We hold the minimum.

Your account email, your workspace name, the operational signals you choose to send us, and standard server logs (IP, request path, response code) for 30 days.

We don't read message bodies of your alerts, we don't sell anything to anyone, we don't run third-party trackers on the dashboard.

EU workspaces stay in EU regions. US workspaces stay in US regions. Self-hosted deployments stay on your infrastructure.

Settings → Workspace → Delete workspace. The Auth identity, all Firestore docs, and all Storage objects are removed within 30 days. Email privacy@sutrace.io if you'd like a copy of everything we hold first.

Firebase (Google Cloud, hosting + auth + Firestore + storage) is currently our only sub-processor. We'll notify in-product before adding any more.