Privacy.
What Prized records about how you use the product, and what it never records.
Prized collects two kinds of usage data: what the CLI does on your machine, and how you use the website and dashboard. Neither reads what is inside your box. How a box is reached and what the control plane holds about it are on Security and trust.
Never collected
Nothing from inside your box is sent anywhere for analytics:
- Source code, files, and anything else on the box filesystem
- Terminal output and shell history, the in-browser terminal included
- Secret values and environment variable values
- CLI arguments, flags, and paths
Website and dashboard
The site records page views, clicks, and a short list of named product events: creating, pausing, resuming, resizing, and deleting a box; changing auto-pause; copying a CLI command; the onboarding steps you view; starting checkout (with the plan amount); and activating a plan. Once you sign in, those events are tied to your account, so a broken flow can be traced to the account that hit it.
Before anything leaves your browser, its URL is cut down to the path: query strings and fragments are dropped, and one-time links (invites, install links) are replaced with a placeholder. Page views are also counted in aggregate by the platform that hosts the site; that count is never tied to your account and sets no cookie.
Session replay
While you are signed in, the dashboard records a replay of the interface, masked in your browser before anything is sent:
- Every input and every piece of text is masked. A replay shows layout, clicks, and navigation, never the words on the page.
- The terminal, the secrets panel, and the environment variables panel record as empty placeholders.
Signed-out visitors are never recorded, so the marketing pages and these docs produce no replay.
Turning it off
- Browser. The site respects Do Not Track. With it on, the site records nothing: no page views, no events, no replay.
- CLI. A separate switch, under CLI: usage telemetry.
How long it is kept
Box metrics, process snapshots, and CLI usage aggregates each have a fixed retention window, and a workspace can shorten them with zero data retention; see Data retention.
Where it goes
- PostHog holds the product events, the account they belong to, session replay, and error reports when a page throws, in its US cloud.
- Vercel Web Analytics, run by the platform that hosts the site, holds the aggregate page-view counts: visits per page, from which country, on which browser. It is never told who you are, sets no cookie, and sees the same cut-down URL.
An ad blocker may block the analytics requests; that affects our telemetry, never the dashboard.
Something unclear or out of date?