privacy
What happens to a trace you upload.
Last updated 2026-08-18
This page describes the service as it is built today, not as it is planned. There are two ways to use Boxdawn and they are not the same: a one-off upload, where you are not signed in and nothing about your trace is kept, and a connected project, where you are signed in and we keep measurements over time. Signing out is how you choose the first one. Where a section below applies to only one of them, it says so.
Optional account, no tracking
You can use Boxdawn without signing in, and that is the default. Signing in is optional, and it sets cookies whose names begin with sb-, which carry your session and nothing else. The site loads no analytics script and embeds no third-party tracker, so no other cookie is set. Our hosting providers keep their own standard request logs, as every web host does.
Your trace is analyzed, then discarded
An uploaded file is sent over HTTPS to the analyzer, written into a temporary directory, analyzed, and that directory is destroyed when the request ends. The file is not persisted, not copied elsewhere, and not used to train anything. A connected project changes what we keep from the analysis. It does not change this.
Where the analysis runs
The hosted analyzer runs on Modal, a third-party serverless platform, so an uploaded trace does leave your machine. If you would rather it did not, run the same detector locally. The deterministic detectors need no network and no API key.
No model provider sees your trace
The hosted analyzer runs the deterministic detectors only. The optional LLM-judge layer is not enabled on it, so no part of your trace is sent to a model provider.
Trace bodies are never in the report
The analyzer is invoked with --no-snippets, so prompt text and tool output from your trace are not included in the report at all.
What the report does contain
A report can contain file paths and commands taken from your own trace: which file was read twice, which command ran again. Those are not masked, because that is the finding. The report is returned to the browser that asked for it. On a one-off upload that is the only place it goes: no share links, no history, nothing to come back to. On a connected project the report file is not stored either. What is kept is a set of measurements derived from it (counts, sizes, costs) plus salted hashes of the targets.
If the analysis fails
A failure returns diagnostic output. That output is sanitized before it is returned or written to logs: caller-side file paths, email addresses, and secret-shaped strings such as API keys and bearer tokens are masked. The report body itself is deliberately left unmasked, for the reason above.
Limits
One file per analysis, .json or .jsonl, up to 10 MB.
Questions
Open a GitHub issue. There is no support inbox yet, and we would rather say so than publish an address nobody reads.
Claims on this page describe implemented behavior. We do not claim encryption at rest, anonymization, or regulatory compliance that we have not built and verified.