Privacy Policy

1. Who we are

Sectr is operated by Donald Pinckney, an individual. Questions, access requests, and deletion requests go to contact@sectr.dev. See Terms for more info.

2. What we collect

• Account: your email address and display name (from GitHub or Google sign-in via Clerk, or the email you used for alpha access), and your org. Kept until you ask us to delete it.
• API keys: stored only as a SHA-256 hash, never in readable form. Expired browser tokens are purged after 7 days; other keys are kept until revoked.
• Deployed code: the tarball you deploy (Google Cloud Storage, us-east4), the container image built from it (Google Artifact Registry, us-east4), and a copy in an E2B sandbox template. Currently kept indefinitely, until we delete it on request.
• App secrets (for example, your LLM provider API keys): stored encrypted at rest and decrypted only into the environment of the sandbox that runs your agent. Kept until you delete them.
• Session transcripts: every journal event of every session, meaning user messages, model output, tool calls and results, and approvals, plus an optional external_user_id your app assigns to its own end users. Stored in Postgres (Neon, AWS us-east-2). Currently kept indefinitely; there is no self-serve deletion yet, so deletion is by request (section 7).
• Code execution: your agent's code runs in E2B sandboxes created per turn and destroyed at the end of the turn.
• Platform telemetry: traces, metrics, and logs (identifiers, routes, error messages) in Grafana Cloud, kept per Grafana's plan retention.
• Product analytics: your org's identifier and name, plus usage events: page views, actions, and frontend errors from the dashboard, and service events (such as deploy outcomes and first sessions) from our server. Sent to PostHog (US), kept per PostHog's default retention.
• Waitlist: what you submit in our Tally waitlist form (offered when the beta is full), and earlier alpha applications, kept until deleted.
• Website analytics: page views on sectr.dev and docs.sectr.dev (the page, the referring site, and your country, device, browser and operating system), measured by Cloudflare Web Analytics. Per Cloudflare, it uses no cookies or local storage, does not fingerprint visitors, and collects no personal data.
• Traffic: requests to sectr.dev and the API pass through Cloudflare and our server on Oracle Cloud (US-Ashburn), which keep ordinary request logs.

3. Why we use it

To provide the service (run and journal your agents), to keep it secure and diagnose problems, and to understand how the product is used so we can improve it. We do not sell your data. We do not train artificial intelligence or machine learning models on any of your data, code, or session transcripts.

If you have an account, we may email you product updates. Every such email includes a one-click unsubscribe link.

4. Customer content and end users

If you build an app on Sectr, we process your transcripts and any end-user identifiers on your behalf, only to run the service for you. You are responsible for giving your own end users any notice and obtaining any consent that the law requires of you.

5. Sub-processors

• Neon: Postgres database (accounts, keys, secrets, transcripts).
• Oracle Cloud: hosts the Sectr server.
• Google Cloud: deployed-code tarballs and container images.
• E2B: sandboxes and templates that run your code.
• Cloudflare: proxy and hosting for sectr.dev and the dashboard, and page-view analytics for sectr.dev and docs.sectr.dev.
• Grafana Labs: platform telemetry.
• PostHog: product analytics and frontend error tracking.
• Clerk: sign-in.
• Tally: the waitlist form (and earlier alpha applications).

6. Cookies and local storage

The dashboard keeps only what it needs to work. To keep you signed in, it uses your browser's local storage and, when you sign in with GitHub or Google, session cookies set by our sign-in provider, Clerk. Interface preferences (such as the theme) are kept in local storage too. Dashboard analytics (PostHog) keep their state in memory only: no analytics cookies or local-storage identifiers are written, so a page reload starts a fresh anonymous analytics session. sectr.dev and docs.sectr.dev set no cookies, and their page-view analytics (Cloudflare Web Analytics) use none. We do not use advertising or cross-site tracking cookies.

7. Retention and deletion

Email contact@sectr.dev from the address on your account and ask us to delete your org. We delete the org's data (accounts, apps, keys, deployments, secrets, sessions and transcripts, and stored code artifacts) within 30 days, and ask our analytics provider to delete the org's analytics data. Telemetry and provider logs expire on their providers' retention schedules. You also have the right to access, correct, export, or restrict processing of the personal data we hold about you.

8. Security

API keys are stored hashed. App secrets are encrypted at rest. Your agent's code runs in an isolated sandbox that is destroyed at the end of each turn. No system is perfectly secure, and this is a beta service.

9. International transfers

Sectr is hosted in the United States. If you use it from elsewhere, your data is transferred to and processed in the US.

10. Changes

We will update this page when our practices change and revise the "Last updated" date above.

11. Contact

contact@sectr.dev