Data Collected

Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.

The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. Here's a list of data categories the Sentry Python SDK collects:

HTTP Headers

By default, the Sentry SDK doesn't send any HTTP headers. Even when sending HTTP headers is enabled, we have a Denylist in place, which filters out any headers that contain sensitive data.

To start sending HTTP headers, set send_default_pii=True in the sentry_sdk.init() call.

Cookies

By default, the Sentry SDK doesn't send cookies. Sentry tries to remove any cookies that contain sensitive information, (such as the Session ID and CSRF Token cookies in Django).

If you want to send cookies, set send_default_pii=True in the sentry_sdk.init() call.

Information About Logged-in User

By default, the Sentry SDK doesn't send any information about the logged-in user, (such as email address, user id, or username). Even if enabled, the type of logged-in user information you'll be able to send depends on the integrations you enable in Sentry's SDK. Most integrations won't send any user information. Some will only set the user id, but there are a few that will set the user id, username, and email address.

To start sending logged-in user information, set send_default_pii=True in the sentry_sdk.init() call.

Users' IP Address

By default, the Sentry SDK doesn't send the user's IP address. Even if enabled, whether you're able to send the user's IP address or not, will depend on the integrations you enable in Sentry's SDK. Most integrations won't set the user's IP address at all.

To enable sending the user's IP address, setsend_default_pii=True in the sentry_sdk.init() call.

Request URL

The full request URL of outgoing and incoming HTTP requests is always sent to Sentry. Depending on your application, this could contain PII data.

Request Query String

The full request query string of outgoing and incoming HTTP requests is always sent to Sentry. Depending on your application, this could contain PII data.

Request Body

The request body of incoming HTTP requests can be sent to Sentry. Whether it's sent or not, depends on the type and size of request body as described below:

• The type of the request body: -JSON and form bodies are sent -Raw request bodies are always removed -Uploaded files in the request bodies are never sent to Sentry
• The size of the request body: There's a "max_request_body_size" option that's set to medium by default. This means that larger request bodies aren't sent to Sentry.

If you want to prevent bodies from being sent to Sentry altogether, set max_request_body_size to "never".

Source Context

When an unhandled exception is sent to Sentry, a snapshot of the source code surrounding the line where the error originates is sent with it.

To opt out of sending this source context to Sentry, set include_source_context to False.

Local Variables In Stack Trace

When unhandled errors and exceptions are sent to Sentry, the names and values of local variables that were set when the errors occurred, are sent at the same time.

You can stop sending local variables to Sentry by setting include_local_variables=False in the sentry_sdk.init() call.

SQL Queries

While SQL queries are sent to Sentry, neither the full SQL query (UPDATE app_user SET password='supersecret' WHERE id=1;), nor the values of its parameters will ever be sent. A parameterized version of the query (UPDATE app_user SET password='%s' WHERE id=%s;) is sent instead.