Privacy Policy

Signing in with Google or GitHub

When you choose "Continue with Google" or "Continue with GitHub", we ask only for basic sign-in information. We keep two things: your email address and the provider's ID for your account, so we recognize you next time. We don't keep your name or profile picture, and we don't ask for access to your contacts, files, email, calendar or repositories. We never post or act on your behalf. We accept only email addresses the provider has verified.

What we collect

• Account information: your email address, a password if you choose one (stored only as a salted bcrypt hash), your Google or GitHub account ID if you sign in that way, your account name, your team's members and roles, and your settings. If you turn on two-factor sign-in, we keep its secret (encrypted) and your recovery codes (only as hashes).
• Logs you send us: the log messages and fields your systems send to SlashLog, and what we derive from them (patterns, counts and usage). You decide what to send.
• Billing information: payments are handled by Stripe. We never see or store your full card number. We keep your Stripe customer ID, your plan and your billing dates.
• Security information: IP addresses of sign-in attempts and sign-up requests, kept for up to an hour to limit abuse; a record of sign-ins and changes in each workspace (who, what, when and from which IP address), kept for a year and shown to that workspace's admins; and server logs needed to run and protect the service.
• Website analytics: our public landing page uses Google Analytics to count visits. It is not loaded on the dashboard, sign-in, sign-up or invite pages.

How we use it

• To sign you in, run the service, store and search your logs, and show your usage.
• To bill paid plans and send account emails (sign-up links, invites, password resets, billing notices).
• To keep the service secure, prevent abuse and fix problems.
• To answer you when you contact us.

We do not sell your data, use it for advertising, or use your logs to train AI models. We don't look at your logs except to provide the service, fix a problem you report, or when the law requires it.

Your logs

Card numbers and secrets (such as API keys and passwords) are masked by default before your logs are stored, and you can mask more (emails, phone numbers, IP addresses or your own patterns) on the Privacy page of your dashboard. Masked values are never stored. Each account's data is kept separate from every other account's.

Logs are deleted automatically after your plan's retention period:

The raw archive is off until an admin turns it on (Archive page). It keeps a copy of each log as it arrived, after masking and before noise rules. In our storage, files are deleted after your plan's archive period, or soon after a change to a plan without one. If you archive to your own bucket, those files are yours: you decide how long they're kept, and we never delete them, also when you delete your account.

When a workspace's owner deletes it, we stop accepting its logs at once and email everyone in it. Its stored logs, settings and raw archive are kept for 30 days, so a deletion made by mistake, or by someone who got into an account, can be undone, and then erased for good. Members keep their own sign-in. When you delete your account, your sign-in and personal workspace are erased the same way, 30 days later; you can cancel until then. If you need it erased sooner, email support@slashlog.dev and we'll do it within a few days. We keep a short record of who deleted or restored a workspace, and when, for 90 days after the erase. Stripe keeps past invoices and payment records, as the law requires.

AI features

AI features are off unless your account turns them on. When they're on, we send the AI provider only what a question needs (log patterns, counts and a few sample lines, after masking), never your logs in bulk. We will name the provider here before AI features launch, and we choose providers that don't train on the data we send.

Text messages (SMS)

If you add a mobile number to get alerts by text message, we keep the number, when and how you agreed, and a record of the texts we send to it. We use them only to send you those texts and to handle your HELP and STOP replies. Texts are delivered by Amazon Web Services for us.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. See the text message terms.

Slack and Discord alert channels

If an admin connects Slack or Discord to get alerts in a channel, we ask Slack or Discord only for permission to post to the one channel you pick (Slack's incoming-webhook, Discord's webhook.incoming). From the connection we keep two things: the channel's webhook address (encrypted) and the channel's name. We don't keep the access token Slack or Discord returns, and we can't read messages, see other channels or users, or act as you.

We use the webhook address only to post your workspace's alerts to that channel: what happened, a few example log lines (after masking) and links back to SlashLog. When you remove the channel in SlashLog, we erase its webhook address; deleting your account removes everything. You can also remove SlashLog from your Slack or Discord settings at any time, which stops it from posting.

Who processes data for us

We use these providers to run SlashLog. Each gets only what it needs for its job:

• DigitalOcean: hosting, database and file storage (servers in the United States)
• Amazon Web Services: sending account emails (SES) and text messages (End User Messaging)
• Stripe: payments and invoices
• Cloudflare: DNS and forwarding mail sent to our support address
• Google: Google sign-in (if you use it) and Google Analytics on the landing page
• GitHub: GitHub sign-in (if you use it)
• Slack and Discord: delivering alerts to channels you connect (if you connect them)
• Better Stack: uptime monitoring (it checks that our service responds; it receives no customer data)

We may disclose information if the law requires it, or to protect our users or the service.

Cookies

The dashboard uses one session cookie to keep you signed in, plus short-lived cookies during sign-in. The landing page sets Google Analytics cookies. We don't use advertising cookies.

Where your data is stored

Your data is stored in the United States. If you use SlashLog from outside the US, your data is transferred to and processed in the US.

Your choices and rights

You can see and change your account information in the dashboard, delete logs, and delete your account at any time. You can also email support@slashlog.dev to ask for a copy of your personal information, to correct it, or to delete it. We answer within 30 days. Depending on where you live, local law may give you more rights, and we'll honor them. If your logs contain information about other people, you control that data and we process it on your behalf.

Security

We use HTTPS for all traffic, store passwords, ingest tokens and recovery codes only as hashes, encrypt the secrets we need to use (webhook addresses, two-factor secrets, keys for your own storage bucket), offer two-factor sign-in, keep each account's data separate, and limit access to our systems. No service is perfectly secure; if a breach affects your data, we'll tell you without undue delay.

Children

SlashLog is not for children under 13, and we don't knowingly collect their information. If you think a child has given us information, email support@slashlog.dev and we'll delete it.

Changes

If we change this policy, we'll update the date above. For significant changes, we'll email account owners before they take effect.

Contact

Questions or requests: support@slashlog.dev. See also our Terms of Service.