Privacy Policy

Who we are

PeekInside is made by Steycode, at the address at the end of this policy. For the information about you and your team that we need to run your account, we decide how it's used: in the terms of data protection law, we are its controller (its data fiduciary under India's Digital Personal Data Protection Act, 2023).

For the data your apps send to PeekInside Cloud, which can include personal data about your own users, you decide; we only process it for you, as your processor, under our Data Processing Addendum. Your users should look to your privacy policy for how that data is used.

What this policy covers

This policy covers the PeekInside website, PeekInside Cloud (the web app at peekinside.dev and its subdomains, and the API your apps send data to), the local dashboard, and the peekinside SDK.

What we collect

Your account

• Your email address, which is also how you sign in.
• Your name, which you give when you set up your account.
• Your organization: its name, its address on peekinside.dev, whether it's personal or a company, and its members with their roles. If you join a company organization, the job title you give.
• Invitations: the email address of the person invited, their role, who invited them, and when it was sent, accepted or revoked.
• Your projects, and their API keys, which we keep only as a hash plus their first six characters, so you can tell them apart.

Signing in and keeping your account safe

• Sign-in codes. We store only a hash of each code. A code works for 10 minutes and is deleted once it's used or expires.
• Sessions. For each signed-in session we store the IP address it came from (for IPv6, only the first half) and your browser's user agent. A session lasts 14 days after you last used it.
• Linked browsers. A label such as "Chrome on macOS" that your browser makes for itself, the browser's public key, how it was linked, and when it was linked and last used.
• Passkeys. If you add one, its identifier, a name, and a copy of your account's key that only that passkey can open. Passkeys unlock your data in a new browser; they don't sign you in.
• Recovery key. A copy of your account's key that only your recovery key can open, and a hash to check the recovery key against. We never see the recovery key itself.
• Encryption keys. Your account's public key and, with standard protection, an encrypted copy of its private key, described in the next section.

Data your apps send to PeekInside Cloud

When a project uses PeekInside Cloud, the SDK in your app records the requests it handles and what happened during them, and sends them to us ("Customer Data"). Before anything leaves your server, the SDK encrypts it with your project's public key. We can't read the encrypted part, which is most of it:

• URLs, request and response headers and bodies (including any cookies and authorization headers your app receives), the client's IP address and user agent;
• database queries and their values, outgoing calls to other services, console lines and your own measures;
• exceptions: messages, stack traces, the lines of your source code around them, and details of the server process, including its host name.

We store a few details in the clear, because charts, filters and plan limits need them:

• for a request: when it happened and when we received it, the environment name your app reports, its HTTP method, status code, duration, request and response sizes, whether it was aborted, and its counters (database queries, slow queries, N+1 statements, duplicate queries, outgoing calls, log lines and exceptions, and the total time spent in queries and calls);
• for an exception: when it happened, the environment, whether it was handled or crashed the process, and which request it belongs to.

When you write to us

Your email address and what you tell us, to answer you.

Payments

Online payment isn't open yet. When it is, a payment provider will process payments for us and we'll name it here. We'll keep the plan, its status and billing period, and the provider's reference for your subscription. We won't receive or store your full card number.

Server logs

Like any website, our hosting provider records requests to our servers (IP address, time, address requested, browser) to keep the service running and secure. Our own logs note the addresses we send email to.

The local dashboard and the SDK on your computer

Without an API key, the SDK runs in local mode: everything it records stays on your computer, in ~/.peekinside, and none of it is sent to us. In local mode the SDK makes no requests to us at all: no telemetry, no update checks. The local dashboard page loads its code and fonts from peekinside.dev, so our hosting provider sees that request (your IP address and browser) as it would any website visit, but the dashboard itself talks only to your computer.

What we can and can't see

Customer Data is decrypted in your browser with keys that belong to your account: your account's key opens your organization's key, which opens each project's key. Our servers store only the encrypted forms of these keys. What that means depends on the protection you choose on the Security page:

• Standard protection (the default). So that signing in with an email code can unlock a new browser, we keep a copy of your account's private key, encrypted to a key that only our servers hold, apart from the database. Our servers open it only to unlock a browser within 15 minutes of you signing in on it, and to check that the copy works. But because they can open it, whoever controls our servers and that key could, in principle, decrypt your organization's data. We don't, and we'd only be made to by a binding legal order, which we'd tell you about unless the law forbids it.
• Advanced protection. We delete that copy. Only your linked browsers, your passkeys and your recovery key can open your account's key, so we can't decrypt your data at all, and nobody can if you lose all of them.

How we use it

Under India's Digital Personal Data Protection Act, we process your personal data with the consent you give when you create your account, and for the uses the Act allows without it. We don't use Customer Data for anything except running the service for you: we don't analyze it, train models on it or build profiles from it. We don't send marketing emails; if we ever want to, we'll ask first.

Cookies and browser storage

The site uses one cookie to keep you signed in and one to remember the organization you last opened, local storage for preferences like the theme, and your browser's database for its encryption key. None of it tracks you, and there are no analytics or advertising cookies. The details are in the Cookie Policy.

Who we share it with

We don't sell or rent personal data, and we don't share it for advertising. We share it only:

• With the companies that help us run PeekInside, each bound by contract to use it only for us:

• Within your organization. Members see the organization's projects and data their role allows, and its members' names and email addresses. Your name and email address appear in invitations you send.
• When the law requires it, such as a court order, or to protect people's safety or our rights. We'll tell you about such requests unless the law forbids it.
• If PeekInside changes hands, with the new owner, who will be bound by this policy. We'll tell you before that happens.

When you add a passkey, your browser passes your email address and name to the passkey provider you choose.

Where it's processed

We're in India, and our providers may store and process data in India, the United States and other countries. Where data protection law requires it, our contracts with them include safeguards for these transfers, such as the European Commission's standard contractual clauses.

How long we keep it

How we protect it

• Customer Data is encrypted on your servers (ECDH P-256, HKDF-SHA-256, AES-256-GCM) and decrypted only in your browser.
• Everything travels over HTTPS.
• Sign-in codes, API keys and recovery checks are stored as hashes; the key that opens escrowed account keys is kept apart from the database.
• Sessions use secure, HTTP-only cookies, and every page is served with a strict Content Security Policy.
• Members' access is limited by their role, and new members can't read anything until an admin confirms them.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires, without undue delay.

Your rights

Depending on where you live, you have the right to:

• get a copy of your personal data, and a summary of how we process it and who we've shared it with;
• have it corrected or completed;
• have it deleted, and withdraw your consent, which ends your account;
• receive it in a portable format;
• object to or restrict how we process it;
• nominate someone to exercise these rights for you if you die or can't act yourself (under India's Digital Personal Data Protection Act);
• complain to us, and to a data protection authority.

Write to support@peekinside.dev with "Privacy request" in the subject. We'll confirm it's you, and answer within 30 days. If you ask us to delete your account and you own an organization, we delete the organization and its data too, unless you tell us which member should own it next.

If your request is about data your apps sent us (about your own users, for example), we process that for the organization that runs the app, so we'll pass your request to them and help them answer it.

You can complain to the Data Protection Board of India, or to the data protection authority of the country where you live or work. Residents of California: we don't sell or share personal information, and you have the rights to know about, correct and delete yours.

Children

PeekInside is for people aged 18 and over, and isn't directed at children. If you believe a child has given us personal data, tell us and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date at the top. If the change matters, we'll email account owners or show a notice in the app before it takes effect.

Contact and grievances

For anything about your data, write to us. Our Grievance Officer handles complaints at support@peekinside.dev (subject: Grievance), acknowledges them within 24 hours and resolves them within 15 days. More on the Contact page.