privacy
What happens to a trace you upload.
Last updated 2026-08-18
This page describes the service as it is built today, not as it is planned. Pre-Beta: no accounts, no payment, no saved history.
No account, no tracking
There is no sign-up and no login. There is no cookie banner because the site sets no cookies, loads no analytics script, and embeds no third-party tracker. Our hosting providers keep their own standard request logs, as every web host does.
Your trace is analyzed, then discarded
An uploaded file is sent over HTTPS to the analyzer, written into a temporary directory, analyzed, and that directory is destroyed when the request ends. The file is not persisted, not copied elsewhere, and not used to train anything.
Where the analysis runs
The hosted analyzer runs on Modal, a third-party serverless platform, so an uploaded trace does leave your machine. If you would rather it did not, run the same detector locally — the deterministic detectors need no network and no API key.
No model provider sees your trace
The hosted analyzer runs the deterministic detectors only. The optional LLM-judge layer is not enabled on it, so no part of your trace is sent to a model provider.
Trace bodies are never in the report
The analyzer is invoked with --no-snippets, so prompt text and tool output from your trace are not included in the report at all.
What the report does contain
A report can contain file paths and commands taken from your own trace — which file was read twice, which command ran again. Those are not masked, because that is the finding. The report is returned to the browser that uploaded it and nowhere else: there are no share links and no stored history in this scope.
If the analysis fails
A failure returns diagnostic output. That output is sanitized before it is returned or written to logs: caller-side file paths, email addresses, and secret-shaped strings such as API keys and bearer tokens are masked. The report body itself is deliberately left unmasked, for the reason above.
Limits
One file per analysis, .json or .jsonl, up to 10 MB.
Questions
Open a GitHub issue. There is no support inbox yet, and we would rather say so than publish an address nobody reads.
Claims on this page describe implemented behavior. We do not claim encryption at rest, anonymization, or regulatory compliance that we have not built and verified.