Last updated 2 August 2026
rewind.js records requests so they can be replayed. That is the whole point of the product, and it means we store more about traffic to your app than a typical host does. This page says exactly what, where it goes, how long it stays, and who else can touch it.
Loop46, Inc., a Washington corporation, trading as rewind.js. We are the data controller for the information described in section 3.
Loop46, Inc.
124 28th Ave, Seattle, WA 98122, USA
privacy@loop46.com
Which parts of this policy apply depends on who you are.
For each request we record what is needed to replay it: the method, path, query string, headers, timing, response status, the results of any outbound work your handler performed (HTTP calls, emails, webhooks), and a client IP address as described below.
Client IP addresses are masked before your code sees them.
IPv4 addresses have the final octet zeroed; IPv6 addresses are truncated
to the first 48 bits. A handler can call
request.unmaskedIp() to obtain the full address — a
deliberate escalation, not the default — and when it does, the full
address is recorded in that request's tape. If you run an app here, that
call is your decision and yours to disclose to your users.
Request bodies are buffered into object storage before your handler runs, so that the request is durable. If your handler never reads the body, the stored request record keeps no reference to those bytes — but the bytes themselves may still exist in that buffer. Treat anything sent in a request body as recorded.
We collect metrics and logs about the service itself — request rates, error rates, latency, and cluster health — to keep it running. These describe the system rather than individuals.
| What | Where |
|---|---|
| Handlers running, and the databases behind them | Beauharnois, Quebec, Canada |
| Recordings, code bundles, static assets, request bodies | Virginia, USA |
Both are OVHcloud facilities. We are a United States company. No data is stored in the European Union. If you are in the EEA or the UK, transfers rely on Standard Contractual Clauses; ask us for a copy.
Your plan sets a retention window — 7 days on the free plan, 30 on pro, 365 on enterprise — that limits how far back logs and replays can be queried.
That window limits access, not storage. We do not currently delete recordings once it passes; the query surface simply stops returning them. Automatic reclamation is being built. Until it ships, assume anything recorded is retained indefinitely, and ask us if you need something deleted sooner.
Account information is kept while your account is open, and after closure only as long as needed to meet legal and accounting obligations.
| Who | What for | What they see |
|---|---|---|
| OVHcloud (Canada) | Servers running handlers | Everything processed by your app |
| OVHcloud (USA) | Object storage | Recordings, bundles, assets, bodies |
| Resend | Sign-in and notification email | Recipient address and message contents |
| Grafana Cloud | Operational metrics and alerting | Service telemetry, not request contents |
| Cloudflare | Authoritative DNS only | DNS queries. It does not proxy our traffic and never sees request contents. |
| jsDelivr | Icon font on our landing page | Your IP and browser when you load that page. We are removing this dependency. |
We will update this list before adding anyone new. Payment processing is not yet available and no payment provider currently holds any data for us.
One cookie, sid, which keeps you signed in. It is strictly
necessary for the service to work and is not used to track you. We set no
advertising or analytics cookies, and there are no third-party trackers on
our sites — with the single exception of the icon font noted above, which
is being removed.
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it elsewhere. Depending on where you live, some of these are legal rights and some are simply things we will do.
We do not yet have self-service export or account deletion. Requests are handled by hand today. Email privacy@loop46.com and we will acknowledge within 5 working days and complete within 30. We are building both as product features.
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.
What we do: traffic is encrypted in transit with TLS. Each tenant's data lives in its own replicated store under its own storage prefix. Handler code runs under enforced CPU and memory limits so one tenant cannot starve another. Client IPs are masked as described above. Sign-in tokens are hashed.
What we do not do, stated plainly: recordings are not encrypted at rest by us beyond whatever our storage provider applies. If your app handles data that must be encrypted under your own key, rewind.js is not the right place for it today.
rewind.js is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.
We will post any change here and move the date at the top. If a change materially affects you, we will email the address on your account.
Loop46, Inc.
124 28th Ave, Seattle, WA 98122, USA
privacy@loop46.com