What we hold, plainly.
Last updated 2026-07-11. Every claim below maps to shipped behavior — the deeper technical version is /security and the scrubbing docs.
What we collect
(1) The telemetry you send — spans, logs, events, feedback — which can contain whatever your app put in it. (2) Your sign-in email when you use the console or hosted MCP (one-time PIN sign-in; the email is your account and attributes approvals). (3) Operational records: keys as hashes only, project metadata, and the MCP's own per-call telemetry (tool name, duration, outcome — never your tool arguments).
Scrubbed before it is stored
Ingest scrubs by default — sensitive field names are filtered, credential patterns and card numbers are masked — before any row is written, so the lake never holds those raw values. You can add fields, safe-list fields, or opt into email masking per project. Spoken feedback is transcribed at the edge; the raw audio is not retained.
Where it lives
The service runs on Cloudflare infrastructure (Workers, R2 object storage, KV) — our only subprocessor. Voice transcription runs on Cloudflare Workers AI at the edge. No third-party analytics, no ad trackers, no data resale — the only browser storage we use is your theme preference and your own console session.
Who can read it
Only keys and accounts scoped to your project — every read carries a tenant + project clause built server-side from the credential, never from the request. We (the team) access project data only to operate the service or when you ask us to look at something.
Retention & deletion
Sandbox projects have free, unlimited ingest and expire if unclaimed; their rows are purged by the retention job. Archiving a project stops ingest and downgrades its keys to read-only. Want everything gone now? Ask and we delete it.
Your controls
Rotate keys anytime with your recovery code. Change scrubbing rules per project (every change is itself recorded). Producer-side capture flags (recordInputs / recordOutputs) stop values from ever leaving your process. Archive or delete on your schedule, not ours.