We monitor your usage,
not your users.
BeforeRed is built so the most useful answer to “what data do you collect?” is a short list. This page states what we collect, what we deliberately never collect, how long we keep it, and what you can do to make us keep less.
What we keep,
what we never touch
BeforeRed only needs a narrow slice of data to do its job: who you are, credentials for the providers you connect, and the bounded usage or status values those APIs return. The list below is the complete picture of what we keep today.
What BeforeRed keeps
- Email address from your Google sign-in
- Display name and avatar URL returned by Google
- Workspace and app names you create inside BeforeRed
What BeforeRed never touches
- Your Google password
- Your Google account contacts or files
- Any other account you have not used to sign in
What BeforeRed keeps
- OAuth access tokens, refresh tokens, and expiry timestamps
- Provider account and project identifiers you select
- Encrypted copies of provider credentials when a scoped OAuth flow is unavailable
What BeforeRed never touches
- Service-role keys (we never request them)
- Database passwords or connection strings
- Your production .env file or any file from your repository
- Write-capable cloud admin keys
What BeforeRed keeps
- Numeric usage values the provider's API exposes (commands, storage size, bandwidth, billing)
- Plan tier and account metadata required to interpret those numbers
- Timestamps of each sync so we can show you a trend
What BeforeRed never touches
- Database rows or any user table contents
- Customer email bodies, subjects, or recipient lists
- Application source code, build logs, or deployment logs
- Environment variables, secrets, or API keys used to send mail
- User passwords, session tokens, or sign-in events
What BeforeRed keeps
- Aggregated counts of how many times a sync ran or an alert fired
- Server error traces needed to diagnose a failure
What BeforeRed never touches
- Token values in any log line
- Personal data from your application logs unless you opt in later
- Per-page browsing history tied to your identity
What BeforeRed keeps
- An opaque, revocable browser session token scoped to one BeforeRed app
- The read-only health summary and freshness values requested by the side panel
What BeforeRed never touches
- Web page content, URLs, tabs, or browsing history
- Cookies, screenshots, provider passwords, or provider credentials
- Data for advertising, sale, or unrelated services
If we add a feature that needs new data, we update this page before the feature ships. The list above is the source of truth, not marketing copy.
If you connect a provider and a metric we previously read stops being available, we drop it from your view. We do not infer the missing value from other sources.
How we store
your tokens
Every provider token is encrypted before it touches our database. The live implementation uses AES-256-GCM with a server-only 32-byte key, a fresh random IV per write, and an authentication tag. Stored credentials are never returned to the browser after connection.
Encrypted at rest
Every credential is stored as AES-256-GCM ciphertext with its unique IV and authentication tag. Encryption happens in a server-only module before the database write.
Server-only key access
The 32-byte encryption key comes from production secret configuration and is loaded only inside the server-side credential vault. No browser route returns decrypted credential values.
Authenticated encryption
AES-GCM verifies the stored authentication tag during decryption. Modified ciphertext, IV, or tag fails instead of returning a corrupted credential.
No token values in logs
Connection routes do not return stored credentials to the browser. Provider adapters redact credential-like values from errors before they reach application logs.
Who we work
with to ship
BeforeRed is a small set of well-known infrastructure providers. Each one is on the list below for a specific reason. If we add a new vendor, this page updates before the integration ships.
We use Google OAuth for sign-in. We receive your email, display name, and avatar URL. We never see your Google password or anything else in your Google account.
OAuth only. No Gmail content is read at any point.
Supabase runs the authentication service and Postgres database that hold your workspace, apps, connections, and encrypted snapshots. Supabase is our backend; we do not export any of your data to a separate store.
Row-level security is enabled on every table that holds user-owned data.
Vercel serves the public marketing site, the authenticated app, and the API routes. Vercel handles TLS, edge caching, and the cron worker that runs scheduled syncs.
Server logs are retained per Vercel's standard policy. No token values appear in any log line we emit.
Resend can deliver warning emails for urgent and critical usage signals when that optional feature is enabled.
When disabled, the product does not send warning email.
We do not sell personal data. We do not share personal data with advertisers. The only data shared with a third party is the minimum needed for that vendor to do its specific job in the list above.