Privacy.

This is the single privacy policy for Tracelane. It covers both tracelane.dev — the website you are reading — and the hosted product: the gateway, the dashboard, and the audit ledger.

What we collect on the website

Your email address, if you submit the product-updates form.
Your IP country (two-letter code, from Cloudflare's CF-IPCountry header) and a truncated User-Agent string, stored alongside your email for abuse detection only.
Cloudflare Web Analytics aggregate data: page views, referrer, geographic region. Collected by Cloudflare's small cookieless analytics script; no cookies are set in your browser.

What we don't collect on the website

No cookies are set by tracelane.dev. Nothing in your browser to delete.
No third-party trackers. No Google Analytics. No Plausible JS. No Segment. No HubSpot. No Marketo. No Intercom widget.
No fingerprinting.

What the product processes

When you send traffic through the Tracelane gateway or ship telemetry to it, we process:

Account identity. Your email, name, and workspace membership, held by our identity provider. When you sign in, we also keep your email, name, first and latest sign-in time and sign-in count in our own account database (Neon, Frankfurt), so we know who has an account and can contact you about it. Deleting your account erases that record.
Trace telemetry. Spans describing each run: model, provider, token counts, latency, cost, status, tool calls, and the causal structure of the run.
Prompt and completion content. Capture depends on instrumentation and workspace configuration. The gateway supports operator-enabled content capture; OTLP instrumentation and history imports can send message bodies. The response cache can also retain completion bodies. Review the content-capture boundaries before sending sensitive data.
Provider API keys (BYOK). Your own provider keys, envelope-encrypted at rest and bound to your workspace. They are never written to logs, spans, or error messages.
Audit ledger records. A tamper-evident hash chain over gateway-proxied calls and guardrail verdicts.

Service providers and storage

Gateway compute and the primary trace and account databases are in Germany. This is not an EU-only processing promise: the service also uses global edge services, a secondary backup outside the EU-jurisdiction bucket, and identity, payment and email providers whose processing locations are provider-managed. Customer-selectable region pinning is not offered.

Hetzner: Gateway and ingest compute, messaging, and ClickHouse hot storage. Falkenstein, Germany.
Cloudflare: CDN and Workers for the website and dashboard; D1 for the website updates list; R2 for cold trace storage and backup archives. Edge and website processing is global; cold storage and primary backups use the EU jurisdiction. The secondary backup uses Cloudflare's default jurisdiction, without an EU-only restriction.
Neon: Postgres for accounts, workspace settings, encrypted provider credentials, billing metadata, and the canonical audit ledger. Frankfurt, Germany.
WorkOS: Authentication, users, organizations and workspace membership. Provider-managed locations.
Polar: Subscriptions, payment processing and invoicing. Provider-managed locations.
Resend: Transactional billing and usage emails when email delivery is configured: recipient address and notification content. Provider-managed locations.

Model providers receive requests selected by your application using your own provider credentials. Their retention and deletion policies apply to those requests. Audit anchoring also uses the public Sigstore Rekor transparency log for hashes, rather than trace payloads. See the security documentation for that boundary.

Retention

Captured traffic has a plan-defined queryable history: 30 days on Free and 730 days on paid plans. The indexed window controls the recent range used for fast queries; it is not the deletion window. The retention sweep removes traffic older than the workspace's effective queryable window. Curated datasets and experiments are outside that traffic sweep. See pricing for the plan windows.

Audit ledger records and their verification anchors are retained separately, including after workspace deletion. Deleting a workspace does not remove its history from the tamper-evident ledger.

Workspace deletion and recovery

An owner can delete a workspace in Settings by confirming its name. This archives the workspace and marks its API keys revoked; access checks take effect as authorization caches refresh. Contact support during the 30-day recovery window if the deletion was accidental. The purge job selects workspaces archived for more than 30 days. Failed purges need operator review and deletion-status confirmation; this is not an immediate wipe or a guarantee that every copy disappears on day 30.

The purge removes classified tenant data from the online telemetry and account stores, including stored provider-key rows, while retaining ledger records and anchors. It checks the target rows and other tenants' row counts. An unclassified tenant table stops the purge for review. Identity-provider deletion and subscription cancellation are best-effort steps and need separate confirmation if they fail.

Shared backup archives are not rewritten for each workspace deletion; backup pruning and storage lifecycle rules are separate from the workspace purge. Vendor-held billing records and data already sent to your model providers have their own retention rules. For a deletion-status confirmation, a personal-data request, or removal from the website updates list, contact support@tracelane.dev.

Changes

This policy may change. If it changes materially, anyone with an account or on the updates list gets a single email explaining what changed before the change takes effect.

Last updated: September 22, 2026.