Privacy overview: what BugMojo collects

When you capture a bug, BugMojo records enough context for a developer or AI agent to reproduce it, without turning your screen into a video. This overview explains what is collected, where it lives, how long it stays, and why the most sensitive data never leaves your browser in the first place.

Each capture can include:

• Session replay: a reconstructed DOM recording of the page (rrweb), not a video stream.
• Screen video and voice note: only if you turn them on for a capture.
• Console logs: messages, warnings, and errors from the page.
• Network requests: the URL, method, status code, and timing of each request. Request and response bodies are never captured. They are dropped in the browser and never sent to BugMojo.
• Screenshots: with optional annotations you add.
• Environment metadata: device, OS, browser, and viewport size.

To learn exactly which signals are recorded, see what BugMojo cannot capture.

PII redaction runs client-side in the extension, before any capture is uploaded. By default, text and input fields are masked, so what you type, including passwords, never reaches BugMojo's servers. This is a design principle, not an afterthought: the redaction is applied at the source, on your device.

Bug records, statuses, and comments live in BugMojo's database. Large payloads (the session replay, console logs, and network logs) are saved as compressed files in AWS S3 and referenced by the bug, rather than stored inline in the database. This keeps the dashboard responsive and means removing a bug also removes its associated files.

Captured data stays available while the bug exists so your team and connected AI agents can work on it. You control the lifecycle: deleting a bug removes its replay, logs, and screenshots, including the underlying S3 files. Retention allowances vary by plan. Check plans and limits for the specifics of yours.