What we collect, and why

Who we are

Mystra at https://mystra.run is operated by Mystra (“we”, “us”). Contact for anything in this policy: hello@mystra.run.

What we collect

Account

When you sign in with Google we receive your name, email address and profile picture. With a magic link we receive your email address. We use them to identify your account and to send you the emails described below.

Your apps

The hosts, paths, CSS selectors, Stripe price ids, alert channels (Slack webhook URLs, email addresses, webhook URLs) and schedules you enter. They exist so Mystra can run and report your checks.

Run evidence

Every run of your app stores screenshots, a video, a HAR network capture, the console log and the emails received by the run's throwaway inbox. This is evidence about your app, created with throwaway accounts that Mystra itself signs up; it does not contain your customers' data unless your app shows it to a brand new account. Broken runs are kept 30 days, passed runs 7 days, pinned runs until you unpin them. Deleting an app deletes its evidence.

Billing

Payments for Mystra go through Stripe. We store your Stripe customer id and the price you subscribed to; Stripe holds the card. Stripe's privacy policy applies to that.

Usage and errors

We use PostHog (EU region) to see which pages and features are used and to record application errors with a reference id. This includes your user id and email once signed in, the pages you visit and the actions you take (for example “run started”). It never includes evidence, emails, or your apps' secrets.

We also use DataFast for traffic and revenue attribution: which page or link a visit arrived from, and whether it ended in a subscription. It records the page, the referrer and a first-party visitor and session id, which are passed to Stripe Checkout so a payment can be traced back to the visit that led to it. It does not receive your evidence, your emails or your apps' secrets.

Cookies

A session cookie keeps you signed in; it is essential and always set. DataFast sets a visitor and a session cookie on your first visit, which is what makes attribution work. PostHog sets its cookie only after you choose “Allow analytics” in the banner; “Essential only” keeps product analytics off. Change your mind any time with the Cookies link in the footer. There is no advertising and no cross-site tracking.

Emails we send

Sign-in links, alerts you configured, and occasional product updates about Mystra itself (you can reply to any of them to stop those). Sent through Resend, EU region.

Where it lives

• Hosting and the runner: Vercel.
• Database and evidence: MongoDB Atlas.
• Email in and out: Resend (EU).
• Product analytics and error tracking: PostHog (EU).
• Traffic and revenue attribution: DataFast.
• Payments: Stripe.

These providers process data on our behalf under their own terms. We do not sell data, and we do not share it with anyone else.

Your rights

You can export your configuration and evidence by asking, correct your details in settings, and delete your account and everything attached to it from Settings → Danger zone, immediately and without a conversation. If you are in the EU/EEA or the UK you also have the rights the GDPR gives you (access, rectification, erasure, restriction, portability, objection) and can complain to your local data-protection authority; we would rather hear from you first.

Children

Mystra is for businesses and is not directed at children under 16. We do not knowingly collect their data.

Changes

When this policy changes in a way that matters, we email account holders before it takes effect and note it in the changelog.