Data and retention
What we log, what we never log, and how long anything is kept.
A precise account of what FlareCode stores and for how long. The guiding rule: keep the minimum needed to run the product and bill it, sanitize the logs, encrypt your workspace, and delete it when you do.
What we log
Task logs capture what happened so you can debug and we can support you:
- the task description (what you asked for),
- the agent's reasoning (what it tried),
- test output and exit codes,
- the diff of what changed.
What we never log
- the contents of
.envfiles or any secret material, - API keys, OAuth tokens, or credentials of any kind,
- source code in our logs — log lines never include the working tree, only the diff.
Your workspace itself is snapshotted — encrypted, to private storage — so an idle pause, restart, or eviction never loses your work (see below). That is separate from logs: logs never contain your source.
A sanitizer scrubs known secret patterns (sk-…, ghp_…, xoxb-…, AKIA…, AWS access keys, GitHub PATs) from every log line before it persists. The sanitizer has a regression test suite that runs in CI; a missing scrub is treated as a P0.
Retention timelines
| Data | Retained |
|---|---|
| Workspace (your code) | Encrypted snapshots for the life of the agent; destroyed when you destroy the agent or delete your account |
| Memory (approved preferences + per-repo embeddings) | For the life of the account, per-account isolated, never used for training; destroyed when you delete your account |
| Memory import (raw uploaded rule files) | Discarded immediately after they're distilled into preference statements |
| Task logs (sanitized) | 30 days, then auto-deleted |
| Task metadata (cost, duration, status) | 90 days (for billing) |
| Account email + GitHub login | While the account is active |
| Waitlist email | Until you ask us to delete it |
Subprocessors
We use a small set of vendors to operate the product (hosting, payments via Stripe, your chosen inference provider, transactional email, observability). The full list and our privacy policy live at /privacy.
Deleting your data
Delete your account from Account settings in the app. This removes your account rows, destroys any running agents, and clears repo grants. For anything else, email privacy@flarecode.sh.