Data & privacy
Your users' data stays where you put it
Pick a region per project. Events, people, recordings and AI answers are stored and processed there, and nowhere else.
Regions that mean it
The EU region is live. UAE, US and Pakistan run the same software on in-country infrastructure as they open. There is no global ingest proxy: SDKs send straight to the region named in your key, and queries go straight to it too.
Less data to begin with
IP addresses are never stored: ingest resolves the location and drops the address. Replay is masked on the device. Anonymous visitors do not become people until they sign in. Browser consent modes include a fully cookieless one.
Erasure in hours, with proof
One API call erases a person: invisible in every query within an hour, deleted from primary storage within 72 hours, out of backups within 35 days. Each request ends with an Ed25519-signed certificate that anyone can verify, and that never contains the identifier itself.
Your data, in your bucket
Stream raw events and person snapshots to your own S3-compatible bucket as Parquet, window by window, exactly once.
Open to inspection
The platform is AGPL-3.0 and the SDKs are MIT. You can read exactly what is collected and how it is stored.
Go deeper: Residency, erasure and export · Security