Privacy policy

DebugGo is a feedback and website-review service operated by its founder as a sole proprietor (an individual, not a registered company) based in California, United States ("DebugGo", "we"). This policy covers three things:

• Our website, debuggo.dev, including the documentation.
• Your account and the dashboard, if you sign up as a customer.
• The widget that our customers embed on their own websites, and what happens if you send feedback or open a review link on one of those sites.

If you only ever meet DebugGo as a feedback box on someone else's website, sections 5, 6 and 12 are the ones for you.

For the website and for your account we decide what is collected and why, so we are the controller. For everything collected through a customer's installation of the widget, the customer decides: they chose to install it, which pages it runs on, which mode it runs in and how long diagnostics are kept. For that data we are the customer's processor under the data processing agreement, and the customer is the controller you should contact to exercise your rights. If you contact us instead, we forward your request to them and help them answer it.

debuggo.dev is hosted on Vercel. Like every web server, Vercel keeps request logs that contain your IP address, browser type, the pages you requested and when, for Vercel's standard log retention period. We use those logs to keep the site running and to investigate abuse.

We measure page views with Vercel Web Analytics, which does not set cookies, does not identify you across websites and does not share data with advertisers. Review links are masked before they reach analytics. We run no advertising pixels, no social-media buttons that phone home, and no third-party fonts.

Our own website runs the DebugGo widget in team-only mode, so you can see the product. For you as a visitor it only checks for a review cookie and does nothing else; the homepage shows an in-memory demo that writes nothing and sends nothing. The data sheet in section 5 applies to it.

Storage our website uses

None of these identifies you to us or to anyone else.

What we collect

• Sign-in details: your email address and a hashed password, or, if you sign in with GitHub or Google, the account identifier, name and email address that provider shares with us. Authentication is handled by Supabase Auth.
• Organization and project settings: names, website URLs, widget options, retention period, members you invite and their roles, digest email addresses you enter.
• GitHub connection: if you install the DebugGo GitHub App, the installation id and the repositories you select. We never store a GitHub password or a long-lived token; each call uses a short-lived token minted from the App's key.
• Secret keys: keys you create for agents are shown once and stored only as a SHA-256 hash.
• Billing: if you buy a paid plan, Stripe handles checkout and stores your payment details. We keep the Stripe customer and subscription identifiers, your plan and invoice history. Card numbers never reach our servers.
• Support: emails you send us and our replies.

Cookies the dashboard sets

Why, and on what basis

We process account data to provide the service you signed up for (performance of a contract), to bill you and keep tax records (legal obligation), to secure the service and prevent abuse (legitimate interest), and to send you service emails such as invitations, the feedback digest you configured and notices about changes to these terms (contract and legitimate interest). We do not send marketing email without asking first, and every marketing email has an unsubscribe link.

The widget is the small feedback tool our customers add to their sites. The complete technical description, including every browser storage key and every field in a report, is the widget data sheet. This section is the summary.

Two ways it can be installed

• Team-only (the default). The customer's page carries a few lines of first-party code that check whether the address contains a review link or the browser already holds a DebugGo review entry. For an ordinary visitor neither is true, so nothing else happens: no script is downloaded from us, no request reaches us, nothing is written to the browser. The tool only appears for a person who opened a review link the customer issued.
• Everyone. The page loads our widget script from debuggo.dev and shows a feedback button to every visitor. The download is an ordinary file request, so your IP address, browser type and the page address reach our hosting provider's request logs. The widget then waits. It sets no cookie, creates no identifier and sends nothing until you press Send. Console and failed-request capture begins only when you open the widget, unless the customer chose to start it at page load, which they must disclose to you.

What a report contains

The message you typed; an email address only if you type one; the page origin and path, without the query string; your viewport size; and the time. A bug report with "Include technical details" left checked also carries a short browser and operating system description, the last 100 console messages and the last 20 failed requests (method, path, status and duration only; never headers, cookies or bodies) recorded since you opened the widget, up to five page elements you selected, and a screenshot if you attached one. Email addresses, tokens, credentials, card numbers and long key-like strings are redacted in your browser before sending and again on our server before storage.

What we never do in the widget

• Record keystrokes, mouse movement, scrolling or your screen.
• Read your application's form fields, request headers, cookies or request bodies.
• Fingerprint your browser or create an identifier shared across sites.
• Load third-party scripts, fonts, pixels or analytics.
• Store your IP address in our database.
• Collect email addresses for our own purposes on a customer's site.

A customer can send a private review link that turns their live site into a commenting surface for their team or their client. If you open one, the widget keeps a review token and the display name you choose in your browser for 30 days, or until you finish the review, so you stay in the review across pages. A random reviewer identifier lets you edit or delete your own comments and is not linked to anything else. Comments you post are visible to the customer's team and to anyone else holding the same link. The customer can disable a link at any time, after which the stored token stops working at the next page load.

We run DebugGo on a small number of providers. We do not sell personal data, share it for advertising, or let any provider use it for its own purposes. The current list, with each provider's hosting location, is kept on the sub-processors page.

Beyond providers, data leaves DebugGo only where a customer directs it: into a GitHub issue if they connected a repository, into a digest email to addresses they configured, or to their own agents through a secret key they created.

If you are a customer: any submission can be permanently deleted from the dashboard, through the agent API or with the CLI, and deleting a project removes all of its submissions. Deleting removes the message, its diagnostics, replies and attachments. To close your account and delete everything, write to support@debuggo.dev; we complete it by hand within 30 days and confirm.

If you sent feedback on a customer's site: ask that customer, who can delete it immediately. If you cannot reach them, write to us with the website address and roughly when you submitted; we will forward your request and make sure it is honoured within 30 days.

Submissions, attachments and account records are stored by Supabase in the United States (AWS us-east-2, Ohio). Our other providers' locations are listed on the sub-processors page; all of them process data in the United States. If you are in the EEA, the United Kingdom or Switzerland, anything you send us is transferred to the United States. For customers, the data processing agreement incorporates the EU Standard Contractual Clauses and the UK Addendum as the transfer mechanism. For visitors and account holders the transfer is necessary to provide the service you asked for.

Traffic is encrypted in transit with TLS and data is encrypted at rest by our database provider. Each organization's data is isolated by row-level security in the database. Screenshots and attachments live in private storage and are served only through short-lived signed links. Submissions are rate-limited, validated and redacted before storage. The security page lists what we do and, just as important, what we have not done yet.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where processing is based on consent. You also have the right to complain to a supervisory authority; in the EEA that is the authority of the country where you live or work.

If you are in California: we do not sell personal information and do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than providing the service. You have the rights to know, to delete, to correct and to non-discrimination described in the CCPA.

To exercise any right, write to support@debuggo.dev from the email address on your account, or, for data you submitted through a customer's widget, tell us which website it was. We answer within 30 days, or tell you sooner if we need longer and why. For widget data we are the processor, so our answer will usually be that we have forwarded your request to the customer and are helping them complete it.

DebugGo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16 through our website or accounts. Customers agree in our terms not to install the widget on services directed at children without a lawful basis for doing so. If you believe a child has sent us data, write to us and we will delete it.

When we change this policy we update the date at the top and describe the change on the sub-processors page when it concerns providers, or by email to account owners when it concerns how we treat account or widget data. Changes that reduce your rights take effect no sooner than 30 days after notice.

DebugGo, run by its founder as a sole proprietor (an individual, not a registered company) based in California, United States.
Privacy requests: support@debuggo.dev
Security reports: security@debuggo.dev
Data protection officer or EU/UK representative: none appointed.