Privacy
Stacktrace AI, Inc. (“Stacktrace,” “we,” or “us”) operates stacktrace.ai. This notice describes information associated with visiting this website and contacting us, and explains the current CLI’s data flows.
Questions or privacy requests can be sent to hello@stacktrace.ai.
Visiting the website
Our website is hosted through Cloudflare. Delivering and protecting a website involves processing technical request information such as IP addresses, requested URLs, browser information, timestamps, and security-related signals. Our hosting provider processes this information to serve content, maintain performance, and protect against abuse. See Cloudflare’s privacy policy.
The site serves its fonts and images from its own domain.
We use the Google tag from Google Ads to measure how our ads perform. It loads from Google on every page, unless your browser sends a Global Privacy Control or Do Not Track signal. When you book a demo, a check finishes on the playground, or you click Start free on the pricing page, the page tells the tag that it happened and nothing else about it. If you are in the European Economic Area, the United Kingdom (including Gibraltar and the Crown Dependencies) or Switzerland, it runs in Google’s consent mode with advertising storage off until you accept our cookie banner: it sets no cookie, removes ad click identifiers, and sends Google cookieless signals about the visit, such as the page, your browser, your IP address, and the time, which Google uses to estimate how our ads perform. Elsewhere, and wherever you accept, it can set Google advertising cookies to measure visits that come from our ads and to show our ads to people who have visited the site. Declining our cookie banner, or changing your choice from the Cookies link at the bottom of every page, turns them off. Google handles this information under its own policies; see how Google uses information from sites that use its services.
We use PostHog to understand how the website is used: pages viewed, time on page, the referring site and campaign tags, device and browser type, page performance, approximate location (country, region, and city) derived from your IP address when the analytics cookie is on, and interactions such as which links and buttons were clicked, which product tab was opened, whether the contact form was opened and sent, and whether a demo was booked. For a booking we record only that one was made, not who booked it or when. Events go to PostHog through w.stacktrace.ai, an address PostHog operates on our domain. If you are in the European Economic Area, the United Kingdom (including Gibraltar and the Crown Dependencies) or Switzerland, or we can’t tell where you are, PostHog sets no cookie and stores nothing in your browser unless you accept our cookie banner: it counts visits with a hash of your IP address and browser that changes daily, and it does not keep your IP address or derive a location for these visits. Elsewhere, and wherever you accept, PostHog keeps a random identifier in a first-party cookie and your browser’s local storage, so repeat visits from the same browser are counted together, and keeps your IP address to derive location; declining turns this off. To know which applies, the page asks our server whether consent comes first where you are; the answer is only yes or no, and your country is not stored. We store your banner choice in your browser’s local storage; you can change it from the Cookies link at the bottom of every page. We never record what you type into the contact form through analytics, and we do not use session recording. If your browser sends a Global Privacy Control or Do Not Track signal, no analytics events are sent. When an agent fetches one of our hosted setup files, we record the file name, the requesting user agent, and the location derived from its IP address. Following an external link takes you to a service with its own privacy practices.
Our in-browser sandbox runs the Stacktrace CLI in your browser, using WebAssembly, on Claude Code session files you choose. The files are read in your browser and are not uploaded, stored or sent to us or anyone else. The part of the page that reads them is barred by your browser from making any network connection, and nothing from them goes to analytics. If you choose your Claude Code folder instead of a file, your browser lets the page read that folder, on your computer, to find your newest session. Your browser then remembers which folder you chose, in this site’s own storage on your computer, so the button can open it again next time with your permission; it keeps a reference to the folder, not its contents, and “Forget this folder” removes it. If you run our share script, it hands one file to the page through your own computer (127.0.0.1), once, and then stops; the file still never reaches our servers, and the one-time link it uses is removed from the address bar and from analytics. The playground page also loads the Google tag described above. It starts only after the page has removed the share script’s one-time link from the address, and the page tells it only that a check finished; your files, and anything from them, are never passed to it. We record only that a check was made, whether it used your own files or our sample, their total size in broad bands (such as under 1 MB), how many findings it produced, and the identifiers of the detection rules that matched (such as stacktrace-credential-egress).
The video on our Personal Agent Gateway page is hosted on YouTube. Nothing loads from YouTube until you press play; then the video plays from youtube-nocookie.com, YouTube’s privacy-enhanced mode, under Google’s privacy policy.
Our documentation at docs.stacktrace.ai uses the same PostHog setup without cookies. It never sets an analytics cookie or stores anything in your browser for analytics, and counts visits with the same daily hash. It records pages viewed, links and buttons clicked, which code block was copied (not its contents) and theme changes. Global Privacy Control and Do Not Track are honored the same way. The docs remember your light or dark theme choice in local storage.
Contacting us
If you email us, we receive your email address, the content of your message, and any information or attachments you choose to send. We use this information to respond, provide support, discuss the product, and maintain the correspondence.
Our demo page shows a booking calendar provided by Cal.com. The calendar loads from Cal.com only on that page, and Cal.com may set its own cookies there. If you book a time, the name, email address and any notes you enter go to Cal.com and to us, and we use them to hold and follow up on the meeting. See Cal.com’s privacy policy.
Please do not send passwords, API keys, raw agent transcripts, or other sensitive content unless we have agreed on an appropriate way to share it. Our email and other service providers process communications as needed to deliver their services.
The CLI and your agent data
The following describes the current beta. Command options, integrations, and behavior can change between releases; review the package documentation for the version you use.
Session inspection
stacktrace sessions reads supported agent transcripts on your machine. It omits prompts, tool arguments, and results from its displayed output unless you use --include-content.
stacktrace monitor serves a browser interface on your machine’s loopback address. It never sends session content to a model or any other analysis service. Take care when sharing your screen or exporting local output: local views may contain sensitive information from your environment.
Detection
stacktrace detect and stacktrace monitor analyze sessions on your machine. By default, no transcript content (prompts, tool arguments, or results) is sent anywhere. Two kinds of data do leave the machine by default, both described below: package coordinates for vulnerability lookups, and usage telemetry.
The CLI also has an optional analysis stage that is off unless you turn it on yourself: run stacktrace detect --reasoning --analyzer jev (or start the daemon with --reasoning) and provide your own TypeSafe API key. When it is on, the CLI sends short excerpts of flagged calls (an agent’s claim that a task is done, one command that checks it, and that command’s output) to TypeSafe’s API for analysis. This uses your TypeSafe account and is subject to TypeSafe’s terms and data practices. The monitor never runs this stage.
Advisory checks
To look up known vulnerabilities, stacktrace detect sends the package coordinates of the components a session used to OSV (osv.dev) on every run. The monitor’s Inventory and Vulnerabilities views send the package names of every installed component that has one, not only those a session used; skills and plugins without a package are never sent. These lookups send package coordinates only, never the session’s prompts, tool arguments, or results.
Usage telemetry
The CLI sends usage telemetry by default. It records four events: an installation’s first telemetry activity, a session becoming observed, a finding delivered to a destination, and an unexpected error. Each event carries a random installation identifier, the CLI version, the operating system, and a timestamp. Session and finding events also carry the agent’s own session identifier and the agent type; finding events carry the rule, severity, and destination; error events carry only an error category. Every value is drawn from a fixed list or format. Telemetry never includes prompts, tool arguments, results, transcript excerpts, file paths, repository names, error messages, or credentials.
Events go to PostHog’s US region, with IP-derived location disabled. The identifier and timestamps make the events pseudonymous, not anonymous. Run stacktrace telemetry off to stop sending and delete the identifier, and stacktrace telemetry show to see exactly what is sent. Opting out does not delete events already sent.
Configured remote services
The CLI also supports separately configured remote services. These workflows can send endpoint and agent metadata, component inventory, activity summaries, and findings to the configured service. They do not upload session transcripts. They are distinct from the local quick start on this website. Review your remote configuration, applicable service agreement, and available payload previews before enabling uploads.
Installing the CLI does not start monitoring by default. The website’s installation script retrieves software from package-distribution services; those services receive the requests needed to download the software.
Disclosure and processing
We use service providers to host the website and handle communications. Information may also be disclosed where required by law or where necessary to address fraud, abuse, or security issues. If our business undergoes a merger, acquisition, or similar transaction, information associated with the business may be transferred as part of that transaction, subject to applicable law.
Information handled by us and our service providers may be processed in countries other than your own.
Retention and your choices
We retain information as needed for the purposes described here, including responding to requests, providing support, maintaining business records, and meeting applicable legal obligations. Retention depends on the type of information and the reason it was collected.
Depending on the law that applies to you, you may have rights to request access, correction, deletion, or other actions concerning your personal information. Contact hello@stacktrace.ai to make a request. We may need to verify your identity and the scope of the request. These rights can be subject to legal exceptions.
You control the local transcript files and outputs on your own machine. Requests about data held by your model provider or an independently configured service should also be directed to that provider.
Changes
We may update this notice as our website or product changes. We will update the date at the top of this page and provide additional notice when required by applicable law.