Privacy
Paprica LLC (“Tripwire”) runs the Tripwire dashboard at tripwire.agency. Questions: support@tripwire.agency. Address: Texas, USA. Effective October 7, 2026.
What we store
- Account email, from the signup or login you submit.
- Password hashes and auth logs, held by Supabase Auth. Tripwire does not store the password itself.
- Session cookies that keep you signed in.
- Workspace name, billing email, plan, your role, and billing status.
- Email addresses of teammates you invite, the role you chose, and when each invite was sent, accepted or cancelled.
- Client and project names, billing model, retainer amount, notes, environments, and pricing profiles (billed amount, markup percent, notes).
- Report records for a client and month.
- Usage events your proxy posts: client, project, environment, external request id, source type, provider, model, status, input, output, and cache token counts, estimated cost, latency, HTTP status, error code, request timestamp, and optional agent, workflow, and run ids, plus an optional metadata object.
- Budget amounts, alert flags, and in-app alert rows.
- Stripe customer and subscription ids after Checkout.
Card numbers are handled by Stripe and never reach Tripwire. The ingest API does not accept prompt text or model responses. If you put that text in metadata, we store what you send. Do not send prompts or completions.
Who processes it
- Supabase — database and auth.
- Vercel — hosting.
- Resend — login, password-reset, teammate invite, budget alert and trial setup emails.
- Stripe — subscription checkout and webhooks.
- PostHog — product analytics, hosted in the United States (PostHog Cloud US).
- YouTube (Google) — hosts the walkthrough video on our home page.
Product analytics
We use PostHog to see which pages people visit and where they get stuck in signup and setup. It records:
- Pages you visit, with links stripped of query strings, invite tokens and record ids.
- Clicks on our public pages (home, signup, login, terms, privacy), including the button or link text.
- Inside the signed-in app, that a click happened and on what kind of element, but no text, link or attribute from the page.
- Browser, device, screen size, referrer, and an approximate location derived from your IP address.
- Once you sign in: your Tripwire user id, workspace id, plan and role, and account milestones (signed up, trial started, first test request, first alert sent, upgraded, invite sent, invite accepted).
PostHog does not receive your email address, client or project names, spend, cost, budget, margin or revenue figures, API keys or tokens, or report contents. Session recording is turned off. PostHog sets a first-party cookie and local storage entry to recognise your browser between visits. Internal Tripwire workspaces are not tracked.
Embedded video
The walkthrough video on our home page is embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press play. Once you do, YouTube’s and Google’s privacy policy applies to that video. We record that the video was played.
We do not sell account data. You can ask support@tripwire.agency for a copy or deletion of the workspace we hold for you.