Privacy

Community reports

When you submit a report, the app stores aggregated counters for the selected service and status. Reports are kept in short-lived Redis buckets for the recent status window.

Duplicate prevention

To reduce duplicate reports, the app creates a short-lived hash from the client address supplied by the trusted Vercel deployment proxy. Self-hosted deployments without that trust boundary share a conservative abuse bucket instead of trusting forwarding headers. The hash is used for cooldown and registration abuse prevention only and expires after a few minutes. User agent and language are not included.

Installed-client signals

SDK and local-tool collectors are opt in. When enabled, they send service-level metadata such as service id, symptom category, duration, status code, short error code, client version, and a random local installation id. SDK delivery retries also include a random signal id. Server aggregation stores derived installation and short-lived signal hashes, not the raw installation or signal ids.

Collector setup

Collector setup stores an anonymous collector id, allowed source, allowed services, client name and version, registration time, and revocation time when applicable. Raw collector tokens are saved locally by setup tools and are not printed. Server-side lookup uses derived token data instead of storing raw tokens.

Collector heartbeat checks can update last-seen metadata using the collector id, derived installation hash, and client version.

Local hook reporting

If you opt in to local hook reporting, a local adapter may receive a vendor hook payload in memory to derive a metadata-only signal. Raw hook payload fields such as prompts, commands, outputs, file paths, transcript paths, headers, cookies, tokens, and emails are not stored, queued, logged, or sent to Not Just You.

Hook adapters authenticate to the localhost receiver with a separate random local credential kept in the private local config. That local credential is not sent to or stored by the Not Just You service.

Analytics

Vercel Web Analytics may be used to understand page views, referrers, and basic traffic patterns. Fallback report control clicks and provider tabs are stored as aggregate Redis counters.

Not stored

Not Just You does not store prompt text, provider request or response bodies, provider request or response headers, API keys, cookies, source files, diffs, clipboard content, exact IP addresses, account emails, machine names, or local usernames.

Source separation

Community reports, official provider status, and installed-client signals remain separate in storage and API contracts. The dashboard can summarize recent problems together, but it keeps source breakdown visible.