On the device
Domains are cut back to their registrable boundary before anything is sent. mail.example.com becomes example.com. A path or query string never exists in the record.
HOW IT WORKS
How Precyz observes your outbound connections.
The client reads metadata from documented operating-system and browser interfaces, reduces it locally, then sends only a closed set of counters and labels.
Context
The situation
You are being asked to install software that watches network activity. That is exactly the category of software you should be most suspicious of. This page is the mechanism, in order, with the boundary at each step.
On each platform the client reads from an interface the operating system or browser already publishes for this purpose. None of these gives Precyz the contents of a connection, and none of them places Precyz in the path of your traffic. Nothing is proxied, nothing is re-encrypted, and no certificate authority is installed.
On this page
What you get from this
Then the closed set
Events are aggregated into short windows. Destination addresses are truncated, and on Personal they are never stored on the server at all.
On the service
Each event is placed on the map by country, and by city on Pro and above with a confidence score. The service stores what your plan says it stores, and nothing longer.
Collection boundary
The boundary
We observe here
Byte and packet counts, protocol, an encryption indicator, destination country, network operator, registrable domain, the app or browser that opened the connection, timestamps, and direction.
We never collect here
Communication content, URLs, paths, query strings, DNS names beyond the registrable domain, headers, cookies, tokens, files, screenshots, form data, keystrokes, usernames, email addresses, hardware serial numbers, or precise location.
Coverage is not complete. Some traffic paths are not observable from the interfaces we use, and geolocation is advisory rather than authoritative.
Availability across plans
Personal
Included
Pro
Included
Team
Included
Enterprise
Included
Questions this page raises
Does a privileged component mean you can read anything?
Placement determines what a component can reach. What it does reach is determined by its code and by a published schema. We name the metadata interfaces we use, and we publish signed hashes of the Linux observer so you can check the binary you run.
What about the browser extension's permissions?
The extension requests the observe-only request permission and nothing that grants content access. Each permission is justified individually on the browser download page.