Privacy and your data

• It keeps what you and your apps put into it, and nothing else. No advertising, no analytics, no tracking. Your data is not sold or shared.
• It does not collect your source code. The error handlers send only the error: its message, stack trace, file names and line numbers. The fix checker reads your code on your computer, and sends DevVault only the solutions you approve (see below).
• An app's token can only send errors in. It cannot read anything stored in DevVault. A fixes token can read one workspace's errors and add solutions to them, and nothing else.
• Only the members of a workspace see what is in it. Your personal vault is yours alone.
• Secrets are protected. Account passwords, recovery codes and API tokens are stored only as one-way hashes. Saved login passwords (Credentials) are encrypted.

• Your source code or repository. DevVault never connects to your Git host.
• Your app's database, or its users' data, except where it appears inside an error message (see the next section).
• Analytics, tracking or advertising data. There are no tracking scripts and no tracking cookies.

The code you add to your app from the integration guide sends each error once, with its message, its stack trace (which names files, line numbers and functions), a project name and an environment. It does not send your code, your database, or any form or query data. The Node.js and Python handlers also label each error with the request's method and page path, such as GET /orders/15, so you can tell which page failed.

One thing to know: an error message contains whatever the code put in it. If a message includes a value, such as an email address in "Duplicate entry 'ana@example.com'", that text is stored like the rest of the error. To keep personal data out:

• Avoid putting personal data into your own exception messages.
• Keep PHP's zend.exception_ignore_args = On (the production default), so stack traces do not include function arguments.
• Delete an error in DevVault if it ever captured something it should not have.

Every token works only while its owner is still a member of its workspace, and you can revoke any token at once on the API tokens page. The members of a shared workspace can see who made each token for it, its name, what it can do and when it was last used, but never the token itself; the workspace's owner can revoke any of them.

• It runs on your computer, next to your code. Your code and your Git history are read there and are not uploaded anywhere.
• It reads your open errors from DevVault, using your fixes token.
• Nothing is sent back unless you choose. When you add solutions, DevVault receives, for each error you ticked: the solution text, the ticket link, and the change from the fixing commit to that one file (at most 200 lines). You can read exactly that on screen before anything is sent.
• Your token stays with you. The browser version runs only on your own computer (127.0.0.1). If you tick Remember, the address and token are saved in your user folder (.devvault/fixes.json), never inside the project, so they cannot end up in Git.

• Your personal vault: only you.
• A shared workspace: its members. Credentials only to members given credential access.
• Administrators of this DevVault can create, suspend and delete accounts and send password-reset links. The app gives them no view into other people's workspaces.
• Whoever runs the server has access to its database, as with any web application. That is why passwords and tokens are stored only as hashes, and credential passwords encrypted.

• Page styles and fonts load from jsDelivr (a public code library service) and Google Fonts. Like any website, your browser sends them its IP address and browser details when a page loads. They receive nothing from inside DevVault.
• Error alerts go only where a workspace's owner points them (Settings → Alerts): a Slack, Microsoft Teams or Google Chat channel, or an email address. Each carries the error's title, number, project, how often it happened and a link; never the stack trace or the full message. Once there, it is kept by that service under its own terms.
• Email is sent through the mail service this DevVault is set up with: sign-up verification, password resets, workspace invitations, and the Monday digest, which goes only to confirmed addresses and not at all in a quiet week.

• What you save stays until you delete it. Deleting a workspace deletes everything in it.
• You can export your vault at any time (Settings → Export).
• Nightly backups are kept for 14 days. Saved credential passwords go into a backup only when it is encrypted with a backup password.
• Server logs are kept for 14 days.
• You can delete your account yourself (Settings → Account → Delete your account). Your name, email, password and recovery details are removed, and so is your personal vault with everything in it. What you wrote in shared workspaces stays with the team, shown as by “Deleted user”, because it is part of their shared record. Shared workspaces you alone own pass to their longest-standing member. Your API tokens stop at once.
• An administrator can also suspend an account (it cannot sign in and its tokens stop, and nothing is deleted), or delete it in the same way. The admin log keeps who did it, the account's former name, and the reason given.
• To ask what is held about you, contact DevVault at support@fsulit.net.

• Passwords, recovery codes and API tokens are stored as one-way hashes; credential passwords are encrypted.
• Every token is limited to one workspace and to what it was created for, and to 60 requests a minute.
• Pages refuse to be shown inside other websites, so they cannot be used for click-jacking.
• Changing your password signs out your other sessions; you can also sign devices out yourself.