Privacy policy

Sourcetrail processes the data you and your respondents give us only to provide the service. We do not sell personal data and do not use third-party advertising trackers.

What we store

Account data (name, email, hashed password), workspace content you create, usage records for billing limits, and security logs (IP address, user agent) for abuse prevention.

Your controls

Workspace owners can export all workspace data as JSON and permanently delete a workspace or account at any time from Settings → Your data. Deletion removes the data from our primary database immediately.

Third-party AI

AI features run only when a workspace adds its own provider API key. Content you submit to an AI feature is sent to that provider under your agreement with them. API keys are encrypted at rest.

Visitors to our customers' websites

Our customers (website owners) decide to use Sourcetrail and are the controllers of their visitors' data; we process it on their behalf. The tracking snippet sets no cookies and does no device fingerprinting. It stores a random identifier in the website's local storage and sends the page path, external referrer host, campaign (UTM) tags and ad click ids. IP addresses are used only in memory for abuse rate limiting and are never stored. Browsers sending Do Not Track or Global Privacy Control signals are not tracked, and websites can require consent before anything is stored.

Server-side events may include an email address or user id from the website owner; we store only a SHA-256 hash of it, used to link visits to a conversion. Each website sets a retention period (30–1095 days, default 395); older visit and conversion data is deleted automatically every day.

Contact

Privacy requests: contact support or support@sourcetrail.invalid.