Collect the evidence needed—and nothing more.

Account and workspace details support authentication, authorization, service delivery, security, and communication. Monitoring data is limited to status, timing, selected headers, counts, ages, capabilities, sanitized fingerprints, operational changes, checks, incidents, and diagnosis records.

Monitoring telemetry does not intentionally include passwords, API secrets, cookies, authentication headers, arbitrary form or POST contents, order or customer records, complete response bodies, or session replay in the authenticated application.

Data is used to run deterministic checks, correlate incidents, deliver alerts, provide bounded diagnosis guidance, secure accounts, support authorized requests, and verify recovery. Sanitized evidence sent for AI diagnosis cannot give a model access to a customer system or make the model authoritative for health or recovery.

Processing needed to create an account, pair a site, run monitoring, show incidents, deliver alerts, and provide requested support is based on performing the beta service agreement or taking requested pre-contract steps. Security, abuse prevention, service integrity, and limited operational measurement rely on the operator's legitimate interests, balanced against user rights. Legal obligations apply where records must be preserved or disclosed by law. Consent is used only where a separate optional activity legally requires it and can be withdrawn without affecting earlier lawful processing.

Amazon Web Services supports application hosting, databases, cache, storage, transactional email, and bounded AI processing, primarily in the Europe (Frankfurt) region where the selected service supports it. Google or Microsoft processes sign-in data only when a user chooses the corresponding OAuth option.

When performance testing is enabled, Google PageSpeed Insights receives the registered public homepage URL and loads its public resources to measure mobile performance. StackFirefly retains selected measurements and limited resource paths, not screenshots or complete page reports. No account credentials or private page access are supplied for these tests.

Providers process data under their applicable contractual and data protection terms. StackFirefly does not intentionally transfer monitoring evidence outside the EEA without reviewing and documenting an applicable transfer mechanism. The current provider list will be updated before a material new provider begins processing customer data.

StackFirefly uses scoped workspace authorization, per-Agent signed credentials, replay protection, encryption in transit, bounded access, audit history, session controls, and authenticator-app two-factor authentication. No system is risk-free; suspected unauthorized access should be reported promptly to security@stackfirefly.com.

The current design bounds raw telemetry to 30 days, check history to 13 months, detailed incident and audit history to 24 months, and compact reliability history to five years. Workspace deletion disables service immediately and targets operational purge within 30 days, subject to documented security, dispute, and legal retention needs.

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent where consent is the legal basis. Workspace owners can start export or deletion review from authenticated privacy controls, or contact support@stackfirefly.com. Identity may be verified before a request is fulfilled.

Individuals may also lodge a complaint with Romania's National Supervisory Authority for Personal Data Processing at dataprotection.ro. StackFirefly does not use automated decisions that produce legal or similarly significant effects.

With separate consent worldwide, Google Analytics 4 measures visits on our public marketing pages. Login, registration, contact forms and the dashboard are excluded. Google receives browser, device and network information, including your IP address, and uses cookies such as _ga and _ga_*. We send public page paths without query strings or fragments, and do not supply account identifiers, monitoring evidence or form contents. Google Signals and advertising personalization are disabled.

Your choice lasts 180 days. Analytics cookies are configured for up to 180 days without extending their expiry on each visit. Withdraw consent in Cookie settings to stop collection and clear accessible analytics cookies; this does not erase information already received by Google. Google may process data internationally. See Google’s privacy information.

With your separate advertising consent, we load the Google Ads tag on public pages to measure advertising. It remains blocked before consent. Google may receive your IP address, browser information and page information and use advertising measurement cookies such as _gcl_*. We do not send account details, email addresses or monitoring evidence to this tag. Personalized advertising and enhanced conversions are not enabled. With consent, successful registration sends a signup conversion with a random deduplication identifier and a nominal value of 1 RON, not payment information.

Your choice is remembered for 180 days. You can withdraw it in Cookie settings; we clear accessible Google measurement cookies and reload the page to stop the loaded tag. Withdrawal does not erase information Google previously received. Google may process information outside your country under its applicable terms and safeguards. See Google’s business data privacy information.

Only after a separate opt-in, worldwide, Microsoft Clarity provides masked session recordings and heatmaps on our homepage, features, pricing, documentation and security pages. Login, registration, contact forms and authenticated pages are excluded. We mask page text before loading the script and do not supply account identifiers. Microsoft may receive public page URLs and campaign parameters, interactions, browser and device information and your IP address, and use analytics cookies such as _clck and _clsk. Advertising storage consent is denied.

Your choice lasts 180 days and can be withdrawn in Cookie settings. Withdrawal stops collection, clears accessible Clarity cookies and reloads the page; it does not delete data already received by Microsoft. Microsoft may process information internationally under its terms. See Microsoft’s privacy statement and Clarity’s terms. Clarity consent is independent of Google Ads, Reddit and first-party analytics.

With a separate Reddit choice, we load the Reddit Pixel on public pages and send signup conversions from our server. Reddit receives browser and network information, public-page information, a random visitor identifier and an advertising click identifier when available. We do not send account email addresses, names, or monitoring evidence. Matching conversion identifiers help prevent duplicate signup counts.

Your browser choice lasts 180 days. Server consent and the click identifier expire after 30 days. Queued conversions expire after one day and recheck consent before sending. You can withdraw in Cookie settings; this clears server consent and accessible Reddit cookies and removes the isolated Pixel to stop it. If server cleanup fails, retry Reject Reddit. Withdrawal cannot undo events already delivered. Google Ads and first-party analytics choices are independent.

Reddit may process data internationally under its applicable terms. See Reddit’s privacy policy. Blocking the Pixel does not affect account access or monitoring.

Essential cookies and local storage support authentication, security, CSRF protection, and saved preferences. These remain active when optional analytics is rejected. Optional first-party analytics requires a separate opt-in through Cookie settings whenever the service is enabled. Its current availability and your choice are shown there.

Optional analytics measures a consenting browser session’s public landing page, allowlisted campaign source and medium, campaign label, and whether that session leads to registration, verification, and site connection. Registration may link that record to your account. It does not collect browsing histories, full URLs, referrers, IP addresses, or user-agent strings in analytics records, and uses no session replay in the authenticated application. Ordinary security and hosting logs are separate from these analytics records.

Cookie settings is available throughout the site and app. Accept and reject are equally available, and rejecting does not affect the service. Your choice is stored for 180 days in this browser. Optional visit records are deleted after 90 days; withdrawing removes the current session’s visit where it can still be identified. You can request deletion of other linked records through support. Consent is the basis for this optional measurement.