What's actually stored
Written to match the real running code, the same standard as /docs -- not template legal boilerplate. This is a single-developer product; if something here is unclear, email directly.
What you give us
An email address and password (hashed, never stored or logged in plain text) to create an account. Whatever incident evidence you record -- alerts, logs, deploy notes, human notes, customer reports -- and the postmortems drafted from it. If you submit a manual UPI or wire payment, a transaction reference. Nothing else is asked for.
What third parties see
Your incident evidence is sent to Google (Gemini) to draft a postmortem, and to Anthropic (Claude) only if Gemini's own call fails and a fallback is configured. Card payments go through Stripe directly -- your card details never reach our own servers. Password-reset emails are sent via Resend, which sees only the email address and the reset link, nothing about your incidents. The database itself is hosted by Supabase, the application by Vercel. None of these are chosen or paid to promote your data further -- they process it only to do the specific job listed here.
What we never do
- Never sell or share your data with advertisers or data brokers -- there is no such relationship to begin with.
- Never expose your email address on a published, publicly-shared postmortem page -- confirmed directly in the API response shape, not just a policy statement.
- Never make an incident public without you explicitly turning that on -- publishing and public visibility are separate, deliberate actions.
Exporting and deleting your account
Account settings has a real "Export my data" button -- every incident, evidence entry, postmortem, and action your account owns, as one downloadable JSON file, on demand. Your own backup, not a promise about one.
Deleting your account (from the same page) really deletes your user row, and any pending payment claims with it. What it does not delete: incidents and postmortems you already created stay on record, the same append-only-history stance this product applies to its own payment audit trail -- useful if you ever need to prove what a postmortem said after the account that wrote it is gone. If you want those removed too, email directly and it'll be handled manually.
Cookies (and clients outside any one country)
Confirmed directly, not assumed: this site sets no cookie at all before you sign in. The only cookie anywhere is one HTTP-only, secure session token, set only after registration or login, read by no script on the page and shared with no third party. Page-view analytics (Vercel Web Analytics, if enabled) is cookieless by design -- no persistent identifier is stored in your browser either way. Under GDPR/ePrivacy, a strictly-necessary session cookie like this one is exempt from consent-banner requirements -- which is why there isn't one here; it's not an oversight.
See system status for the backend's live health, checked the same way regardless of which country you're connecting from.