Fastly Inc.: Edge CDN caching and DDoS mitigation.
• ClickHouse Cloud Inc. / AWS / Hetzner: Encrypted database hosting.

6. Your Rights Under GDPR, UK PECR & CCPA

Because Tracabit does not collect or store personal data, standard data subject access requests (DSARs) are practically exempt. However, customer accounts retain full rights to:

• Export all raw event logs via ClickHouse SQL console or CSV export.
• Purge complete tenant projects and revoke all API keys instantly.
• Execute our legally binding Data Processing Agreement (DPA).