Who is responsible
Shay Gavan trading as Braith is responsible for account, billing, security and support information used to run Braith. Contact support@braith.dev with privacy questions or requests.
When an app owner sends information about their app's users, that owner generally decides why those users are monitored. Braith processes the configured telemetry to provide monitoring for that owner. If you use an app monitored by Braith, contact its owner first about its monitoring or your data; we can help that owner respond.
Information we handle
The integration does not automatically collect screen recordings or every action in your app. Your configuration determines the events and permitted properties. Use pseudonymous identifiers and exclude unnecessary personal information, credentials and payment details. App source code is not required by the monitoring API; the coding tool you choose for setup has its own access to your repository and its own terms.
If you explicitly enable discovery, the browser SDK can collect a bounded sample of supported actions, navigation, response status/content categories, generic errors and configured feedback. It uses static route/action identifiers and local state summaries. It does not send form values, page text, error messages, full URLs, request/response bodies or screen recordings. Browser discovery honours Do Not Track and Global Privacy Control. You are responsible for your application's disclosures and any consent needed before enabling it, including separately configured server observations. Existing integrations are not automatically switched to broader capture.
- Account email, authentication and session information, project names, setup configuration and integration credentials.
- Configured event names, timestamps, environment, workflow and user identifiers, and the event properties your integration sends. We derive outcome states, possible incidents and analysis results from this evidence.
- Plan, subscription and payment references, billing periods, collected amounts and usage records. Stripe handles checkout and payment details; Braith does not collect full card numbers through its own forms.
- Support messages, notification delivery information and operational records needed to protect the service. Hosting providers may process request metadata, including IP addresses, for their infrastructure and security.
Why we use it
We use account and project information to provide the service you request, authenticate access, support you and manage subscriptions. We use telemetry to assess configured outcomes and show evidence and alerts. We use limited operational and usage records to prevent abuse, keep the service reliable, account for processing and enforce allowances.
Braith also monitors its own sign-in, app-connection and paid-activation flows using a small set of status events and pseudonymous workflow identifiers. This does not record form contents, passwords, email codes, integration secrets or payment details. Missing activity alone is not treated as a product failure.
We keep limited statistics to understand whether people find Braith and get it working. Public page requests reaching our server are counted by page, day and a broad referring-site category, such as Reddit or search. Free tools also count visits, completed checks and openings of the signup page by tool and day. Opening an interactive tool or completing a check sends only its fixed tool name and whether it was opened or run; Try example does not send a completion count. Inputs, uploaded file contents, results, passwords and signing secrets stay out of these statistics.
These statistics do not store IP addresses, browser identifiers, full referring URLs or query strings, and add no tracking cookies or browser storage. Recognised bots and requests carrying Do Not Track or Global Privacy Control signals are skipped. Signed-in server page requests are skipped; tool notifications contain no login cookie or account identity and can include signed-in use. Counts can include repeat visits and are capped, so they are not unique visitor counts. Opening signup is not proof that an account was created.
For accounts created within the last 31 days, we also keep the account identifier and the first observed confirmation, production connection and paid activation. These help us find problems with onboarding. They are separate from referring-site counts and do not link a particular visit to an account. This processing is based on our legitimate interest in improving the service; contact support@braith.dev to object.
For our own account administration, our bases include performing our contract with you, legitimate interests in operating and securing Braith, and legal obligations for applicable accounting or other records. App owners must establish their own lawful basis for the telemetry they instruct us to process. We do not sell personal data or use submitted telemetry for advertising.
Providers and international processing
We use Supabase for authentication and database services, DigitalOcean for application hosting, Cloudflare Turnstile for security checks on authentication forms, TypeSafe for Jev analysis, Resend for email delivery, and Stripe for payment and subscription services. These providers receive the information needed for their role. For example, analysis receives configured task descriptions, selected event evidence and derived context; email delivery receives the recipient and notification text.
TypeSafe states that customer requests and responses are not used to train Jev. Its standard processing can still include service delivery, usage charging, abuse prevention and telemetry. Braith does not claim a zero-data-retention arrangement for this account.
When configured, we use Sentry for application error reporting. Our filter sends limited error types, stack locations, reviewed error codes, a broad page category and the deployed build identifier. It removes raw error messages, request bodies, cookies, user fields and other attached context. Session replay and performance tracing are not enabled. Providers can still receive technical network-connection information when a browser contacts them.
Providers can process information outside the UK, including in the United States. Their published processing agreements describe safeguards for relevant transfers, including standard contractual clauses and UK addenda. Contact support@braith.dev for information about the arrangements applying to your data. This does not mean every provider holds every category of information, or that all processing stays in the UK.
How long information stays
Routine raw-event and analysis history is pruned under the plan's retention: seven days for Free and 30 days for paid plans. Cleanup runs in batches. Unfinished work, the latest recovery context and open incidents can remain while needed to finish processing or investigate an unresolved problem. Those periods are not a promise that every operational copy disappears at an exact time.
Discovery review records and their evidence follow seven-day Free or 30-day paid retention, including shadow and open possible-problem findings. These records are distinct from confirmed-outcome incidents and are removed with their project.
Public page statistics and recent-account onboarding statistics are kept for up to 31 days, with hourly cleanup. Deleting an account also removes its entry from these onboarding statistics.
Account and configuration records stay while your account or project needs them. You can delete a project or account through settings, subject to the app's subscription safeguards. Limited usage, email-attempt and processing-accounting records can remain for about 13 months to prevent deletion from resetting limits. Accounting records and provider-held billing records may need to remain longer for legal obligations, disputes or fraud prevention. Provider backups and logs follow their applicable retention arrangements.
Cookies, choices and rights
Braith uses authentication/session storage and plan-selection cookies to make the requested service work. Operational monitoring also uses a short-lived pseudonymous correlation cookie and browser session storage to avoid duplicate status events. This notice does not describe advertising trackers as essential cookies.
Contact support@braith.dev to request access, correction, deletion, restriction or portability of personal information where those rights apply. You can object to processing based on legitimate interests. We may need to verify your identity and explain any lawful reason we cannot fulfil a request. If we rely on consent for a particular optional use, you can withdraw it for that use.
You can complain to the UK's Information Commissioner's Office. Please contact us too so we can try to resolve the problem. We will update this notice when our processing changes and make material changes clear.