Privacy Policy
Last updated: October 21, 2026
Effective from: October 21, 2026
This Privacy Policy describes how Logged ("Logged", "we", "us", or "our"), developed by Oheo, collects, processes, protects, and retains your information when you access our hosted service at logged.oheo.site, use our APIs, install the @oheoco/logged SDK, or otherwise interact with our error monitoring and observability platform.
Auto-Redacted Secrets
Passwords, tokens, authorization headers, and API keys are automatically stripped upon ingestion.
Zero Card Storage
Payment card data is processed directly by Paystack (PCI-DSS Level 1); we never store raw card numbers.
Automated Retention
Telemetry logs automatically purge based on your plan retention tier (7 to 90 days).
Full Right to Erasure
One-click account deletion permanently wipes all user projects, API keys, credentials, and log data.
Roles: Controller vs. Processor
Depending on how you interact with Logged, we operate in two distinct capacities under privacy legislation (including GDPR, UK GDPR, and the Nigeria Data Protection Act / NDPA):
- Logged as a Data Controller: When you register an account, configure profile preferences, purchase a plan, deposit into your wallet, access our dashboard, or submit feedback, we act as the Controller for your account details, identity, and billing data.
- Logged as a Data Processor: When you integrate our SDK (
@oheoco/logged) or ingest application logs via our REST API (POST /api/v1/logs), you (the developer or customer) are the Data Controller of that application data, and Logged acts as a Data Processor executing telemetry collection on your behalf.
Information We Collect
A. Account & Identity Credentials
When you sign up or authenticate with Logged, we collect:
- Full name, primary email address, username, and optional display username.
- Cryptographically hashed passwords (for email and password registrations). We never store raw passwords.
- Third-party OAuth metadata if signing in via Google or GitHub (provider account ID, email, profile avatar URL).
- Email verification state, reset password tokens, and account creation timestamps.
B. Application Telemetry & Ingested Logs
When your client, edge, or backend applications transmit events to Logged, we collect and store:
- Log Properties: Log severity levels (
log,debug,info,success,warn,error), message text, and optional client-supplied timestamps. - Error Diagnostics: Exception messages, error names, and full call stack traces (
stack). - Contextual Metadata: Application context supplied in custom JSON metadata objects, browser URLs, routing pathnames, and runtime sources (
server,client, oredge). - Originating Environment: Target environment labels (
development,staging, orproduction). - Network Telemetry: Client IP address (extracted from
x-forwarded-fororx-real-iprequest headers) and the HTTPUser-Agentheader.
C. Billing & Payment Details
If you subscribe to a paid tier or use our Pay-As-You-Go (PAYG) prepaid wallet:
- Billing Profiles: Billing classification (individual vs. company), full billing name, email, phone number, company name, Tax Identification Number (TIN / VAT), and billing address (street, city, region, postal code, and country).
- Transaction Records: Prepaid wallet balances, transaction timestamps, debit amounts for log consumption units, Paystack customer codes, and provider reference IDs.
- Payment Card Data: All payments are processed directly by Paystack. Sensitive credit/debit card numbers, CVVs, and banking credentials are handled exclusively by Paystack in accordance with PCI-DSS Level 1 standards and are never received, logged, or stored on Logged servers.
D. Security, Device, and Session Diagnostics
To protect your account and investigate security incidents:
- Active session tokens, session creation dates, expiration dates, device categorization (Mobile, Desktop, Browser type), and login IP addresses visible within your security settings.
- Security audit entries capturing IP addresses, attempted paths, user IDs, and timestamps when unauthorized access to restricted endpoints is detected.
E. Feedback, Communications, & Preferences
When you submit inquiries or use our in-app feedback dialog, we store your selected feedback category (Bug, Feature, General), rating score, written feedback, and email (with an option for anonymous submission). We also store your notification preferences (email alerts, weekly digest toggle, and soft retention defaults).
Automated Data Redaction & Sanitization
Logged is engineered with a privacy-by-design ingestion pipeline. Every incoming log undergoes automatic sanitization before it touches our persistence layer:
Built-in Redaction Rule Highlights:
Keys matching: password, secret, token, apikey, accesstoken, refreshtoken, authorization, bearer, cookie, sessionid, jwt, credential, clientsecret, or privatekey are replaced with [REDACTED].
Authorization header strings, Bearer tokens, and token-pattern values are automatically stripped from error messages and stack traces.
Note: While our sanitizer catches standard tokens and secret keys, developers remain responsible for ensuring their applications do not transmit unencrypted highly sensitive personal data (e.g., medical records, full card numbers) in arbitrary free-text log messages.
How We Use Your Information
We process collected data exclusively for valid operational and legal purposes, including:
- Service Delivery: Ingesting, parsing, indexing, and presenting logs, errors, and traces in your authenticated dashboard.
- Automated Notifications: Dispatching real-time error alert emails when critical exceptions occur in your projects, and sending opt-in weekly digest summaries via Resend.
- Account Administration: Authenticating user sessions, issuing environment-specific API keys, facilitating password resets, and sending email verifications.
- Billing & Usage Reconciliation: Tracking monthly ingested log quotas, calculating Pay-As-You-Go units, and debiting prepaid balances accurately.
- Platform Security & Fraud Prevention: Protecting API endpoints from abuse, enforcing rate limits per project API key, blocking unauthorized admin attempts, and safeguarding infrastructure.
- Continuous Improvement: Analyzing aggregated, anonymized usage metrics (e.g., active dashboard features) to improve platform stability and user experience.
Cookies & Analytics
We use cookies and browser storage strictly to ensure platform security, preserve user sessions, and gather consented analytics:
Essential Cookies
Required for user authentication, security verification, CSRF mitigation, and maintaining your signed-in state. These cannot be disabled as the dashboard cannot function without them.
Analytics & Performance
We use Google Analytics (gtag.js) to evaluate dashboard interactions (e.g., project switching, key copying). You can manage or customize cookie preferences at any time via the cookie banner or footer link.
Third-Party Service Providers (Subprocessors)
We engage trusted, enterprise-grade third-party service providers to assist in operating Logged. Each subprocessor is bound by rigorous data protection standards:
Payment gateway, subscription recurring billing, and prepaid wallet settlements.
Transactional email delivery for verification, password resets, digests, and error alerts.
Managed PostgreSQL cloud database hosting application records and partitioned logs.
Global edge network, application hosting, serverless execution, and scheduled cron jobs.
Web measurement and usage analytics (subject to user consent preferences).
Data Retention & Scheduled Purging
We do not retain application telemetry indefinitely. Log records are maintained according to clear, plan-specific lifecycle policies:
- Free Tier Projects: Telemetry logs are retained for 7 days.
- Plus / Paid Plans: Telemetry logs are retained for 30 days (or extended up to plan entitlement).
- Automated Purge Cron: An automated scheduled maintenance cron job (
/api/cron/purge-logs) runs daily to permanently delete records exceeding their respective cutoff date. - Account Credentials: Account data and project metadata are retained for as long as your account remains active.
Your Data Rights & One-Click Erasure
Regardless of your geographic location, Logged provides you with comprehensive privacy controls:
- Right of Access & Portability: You can view all projects, API keys, logs, billing transactions, and active sessions directly within the authenticated dashboard.
- Right to Rectification: You can update your profile name, usernames, passwords, connected OAuth accounts, and billing profile at any time.
- Right to Session Revocation: You can inspect active device logins and remotely terminate any unrecognized session with immediate effect.
- Right to Erasure ("Right to be Forgotten"): Under Settings > Danger Zone, you have the right to permanently delete your account. Confirming deletion immediately executes a hard cascade delete: all projects, API keys, ingested logs, preferences, and account credentials are permanently erased from our production databases.
Security Safeguards
We implement rigorous technical and organizational measures to safeguard your information:
- End-to-end transport layer encryption (TLS 1.3) for all web, dashboard, and ingestion API traffic.
- Cryptographic hashing of project API keys using secure hash algorithms; raw keys are never stored in plain text.
- Session security utilizing HTTP-only, SameSite secure authentication cookies.
- Automated security alerts sent to administrators upon unauthorized access attempts to protected endpoints.
Contact Information
If you have questions, feedback, or data privacy requests concerning this Privacy Policy, please reach out to our privacy and security team:
Service Operator: Oheo
Direct Inquiries: info@oheo.site
Support & Inquiries: oheo.site/contact
Platform Status: logged.oheo.site/status