Privacy Policy

Who this covers

RazorSoft, Incorporated operates TraceWise. This policy covers account holders, people who use the dashboard or API, and visitors who load a public status page or embed. It also covers a WordPress site that installs TraceWise for WordPress.

Accounts

When you create an account, Clerk handles sign-in. TraceWise stores the Clerk user id, email address, optional name, and a workspace. The workspace can store a plan, a billing status, a Stripe customer id, and an optional alert email.

Clerk sets its own session cookies when you sign in. TraceWise also stores a language preference in the cookie tracewise_locale.

Monitor URLs and check results

A monitor stores the name, URL, interval, expected HTTP status codes, timeout, and slow threshold you set. Each check stores whether it succeeded, when it ran, how long it took, and a diagnostic record: DNS, connection, TLS, HTTP, redirect count, HTTP status when one was received, and a short explanation. The check record includes the monitor URL. It does not include the response body of that URL.

TraceWise requests the monitor URL from its own infrastructure. The operator of that URL can see that request in their own logs. TraceWise does not control those logs.

Incidents and public status pages

Incidents store status, open and resolve times, a summary, failure and recovery counts, and the latest HTTP status or error associated with the incident.

An enabled public status page is available to anyone who has its link. The public page and the public JSON used by embeds include the page name, slug, overall status, uptime, monitor names, group names, and incident start and end times for monitors on that page. They do not include workspace settings or the internal diagnostic text. Public history that the product returns follows the plan’s current history window.

API keys and integrations

The full API key is shown once at creation. TraceWise stores a SHA-256 hash, a non-secret display prefix, the scopes, optional expiry, last-used time, and revocation time. The hash is not the key.

A signed-in API request sends the key to https://www.tracewise.dev/api/v1. TraceWise uses it to authorize the workspace action and then keeps only the hash.

Notification destinations you add, such as an email address, Slack webhook, or HTTP webhook, receive the alert content for incidents routed to them. Device push stores the browser push endpoint and its keys for the signed-in user.

Public embeds and the WordPress plugin

A page that contains a TraceWise widget loads https://www.tracewise.dev/embed/status.js in the visitor’s browser. The script then requests the published status, and when the widget needs them, the public history or incidents, for the status-page slug. The visitor’s browser sends the usual connection data for that request, such as IP address and user agent. The request does not include a TraceWise API key or WordPress account data.

If a WordPress administrator connects an API key, that key stays on the WordPress server. The plugin encrypts it in WordPress and sends it only on server-side calls to the TraceWise API. The plugin does not send WordPress users, comments, or post content. Removing the plugin deletes the plugin settings, the encrypted key, and cached API views from that WordPress site. It does not delete the TraceWise workspace.

Support and product analytics

The support page loads a form from formlyx.com. When you are signed in, the form receives your TraceWise user id, workspace id, and plan, the page path, the referrer, and any monitor id or monitor URL included in the support link.

When the site is configured with a CauseWise site id, pages load https://causewise.io/causewise.js for product analytics. This policy does not describe CauseWise’s own retention. When that site id is not configured, the script is not added.

Providers used by the product

The application uses these providers for the functions below. This is not a complete subcontracting agreement, and no data-processing addendum is published here.

• Clerk, for sign-in and the account-deletion webhook.
• Stripe, for paid checkout, the billing portal, and the customer id stored on the workspace.
• Resend, for incident email and test email.
• Formlyx, for the support form.
• CauseWise, for product analytics when a site id is configured.
• PostgreSQL, for the application database. This page does not name a database host.

Retention and deletion

The product currently shows and returns check history inside a window of 7 days on Free, 30 days on Starter, 90 days on Growth, and 365 days on Scale. A paid plan that is not Active or Trialing uses the Free window. That window is what the product displays and returns today. It is not a promise that rows are kept for that long, or deleted after it. The application does not automatically delete stored check rows when they fall outside the window.

Deleting a monitor deletes that monitor’s checks and incidents. Revoking an API key keeps the key record and marks it revoked. Deleting the user in Clerk marks the TraceWise user row with a deletion time. It does not delete the workspace, monitors, checks, or status pages.

TraceWise does not offer a self-serve export or a self-serve wipe of a workspace.

What this policy does not claim

This policy does not state a security certification or a deadline by which data will be deleted. It does not add a refund right beyond applicable law. It does not promise that public status data is hidden from anyone who has the link.

Contact

Privacy questions go to https://www.tracewise.dev/support. The related terms are at https://www.tracewise.dev/terms.