Privacy Policy
Last updated 24 August 2026
Draft — not yet reviewed by a lawyer. The practices described here are accurate: they match what the software actually does. The legal wording, the governing law and the company details have not been checked by anyone qualified, and the operating entity is not yet named. Do not rely on this document as it stands.
Two kinds of people
Tracebird holds data about two groups, and the rules differ for each.
Customers are the people with an account. We decide what to collect about them, so we are the data controller.
Testers are the people who file reports through a customer's app. The customer decides what their app captures and who may see it; we only process it on their instructions. For that data the customer is the controller and we are the processor. If you are a tester and want your report removed, ask the company whose app you were testing — they can delete it themselves, immediately.
What we collect about customers
- Your account. Email address, and the name and avatar your identity provider gives us when you sign in with Google or GitHub. Nothing else.
- Your workspace. Project names, allowed origins, teammates you invite, and the settings you choose.
- Sessions. A random secret stored hashed, its expiry, and the browser string of the device that signed in.
We do not run analytics or advertising trackers on the dashboard, and we have never sold data to anyone.
What a report contains
This is the customer's data, captured by their app. The exhaustive list, with the size limits, is in Captured context. In summary:
- What the tester wrote, and the name they gave if any.
- Console output, JavaScript errors and the pages visited during the session.
- Network requests: method, URL, status and duration. Request and response bodies are never captured, and authorization headers are stripped.
- Screenshots, DOM snapshots and session recordings, when the customer enables them. Inputs are masked by default and password fields always are.
- Browser, viewport, language, timezone and connection type.
Who else sees it
These companies process data on our behalf. We use them because we cannot run everything ourselves; we do not give them the right to use the data for their own purposes.
| Who | What they see | Why |
|---|---|---|
| Anthropic | The text of a report and its technical context | AI triage: writing a title, repro steps and severity, and spotting duplicates |
| Cloudflare (R2) | Screenshots, snapshots and recordings | Storing captures outside the database |
| Prisma | Everything else | The database |
| Resend | Your email address and the message sent to it | Sign-in links, invitations and report notifications |
AI triage can be turned off for a workspace, in which case nothing is sent to Anthropic. Reports are not used to train anyone's models.
How long we keep it
Reports are deleted automatically once they pass the window of the plan they were filed on — 30 days on Free, 90 on Indie, a year on Studio. This is enforced by a scheduled job, not by a promise.
Deleting a project deletes its reports, comments and captures immediately. Deleting your account deletes your workspace with it. Sign-in links and expired sessions are cleared on the same pass.
Two things survive a deletion for a short while: backups of the database, which roll over on their own schedule, and the delivery log our email provider keeps for 30 days.
What you can ask for
- A copy. Export every report in your workspace as CSV or JSON from the dashboard, without asking us.
- Deletion. Delete a project or your account from the dashboard. Both take effect at once.
- Correction, restriction, objection, or a complaint. Write to hello@tracebird.dev. We answer within 30 days.
Security
Sessions, sign-in links, invitations and API tokens are stored hashed, never as the value itself, so a leaked database row cannot be replayed as a credential. Captures live in a private bucket and are served through links that expire in minutes, minted only after checking you belong to the workspace. The dashboard's API credential never reaches a browser.
No system is beyond compromise. If one happens and it affects you, we will tell you what we know, when we know it.
Children
Tracebird is a tool for software teams and is not directed at anyone under 16. We do not knowingly hold data about children.
Changes
We will post any change here and update the date above. If a change materially affects what we do with your data, we will email you before it takes effect.