Privacy

LogSure is built to count visits without tracking people, and to keep what people send you safe. These are rules of the engine, tested in its core, not settings you have to find.

Analytics without cookies

The tracker sets no cookies and uses no storage on the visitor's device: no localStorage, no fingerprinting script.
No IP address or User-Agent is written anywhere. They are used in memory to make the visitor's code for the day, and to read the device and browser.
The visitor's code is sha256(salt, app, ip, ua) cut to 16 hex characters. The salt lives one UTC day; after its day it is deleted, in the database and in every backup. The same person tomorrow is a new visitor, and nobody, you included, can turn a code back into an address.
The app's id is part of the code, so one person cannot be linked from one app to another.
Of a URL, only the host, the path and the utm_* parameters are kept, and of a referrer only its host. A path segment holding an email address is replaced.
Event names and properties that hold an email address, an IP address or a User-Agent are refused.
The country comes from your proxy's header (Cloudflare's, for example), not from a lookup of the address.

Errors, traces and experiments

Before an error report, a span attribute or a log is stored, email addresses, tokens and keys, card-like numbers and URL query strings are removed. Credentials, cookies and authorization headers are never stored.
Automatic error capture is off until you turn it on per app. Failed requests are recorded by method, address without its query, status and time, never by body or headers.
A/B variants and feature flags are worked out in the page. The id, score and attributes you pass to logsure.variant and logsure.flag stay there; the flag config is the same for every visitor.

First-party

The ingest API runs under /_care/ on your app's own host, routed to your LogSure server. Visitors' browsers talk only to the site they are on, and the data goes only to your server.

Email addresses

Personal data (email addresses and names) appears only in the inbox, the waitlist and the Privacy page, and in the API only to callers with the inbox scope.
With DATA_KEY set, email addresses are sealed at rest with AES-256-GCM, and found again through a keyed HMAC-SHA256 of the address. A copy of the database alone does not reveal them; keep the key with your backups.
A waitlist signup gets the same answer whether the address is new or not, so a form never tells anyone who is on the list.

Retention and erasure

Data	Kept, by default
Events	750 days
Requests	730 days
Spam	30 days
Attachments	180 days
Error occurrences	90 days
Spans	7 days
OpenTelemetry logs	14 days
Backups	7 daily copies, without the salts

The server-wide limits are environment variables; each app can set its own retention in Settings › Apps. The console's Privacy page finds everything stored for one email address, downloads it, or erases it.

Transparency page

Every host that routes /_care/ to LogSure has a public page at /_care/ that says what the ingest endpoints receive, use and keep, generated from the running configuration (also as JSON at /_care/privacy.json). Link to it from your privacy policy.

The console

The web console signs in with an HttpOnly, SameSite=Strict session cookie and runs no inline script (script-src 'self'; style-src 'self'); writes must come from its own origin. Two-factor sign-in protects devices and AI connections, which are listed and revocable in Settings.