Privacy.

This is the single privacy policy for Tracelane. It covers both tracelane.dev — the website you are reading — and the hosted product: the gateway, the dashboard, and the audit ledger.

What we collect on the website

Your email address, if you submit the product-updates form.
Your IP country (two-letter code, from Cloudflare's CF-IPCountry header) and a truncated User-Agent string, stored alongside your email for abuse detection only.
Cloudflare Web Analytics aggregate data: page views, referrer, geographic region. Server-side beacon, no cookies set in your browser.

What we don't collect on the website

No cookies are set by tracelane.dev. Nothing in your browser to delete.
No third-party trackers. No Google Analytics. No Plausible JS. No Segment. No HubSpot. No Marketo. No Intercom widget.
No fingerprinting.

What the product processes

When you send traffic through the Tracelane gateway or ship telemetry to it, we process:

Account identity. Your email, name, and workspace membership, held by our identity provider.
Trace telemetry. Spans describing each run: model, provider, token counts, latency, cost, status, tool calls, and the causal structure of the run.
Prompt and completion content — we do not capture it. Neither the gateway nor our SDKs record your message bodies; we store the shape of a run without its text. The only way prompt text reaches us is if your own OpenTelemetry instrumentation sends it to us explicitly.
Provider API keys (BYOK). Your own provider keys, envelope-encrypted at rest and bound to your workspace. They are never written to logs, spans, or error messages.
Audit ledger records. A tamper-evident hash chain over gateway-proxied calls and guardrail verdicts.

Where your data lives

Hosted Tracelane runs in the European Union. Trace data is not replicated outside your region.

Compute and hot trace storage — Hetzner, Falkenstein, Germany.
Cold trace storage — Cloudflare R2, EU jurisdiction.
Account and workspace metadata — Neon Postgres, Frankfurt, Germany.
Website updates list — Cloudflare D1, pinned to Cloudflare's nearest edge to the submitter, not replicated cross-region.

Sub-processors

A deliberately short list. Each one is here because it is load-bearing, not for convenience.

Hetzner Online GmbH (Falkenstein, DE) — compute and hot trace storage.
Cloudflare, Inc. — CDN, Workers, R2 cold storage (EU), and D1 for the website updates list.
Neon, Inc. (Frankfurt, DE) — Postgres for account and workspace metadata.
WorkOS, Inc. — authentication, workspace membership, and SSO.
Polar Software Inc. — Merchant of Record for subscriptions and payments. Card details go to Polar and its processor; we never see or store them.

We never send your prompts or completions to a model provider on our own initiative. You bring your own provider keys, and traffic goes to the provider you selected.

How long we keep it

Trace retention has two windows that differ by plan: an indexed window for fast queries (3 days on Free, up to 365+ days on Enterprise) and a longer queryable history (30 days on Free, 730 days on every paid tier) during which older data is still readable from cold storage. See /pricing for the full per-tier figures. Longer retention is never a shortcut around erasure: deletion on request is unaffected.

The tamper-evident audit ledger is retained for the life of the ledger by design: a record you can selectively delete is not a tamper-evident record.

Deletion and your rights

Email support@tracelane.dev and we will remove your tenant's trace data and account metadata. Deletion is handled manually by our team today — there is no self-serve erasure endpoint, and the append-only audit ledger is retained as described above. GDPR data-subject requests and India DPDP rights requests are handled through the same address, as is removal from the website updates list.

Changes

This policy may change. If it changes materially, anyone with an account or on the updates list gets a single email explaining what changed before the change takes effect.

Last updated: July 28, 2026.