Privacy Policy
Last updated: September 2026
This Privacy Policy explains how TraceRoot, Inc. (“TraceRoot,” “we,” “us”) collects, uses, and shares information when you use our website, our hosted platform at app.traceroot.ai, our SDKs and command-line tools, and related services (together, the “Services”). It supplements our Terms of Service.
1. Two kinds of data
We handle two categories of information and treat them differently.
- Account data is information about you as a user of TraceRoot: your name, email address, workspace and project settings, billing status, and how you use the product. We are the controller of this data.
- Customer data is what your applications send to TraceRoot: traces and spans from your AI agents, which can include prompts, model responses, tool inputs and outputs, and any attributes your code attaches; and, if you connect an integration, content from your GitHub repositories or Slack workspace. You own this data and decide what to send. We process it only to provide the Services to you, as described in the Terms.
2. What we collect
| Data | Source | Why |
|---|---|---|
| Name, email, avatar | Sign-up with email and password, or Google sign-in | Create and secure your account, send account email |
| Session and device information | Your browser | Keep you signed in, protect against abuse |
| Product usage events | Your browser, via PostHog | Understand which features are used; page views and clicks tied to your user ID, never trace content |
| Billing details | Stripe checkout | Payments. Card numbers are entered on Stripe’s pages and never reach our systems |
| Traces, spans, sessions | Your applications, through our SDKs, CLI, or OpenTelemetry | Provide observability, detectors, evaluations, and the analysis agent |
| Repository contents | GitHub, when you install our GitHub App | Let the analysis agent read code related to a trace, in a sandbox, for the duration of a run |
| Slack channel identifiers | Slack, when you connect it | Deliver detector alerts to your channel |
| API keys and integration tokens | Generated in the product | Authenticate your SDKs and integrations; stored hashed or encrypted |
3. How we use account data
- To operate the Services, authenticate you, and provide support.
- To send transactional email such as invitations, usage notifications, and security notices.
- To understand product usage in aggregate and improve the Services.
- To bill you and to comply with law.
We do not sell personal information, and we do not use customer data to train machine-learning models.
4. AI features
Some features send data to large-language-model providers on your behalf: the analysis agent and detector root-cause runs send the prompt you write and the relevant parts of the trace to Anthropic or OpenAI, using either keys you supply (“bring your own key”) or keys TraceRoot holds. Under those providers’ API terms, data sent through the API is not used to train their models. When the agent needs to run code, it does so in an isolated sandbox provided by Daytona that is discarded after the run.
5. Who we share data with
We share data only with service providers that help us run TraceRoot, under contracts that limit their use of it, and when the law requires. Our sub-processors as of the date above:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, databases (all customer data at rest) | United States (us-east-1) |
| Anthropic | Language models for agent and detector features | United States |
| OpenAI | Language models for agent and detector features | United States |
| Daytona | Isolated sandboxes for the analysis agent | United States |
| Stripe | Billing and payments | United States |
| Resend | Transactional email | United States |
| PostHog | Product analytics (account data only) | United States |
| Optional sign-in | United States | |
| Vercel | Hosting of this website (no customer data) | United States |
| Cloudflare | DNS for traceroot.ai (no customer data) | United States |
| GitHub, Slack | Only when you connect them, to read repositories or deliver alerts | United States |
We will update this list before adding a sub-processor that handles customer data, and note the change in our changelog.
6. Retention and deletion
- Customer data is kept while your workspace is active. Your plan sets how far back queries can reach (15, 30, or 90 days, or a custom window); data outside the window is not shown but is not deleted automatically.
- You can delete projects and workspaces in the product, and you can ask us to delete your account and all associated data by writing to the address below. We complete deletion within 30 days, after which data survives only in encrypted backups that expire within 7 days.
- Account and billing records are kept as long as needed for accounting and legal obligations.
7. Security
Data is encrypted in transit with TLS and at rest in our databases and storage. Access to production systems is limited to named staff with single sign-on and multi-factor authentication, and is reviewed quarterly. More detail is on our security page. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.
8. Your choices and rights
- You can view and update your account information in the product.
- You can export customer data through the API and CLI at any time, and for a limited period after termination, as described in the Terms.
- Depending on where you live you may have rights to access, correct, delete, or restrict processing of your personal information. Write to us and we will respond within 30 days.
- Product analytics can be declined by contacting us; declining does not affect the Services.
9. Cookies
The product uses a session cookie to keep you signed in and PostHog cookies for product analytics. This website uses no tracking cookies. We do not respond to “Do Not Track” signals because there is no common standard for them.
10. Children, international transfers, changes
The Services are for businesses and are not directed at children under 16. We are based in the United States and process data there; if you use the Services from elsewhere, your data is transferred to the United States. We will post changes to this policy here and, for material changes, email account owners before they take effect.
11. Contact
TraceRoot, Inc. · [email protected]