Privacy Policy
Flagin is currently in early access. This policy describes our practices and intentions. If you have questions, email hello@flagin.app.
What Flagin collects
When a user submits a Finding through the @flagin/sdk widget, the following data is captured and transmitted to flagin-ingest:
- Current route and page URL at time of capture
- Build SHA and application environment
- Browser, OS, viewport, and timestamp
- Console errors and failed network requests from the session
- A screenshot of the current viewport
- Up to 60 seconds of ArcWitness session trace (when enabled)
- Any annotations added by the reporter (arrows, boxes, text)
- Reporter name and email address, if provided
Evidence redaction
DOM-level redaction runs client-side before any data leaves the browser. Any element marked with data-flagin-mask is replaced with a blank region in the captured screenshot. Automated detection runs against captured text for common sensitive patterns including card numbers, government IDs, and email addresses.
Tenants configure a selector allowlist and denylist. Unclassified evidence is not stored. Evidence never crosses tenant boundaries.
How we use collected data
- Reproducing and triaging the reported Finding
- Notifying the reporter of status changes
- Computing priority using reach, impact, recency, and workaround availability
- Clustering similar Findings to reduce noise
We do not sell collected data. We do not use it for advertising. We do not share it with third parties except as required to operate the service (hosting, infrastructure).
Evidence retention
Evidence attachments are retained for 90 days by default on Pro plans and configurable on Team plans. The Finding record itself is retained until deleted by the tenant. Reporters may request deletion of their submitted evidence by emailing hello@flagin.app with their Finding ID.
Reporter transparency
In the flagged path, reporters can preview exactly what will be captured before they submit. Silent capture does not occur in the deliberate flagging flow. The ArcWitness observed path captures ambient session data for aggregate analysis; individual session traces are not stored beyond the retention window.
Contact
Questions about this policy or a data deletion request: hello@flagin.app
Agent Space LLC · d/b/a Flagin