Privacy Policy

Account data. When you create an account we collect your name, email, and authentication credentials, plus workspace, project, and team membership.

Bug capture data. When you (or a teammate) deliberately capture a bug, we collect the artifacts you choose to include: a DOM session replay (via rrweb), console logs, network request metadata (never request or response bodies), screenshots, and environment details (browser, OS, viewport, page URL). If you turn them on for a capture, we also collect a tab video and a voice note. Nothing is uploaded until you capture.

Usage data. Basic, privacy-respecting product analytics and error diagnostics to keep the service reliable. On our public website we use Microsoft Clarity to understand how visitors interact with pages: aggregate heatmaps and session replays of the BugMojo interface itself, with text and form inputs masked by default so personal information is not captured.

Personally identifiable information is redacted in your browser, before any data leaves the page. By default, input values and password fields are masked during recording. You control redaction rules from the extension. Because redaction is client-side, masked content is never transmitted to or stored by BugMojo.

To provide the service: store and display captured bugs, power session replay, route issues to people or AI agents, and sync with your connected tools (e.g. GitHub, Jira, Linear, Slack) when you enable them.

To secure, maintain, and improve the product, and to communicate with you about your account. We do not sell your data or use bug capture content for advertising.

Capture artifacts (recordings, logs, screenshots) are stored as files in cloud object storage (AWS S3) within your workspace, uploaded via short-lived presigned URLs. Data is encrypted in transit (HTTPS/TLS). Access is scoped to your workspace and its members.

Quick Capture (no account) links expire automatically: anonymous captures after 7 days, free-tier captures after 30 days. If you sign in on the same browser extension before an anonymous capture expires, it moves to your account and follows the free-tier period.

Account and workspace data is retained while your account is active. You can delete individual captures, issues, or your entire account at any time; deletion removes the associated stored artifacts.

We share data only with infrastructure providers that help us run the service, under contract: app hosting (Vercel), the database (Neon), object storage (AWS S3), transactional email (Zoho Mail, with Resend as a backup), rate limiting (Upstash), error monitoring (Sentry), and website analytics on our marketing pages (Microsoft Clarity). The full list, with what each one does and where, is on our subprocessors page. When you enable an integration, we share the relevant issue data with that provider at your direction.

We may disclose information if required by law or to protect the rights and safety of our users and the public.

The extension shows a consent dialog on first use and records nothing until you agree. It sends data only to BugMojo: our API, to authenticate and upload the bugs you capture, and our own storage bucket, through short-lived signed upload URLs. It stores your session, capture history, redaction preferences, and a local retry queue on your device.

Instant replay. After you consent, the extension keeps a short rolling buffer of recent page activity (15 seconds to 2 minutes, your choice) in memory on your device, so a capture can include what led up to the bug. By default this runs only on your own sites: local development hosts, the domains set on your workspace’s projects, and sites you turn on yourself. Recording on every site is an opt-in setting, and even then banking, webmail, password-manager, payment and health sites on a built-in list are skipped unless you add one yourself. The buffer runs only in the tab you are looking at, you can pause it at any time, and it is discarded unless you capture. Nothing is uploaded until you capture. Network request and response bodies are never captured, and page elements a site has marked private for other session-replay tools (FullStory, Hotjar, Sentry, PostHog, LogRocket and others) are masked or left out.

BugMojo’s use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

You can access, export, correct, or delete your data. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. To exercise any of these, contact us using the details below.

BugMojo is a developer tool not directed to children under 16, and we do not knowingly collect their data.

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above and, where appropriate, additional notice.

Questions about privacy? Email privacy@bugmojo.com.