# Privacy

> What Prized records about how you use the product, and what it never records.

URL: https://prized.dev/docs/privacy

Prized collects two kinds of usage data: what the CLI does on your machine, and how you use the website and dashboard. Neither reads what is inside your box. How a box is reached and what the control plane holds about it are on [Security and trust](https://prized.dev/docs/security).

## Never collected [#never-collected]

Nothing from inside your box is sent anywhere for analytics:

* Source code, files, and anything else on the box filesystem
* Terminal output and shell history, the in-browser terminal included
* Secret values and environment variable values
* CLI arguments, flags, and paths

## Website and dashboard [#website-and-dashboard]

The site records page views, clicks, and a short list of named product events: signing up (which sign-in provider, and where you came from); creating a box, the box reaching running, or waiting for capacity; opening the browser terminal; signing in from the CLI; pausing, resuming, resizing, and deleting a box; changing auto-pause; copying a CLI command; the onboarding steps you view; starting checkout (with the plan amount); and activating a plan. Once you sign in, those events are tied to your account, so a broken flow can be traced to the account that hit it.

"Where you came from" is one first-party cookie, `prized_src`, written on the first page you land on and kept for 30 days: the referring site's hostname, the path you landed on (with invite and install tokens removed), and any campaign tags (`utm_source`, `utm_medium`, `utm_campaign`, `ref`) on the link you followed. It holds no identifier, is never rewritten by a later visit, and is not set when Do Not Track is on. Enabling Do Not Track removes a previously stored acquisition cookie on your next page load; a sign-up callback carrying Do Not Track is not recorded.

Each sign-in records its time, the network address it came from, and the browser it used, kept 90 days to investigate abuse and account takeover ([Data retention](https://prized.dev/docs/data-retention#telemetry-retention-windows)); **Settings → Sessions** shows you the address of each of your own.

Before anything leaves your browser, its URL is cut down to the path: query strings and fragments are dropped, and one-time links (invites, install links) are replaced with a placeholder. Page views are also counted in aggregate by the platform that hosts the site; that count is never tied to your account and sets no cookie.

## Session replay [#session-replay]

While you are signed in, the dashboard records a replay of the interface, masked in your browser before anything is sent:

* Every input and every piece of text is masked. A replay shows layout, clicks, and navigation, never the words on the page.
* The terminal, the secrets panel, and the environment variables panel record as empty placeholders.

Signed-out visitors are never recorded, so the marketing pages and these docs produce no replay.

## Turning it off [#turning-it-off]

* **Browser.** The site respects Do Not Track. With it on, the site records nothing: no page views, no events, no replay.
* **CLI.** A separate switch, under [CLI: usage telemetry](https://prized.dev/docs/cli#usage-telemetry).

## How long it is kept [#how-long-it-is-kept]

Box metrics, process snapshots, and CLI usage aggregates each have a fixed retention window, and a workspace can shorten them with zero data retention; see [Data retention](https://prized.dev/docs/data-retention).

## Where it goes [#where-it-goes]

* **PostHog** holds the product events, the account they belong to, session replay, and error reports when a page throws, in its US cloud.
* **Vercel Web Analytics**, run by the platform that hosts the site, holds the aggregate page-view counts: visits per page, from which country, on which browser. It is never told who you are, sets no cookie, and sees the same cut-down URL.

An ad blocker may block the analytics requests; that affects our telemetry, never the dashboard.