Hosted service

Privacy

Effective July 29, 2026.

Metergraph is a project owned and operated by Pioneer Square Labs, Inc. PSL's privacy policy at https://www.psl.com/legal applies to Metergraph; this page describes how the hosted service specifically handles trace content and account data. See also our Retention & Deletion notice and Terms of Service.

Hosted trace content

Metergraph SDK 0.3 sends the scrubbed provider request and normalized model response, including assistant content and tool calls, to the hosted service by default. This applies to free and managed workspaces. Provider credentials, authorization values, cookies, API-key headers, and transport headers are removed. Request and response are each limited to 100 KiB of UTF-8 and visibly marked when truncated.

Control

Applications can disable content globally with METERGRAPH_CAPTURE_TEXT=0 or an initialization option, and can disable it for a sensitive route or trace. An explicit opt-out is honored before durable hosted ingestion. Older SDK 0.2 clients remain metadata-only by default. Historical content that was never captured cannot be reconstructed.

Access

All authenticated roles in a workspace may inspect that workspace's trace content in the dashboard. The content-bearing trace endpoint requires a same-tenant dashboard session and returns Cache-Control: no-store. Ingest keys, coding-agent MCP keys, cross-tenant sessions, list endpoints, summary endpoints, and application logs do not expose prompt or response content.

Open-source server

The public open-source server remains content-blind and strips content at ingestion even if SDK 0.3 sends it. Pointing the SDK at that server does not store prompts, completions, tool arguments, or tool results.

Account data

We process verified email, workspace membership, API-key metadata, product usage, and upgrade requests to operate and secure the service. Raw API keys are displayed once; only a one-way hash is stored.

Model Compare tool

The Model Compare feature is hosted separately on Cloudflare Pages (not the AWS-based trace service). Your prompt is sent through OpenRouter to four model providers for a blind comparison tournament.

Data lifecycle: Your prompt and model responses are stored in a Cloudflare D1 database. Session access expires after one hour. Records are removed opportunistically when subsequent tournament requests trigger cleanup. We do not log prompts or responses in application logs. Provider data retention follows each provider's own policies (Anthropic, OpenAI, DeepSeek, Zhipu AI via OpenRouter).

Aggregate statistics: When a tournament completes, anonymous daily aggregates (model ID, win count, cost sum, cost count, and UTC date) are written to a separate table. These aggregates contain no prompts, responses, IPs, or session identifiers and are retained beyond session cleanup to power the compare page leaderboard.

Security: Session capability tokens are stored in your browser's sessionStorage (not in the URL or cookies) and are excluded from downloadable results. Responses are rendered as safe Markdown (HTML disabled, images stripped, URLs validated) to prevent injection attacks. Rate limiting uses a one-way cryptographic hash of your IP address with a server-side salt; raw IP addresses are never stored. Do not enter sensitive personal data.

Marketing website analytics

Our marketing website records page views, link destinations without query strings, article scroll-depth milestones, visible page time, referring hostnames, and campaign tags. A random session identifier in sessionStorage connects visits within a browser tab; a new page starts a fresh session after 30 minutes without tracked activity. These events are stored in Cloudflare D1. The analytics collector does not store IP addresses, browser fingerprints, form contents, or account identifiers. It does not use cookies. We honor browser Do Not Track and Global Privacy Control signals. Scroll depth measures how far content was reached, not whether it was read, and a signup click is not a completed signup.

Infrastructure

Hosted trace data is tenant-isolated and encrypted in the Metergraph AWS account. Model Compare data is hosted on Cloudflare. We do not sell personal information. Contact studio-legal@psl.com for access or deletion requests.