Private-beta privacy notice

Data we collect

• Name, email address, password credential record, and account timestamps.
• Session metadata, including expiry, IP address, and user agent.
• Investigation progress, commands, queries, hints, notes, bookmarks, report drafts, decisions, and grades.
• Support or feedback messages a learner chooses to send after the beta contact path is published.
• Limited operational logs used for security, reliability, and abuse prevention.

Why we use it

Data is used to authenticate learners, preserve investigation progress, grade submitted work, support the beta, prevent abuse, and diagnose reliability or security problems. Tracework does not sell learner data.

Service providers

Tracework currently relies on Vercel for application hosting, Upstash for distributed rate limiting, and a managed PostgreSQL provider for account and learning records. The database provider and applicable processor terms must be confirmed before invitations are sent.

No advertising, behavioral analytics, payment, email-marketing, or AI provider receives learner content in the current beta build.

Retention and deletion

• Sessions expire after seven days unless ended sooner.
• Beta account and learning records are scheduled for deletion within 30 days after the beta ends unless continued retention is agreed.
• Feedback is retained for up to 90 days after beta, then deleted or anonymized.
• Operational logs are limited to 30 days where provider controls allow.
• Deleted records may remain in encrypted backups until the backup retention window expires.

Learner choices

Learners may request access, correction, session revocation, or deletion after the privacy contact is published. Do not enter real credentials, employer information, live incident data, or other secrets into an investigation or support message.

Cookies

Tracework uses essential authentication and security cookies. The current beta does not use advertising or behavioral-tracking cookies.