Privacy Policy

1. Introduction & Operating Models

TraceIQ is a developer-first behavior intelligence and observability platform engineered for web, mobile, and backend systems. Depending on how you interact with TraceIQ, two primary operating architectures apply:

• TraceIQ Cloud (Hosted SaaS): When you register for our hosted dashboard, telemetry ingested from your projects is stored in dedicated, access-controlled databases maintained by TraceIQ and our vetted infrastructure partners.
• TraceIQ Self-Hosted (Community & Enterprise): When you run the open-source TraceIQ containers on your own infrastructure (Docker, Kubernetes, PostgreSQL), all event ingestion, session recordings, and database tables reside exclusively in your environment. TraceIQ does not collect phone-home telemetry or exfiltrate your analytics data.

2. Information Collected & Telemetry

When you instrument your applications using TraceIQ SDKs (JavaScript, React Native, Node.js, Python, or Go), the following categories of telemetry data may be collected:

• Behavioral Events: Page views, route transitions, custom interaction events, button clicks, funnels, and feature flag evaluation results.
• Technical & Device Context: User agent, browser vendor, operating system, screen resolution, viewport dimensions, language preferences, and approximate network connection type.
• Network & Geolocation: Client IP address (which can be truncated or hashed at ingest) used to derive approximate country/region coordinates.
• Diagnostic Telemetry: JavaScript exceptions, stack traces, console breadcrumbs, API roundtrip latencies, and HTTP status codes.
• Identified User Profiles: Optional user IDs, organization IDs, and custom traits passed explicitly by your application via the identify() method (such as plan level, workspace ID, or role).

3. Browser Storage & No Third-Party Cookies

The standard TraceIQ client SDK does not use third-party tracking cookies or participate in cross-site identity graphs.

• localStorage: Used to retain a pseudorandom first-party anonymous device identifier (e.g. tiq_anon_id) to connect sessions over time on the same domain.
• sessionStorage: Used to retain an ephemeral session identifier (e.g. tiq_session_id) that expires automatically when the user closes their browser tab.

Because local and session storage are restricted to the origin origin domain, visitors cannot be tracked across unrelated websites.

4. Session Replay & Privacy Masking

If you enable TraceIQ Session Replay, the SDK records a privacy-sanitized stream of DOM mutations to reconstruct user workflows and diagnose UX friction.

• Automatic Input Redaction: All password fields, credit card inputs, and sensitive form elements are masked by default on the client before serialization.
• Class-Based Masking: Any DOM element marked with the CSS class .tiq-mask or attribute data-tiq-mask will replace text content with placeholder blocks.
• Exclusion Rules: Elements annotated with .tiq-ignore or data-tiq-ignore are completely omitted from the recorded DOM tree.

5. AI Copilots, Cencori & Model Context Protocol (MCP)

TraceIQ incorporates AI-driven insights and natural language query assistance powered by services like Cencori, and provides an optional Model Context Protocol (MCP) server allowing developer tools (such as Claude Code, Cursor, or custom agents) to inspect telemetry, investigate error spikes, and summarize funnels.

• Permission Scoping: Every AI interaction requires a cryptographically generated Personal Access Token (PAT) with explicit read or write scopes.
• No Training on Customer Data: Neither TraceIQ nor our AI partners (including Cencori) use your raw customer telemetry, logs, or user records to train public machine learning or foundation models without explicit consent.

6. How We Use and Process Information

We use collected information solely to provide and operate the TraceIQ platform, including:

• Generating aggregation charts, retention matrices, funnel metrics, and latency graphs.
• Triggering anomaly alerts, error notifications, and webhook webhooks to your designated endpoints.
• Authenticating organization members, managing subscriptions, and preventing abusive automated traffic.
• Providing customer support and debugging service degradation.

7. Data Retention, Deletion & Export

You retain complete ownership of your project data. In TraceIQ Cloud:

• Configurable Retention: Telemetry, error logs, and session replays are retained in accordance with your organization's chosen retention window (default 30 to 90 days on standard plans).
• Hard Deletion: When an organization or project is deleted, all associated event records, session replays, and API tokens are permanently purged from primary databases within 30 days.
• Data Portability: You can export full event datasets at any time via our REST APIs or direct PostgreSQL replication connections.

8. Operator Responsibilities & Compliance (GDPR/CCPA)

Under data protection laws (such as the EU General Data Protection Regulation and the California Consumer Privacy Act), the deploying organization is the Data Controller and TraceIQ acts as the Data Processor.

Organizations deploying TraceIQ are responsible for:

• Providing proper notice to end-users regarding analytics and telemetry collection.
• Obtaining valid consent or establishing a legitimate legal basis in jurisdictions where required (e.g. EU/UK ePrivacy regulations).
• Honoring end-user Data Subject Access Requests (DSARs), including right-to-be-forgotten and data rectification requests.
• Configuring client SDK masking rules to prevent unintentional collection of sensitive personal data.

9. Security & Infrastructure Safeguards

We employ industry-standard organizational and technical safeguards:

• Encryption in Transit: All API ingestion endpoints and dashboard traffic enforce TLS 1.3 / HTTPS encryption.
• Encryption at Rest: Database volumes and backups are encrypted using AES-256.
• Multi-Factor Authentication (MFA): TOTP-based two-factor authentication is available for all user accounts.
• Role-Based Access Control (RBAC): Granular permissions (Owner, Admin, Member, Read-Only) across workspaces.

10. Third-Party Subprocessors

TraceIQ Cloud engages trusted third-party subprocessors to deliver core infrastructure:

11. Contact & Data Subject Inquiries

For questions regarding this Privacy Policy, Data Processing Agreements (DPAs), or privacy practices, please contact us:

• Email: traceiq.run@gmail.com
• Security Inquiries: traceiq.run@gmail.com