This document is not yet effective. Everock’s operator details and final legal terms must be completed before it is used as an agreement or production notice.
Scope and responsibility
This draft describes the current Everock product and its proposed hosted-service practices. Everock is a product name; the operator’s legal identity and privacy contact must be finalized before this becomes an effective privacy notice.
Account and service-administration data are distinct from telemetry a customer sends about its own application. The customer determines why its application is monitored and must provide its users with the required notices and lawful basis. A self-hosted operator determines its own infrastructure and privacy practices.
Information the product can process
| Category | Examples and purpose |
|---|---|
| Account and inquiries | Email, account identifiers, profile information, and information you choose to include in a support or sales request. |
| Runtime evidence | Errors, stack traces, request metadata, timing, logs, environment and release tags, and service-health observations. |
| Sessions and identifiers | Session and device identifiers, supported browser or device metadata, and a user identifier if your application supplies one. |
| Replay, when enabled | Supported DOM snapshots and interactions subject to consent, masking, sampling, and collection settings. |
| Authorized integrations | Repository metadata, architecture summaries, source maps, integration credentials, and agent activity where those features are connected. |
| Service operations | Security records, rate-limit information, usage counters, delivery status, and diagnostic information needed to operate the service. |
Why data is processed
The product uses submitted data to authenticate access, ingest and display telemetry, group issues, show affected sessions, track releases, provide evidence to authorized agents, and deliver configured notifications. Operational processing also supports troubleshooting, abuse prevention, and usage measurement.
The proposed policy does not permit selling customer telemetry, using it for behavioral advertising, or using it to train a general-purpose model. Those restrictions must be maintained in final operating agreements and provider arrangements. Your chosen external agent has its own terms for the evidence you authorize it to access.
Minimize data before collection
SDK controls include consent state, sampling, URL sanitization, common-field redaction, custom redactKeys, and beforeSend filtering. Replay is optional and has separate masking controls. These are configurable safeguards, not a guarantee that an arbitrary payload is free of personal information.
Initialize consent-dependent capture in a disabled state when permission is required. Everock does not supply consent merely because the SDK is installed. Avoid sending secrets, sensitive documents, or information you do not need for investigation.
Retention and deletion
Events, replay, security records, and backups have different operational purposes. Actual retention must be defined for the deployment and plan; this draft does not establish a universal retention period. Removing a project or revoking a token does not by itself prove that all backup copies have been removed.
For access, correction, export, or deletion requests, contact the operator of the relevant installation. If the data comes from a customer’s application, that customer may need to handle the request. Identity verification and applicable legal retention requirements can affect the response.
Privacy rights and international use
Depending on applicable law, individuals may have rights concerning access, correction, deletion, restriction, objection, portability, withdrawal of consent, or complaints to a supervisory authority. The final notice must identify the operator, legal bases, response process, and any region-specific disclosures.
Data residency and cross-border transfer arrangements have not been fixed by this page. Do not assume that a region, adequacy decision, or standard contractual clause is covered simply because a provider supports it. Required transfer terms must be completed before the relevant processing begins.
Questions and updates
Use the Privacy topic in the contact form to ask about this draft or available data controls. Do not include another person’s full telemetry or identity documents in the initial request. Material changes will need a dated notice and any additional communication required by applicable law.
