Privacy

What BugTape is for

BugTape helps teams capture bug reports with browser context such as session events, console output, network failures, screenshots, and user-supplied notes. This page explains the data we process, how long we keep it, and how you can exercise your rights under GDPR, ePrivacy, and comparable regimes.

What data we collect

The BugTape SDK runs in a customer's own web app and records a rolling buffer of browser activity in memory. Only when a user submits a bug do we transmit data to our servers.

• Session events: DOM mutations, user interactions (clicks, inputs, navigation), console output, and network request metadata (URL, method, status, timing) — captured locally by the SDK.
• Bug reports: the rolling buffer at the moment of capture, a user-supplied title/description, optional screenshot/audio, the reporter's email if provided, and environment (browser, OS, viewport, page URL).
• Derived artifacts: an AI-generated title, severity estimate, reproduction steps, and suggested fix based on the captured events.
• Account & team info: email, name, organization, roles, team memberships, API keys, notification preferences, and integration configs.
• Telemetry: request IDs and timing for our own reliability. We do not use third-party analytics or advertising pixels.

What data we do not collect

• We do not record screen content outside the customer's web app.
• We do not capture keystrokes in password fields or elements marked as sensitive by the customer's SDK configuration.
• We do not sell, rent, or share customer data with advertisers.

Retention

• In-flight events: Session events live only in the user's browser memory (the rolling buffer) and are discarded when the tab closes, unless a bug is submitted.
• Server-stored reports: Bug reports and their attached events are kept for the duration of the customer's subscription plan's retention window. Free tier retains 30 days; paid plans extend that per the plan terms.
• Account data: We keep user, org, and team data until the account is deleted. Closed accounts are removed on request (see "Your rights" below) and otherwise after 12 months of inactivity.
• Logs: Request traces and error logs are kept for up to 90 days for security and reliability.

Your rights

You can exercise GDPR/ePrivacy rights directly through the BugTape API or by emailing hi@bugtape.ai.

• Access / export: POST /v1/auth/data-export (authenticated) returns a JSON blob of every record tied to your account — user row, org memberships, projects, bug reports you filed, comments, notifications, API keys, and integrations you touched. Rate-limited to once per hour.
• Erasure: POST /v1/auth/data-delete/request followed by POST /v1/auth/data-delete/confirm. The first call emails a single-use token (valid for 24 hours); the second completes the delete. Bugs filed to a shared organization remain as org-owned artifacts but are disassociated from you.
• Rectification: update your profile from the console, or email support.
• Objection / restriction: email hi@bugtape.ai.

Cookies & local storage

We aim to keep the surface minimal. On bugtape.ai and the console we use:

• Session JWT (first-party, 1-hour lifetime) and refresh token (30 days) — stored in localStorage so you stay signed in. Strictly necessary for the console to function.
• Console preferences (theme, recent filters, dismissed banners) — stored locally, never transmitted.
• Cookie consent choice — we store your accept/decline decision in localStorage.bugtape_cookie_consent so we don't prompt you again.

We do not set tracking cookies, third-party cookies, or advertising identifiers.

Subprocessors

BugTape is hosted on AWS (ap-southeast-2). Email is delivered via AWS SES or Resend. AI summaries use OpenAI, Anthropic, or Google AI depending on plan — only the relevant event slice is sent, never raw account PII.

Early-Access Note

BugTape is in a controlled early-access phase. Some policies above (e.g. formal DPA availability and retention tiering per plan) are being formalized. If you need a signed DPA before onboarding, contact us.

Contact

Data protection, privacy, or security questions: hi@bugtape.ai. We aim to respond within 5 business days.