Data processing notes
| Data | Controller | Processor |
|---|---|---|
| Analytics collected through your site | you | tracing.tools |
| Your own account, billing and support | tracing.tools | — |
Services the code talks to
Section titled “Services the code talks to”Derived from the repository, for the reference deployment.
| Service | What reaches it | Where in the code |
|---|---|---|
| Cloudflare | Every collector request and every dashboard request. Edge geo (request.cf) is read from the request |
apps/*/wrangler.jsonc |
| Postgres | Everything stored. Provider and region are deployment configuration | DATABASE_URL |
| Clerk | Authentication for dashboard users — your team, not your visitors | the web app’s layout and middleware |
| Stripe | Your own subscription to tracing.tools, nothing about your visitors | the billing routes |
| DeepInfra | Ask questions and their grounding context | /api/ask |
| MaxMind GeoLite2 | Nothing — the database is downloaded and queried locally | @tracing/geoip |
| DuckDuckGo icon service | Hostnames of sites whose favicon is being cached | the favicon route |
No visitor data is sent to any advertising network, data broker or third-party analytics service. The tracker loads from one origin and posts to one origin.
What leaves the product for Ask
Section titled “What leaves the product for Ask”What leaves for revenue
Section titled “What leaves for revenue”Nothing. Revenue is an event your page sends to the collector, like every other event, and no payment processor is contacted about it. The app makes outbound Stripe calls for your own subscription (checkout, portal, price lookup, the usage meter), never for your visitors.
Transfers
Section titled “Transfers”Where each service processes data depends on the deployment: which Cloudflare regions, which Postgres provider, which Stripe account. None of that is determined by this code, and this documentation does not claim a transfer mechanism. Ask the operator, and do not publish a mechanism until it is verified.
Security properties visible in the code
Section titled “Security properties visible in the code”These are architectural facts, not a security programme:
| Property | Where |
|---|---|
| IP addresses are hashed with a rotating salt and never stored | the collector |
| API keys are stored as a SHA-256 digest; the plaintext is shown once | api_keys |
| Billing webhooks are HMAC-verified with a five-minute replay window | the billing webhook route |
| Webhook deliveries are idempotent on the provider’s event id | billing_events |
| A site is always resolved inside the caller’s account | requireSite, callerSite |
| The public share page has no links into the dashboard and no filters | /share/[shareId] |
Access control, incident response, penetration testing, backup handling and personnel controls are operational matters. Ask the operator.