Bug Report (“we”) is made by Adarsh Sharma, India. Contact: [email protected]. This policy covers the Bug Report browser extension, the team dashboard at app.bugreport.site, the Bug Report MCP server, the @bugreport/playwright test reporter and this website.
The short version
- The extension records only when you press Record, Screenshot or Record video, and only on the tab you choose (plus tabs or windows that page opens during the recording).
- Your recordings stay on your computer until you send one to a team workspace or download it.
- Passwords, card numbers, security codes and one-time codes are hidden by default. Secret headers, cookies and tokens are replaced with [redacted] before anything is saved.
- We don't sell your data, show ads, or use your recordings to train AI models.
What the extension handles
While you record a tab, the extension saves, on your computer:
- what you do on the page: clicks, typed values (passwords and card numbers masked), choices, scrolls, page addresses;
- the page's console messages and JavaScript errors;
- the page's network requests: address, method, status, headers, timing, and the bodies of fetch / XHR requests (up to 200 kB each), with secrets removed;
- your browser and device: browser and version, operating system, window and screen size, language, time zone;
- screenshots, and a video of the tab if you choose Record video (with your microphone and the tab's sound only if you turn them on);
- files you choose in a file field during the recording (up to 5 MB each; you can turn this off in Settings).
You can turn on “Blur private details” so emails, phone numbers and private fields are blurred in screenshots and video, and add your own redaction rules in Settings.
During a replay the extension uses Chrome's debugger interface on the replay tab only, to click and type like a person and to read that tab's network and console so it can tell whether the bug happened again. Chrome shows a bar while this is on. It stops when the replay ends.
The extension also keeps your sign-in to your Bug Report account (a sign-in token, never your password) and your settings.
The Playwright reporter
@bugreport/playwright writes its report and history as files on the machine where your tests run. It sends nothing anywhere. When you press Create bug report, the failed test's report (steps, checks, console, network, screenshot and, on Pro, video) goes to your Bug Report dashboard, as described below.
What reaches our servers
Only what you send:
- Your account: name, email address, a hash of your password (never the password itself), the workspaces you belong to and your role.
- Bugs you send to a workspace: the report (title, steps, expected and actual result, environment), its console and network evidence and screenshots, comments, who reported it and who it is assigned to.
- Videos (Pro): uploaded to our storage only when you send a bug from a Pro workspace.
- Share links you create, and the email addresses you share a bug with.
- Issue trackers: if your workspace connects Jira, GitHub, Linear or Slack, we send a bug there when someone asks us to, and keep the link to the issue. That service's own privacy policy covers what it stores.
- AI assistants (MCP): if you connect Claude, Cursor or another assistant, it can read and (if you allow it) change the bugs in the one workspace you chose. You can disconnect it at any time in Settings.
- Basic server logs (time, address requested, errors) to keep the service running. We never log passwords, tokens or report contents.
Who processes it for us
| Service | What for | Where |
|---|---|---|
| Render | Runs the dashboard and the API | Singapore |
| Supabase | Database: accounts, workspaces, bugs, report files | Singapore |
| Cloudflare | This website, DNS, video storage (R2), cookie-free website analytics | Global network |
| Resend | Account and sharing emails | United States |
Data is encrypted in transit (HTTPS) and at rest by these providers.
How long we keep it
- Recordings on your computer: until you delete them or remove the extension.
- Bugs in a workspace: until someone with permission deletes them. Deleted bugs, projects, workspaces and accounts go to a trash for 30 days, then everything is wiped: database rows, report files, videos, comments and share links.
- Videos in the cloud: 90 days.
- “Anyone with the link” share links: end after 30 days unless the person who shared it changes that.
- Free workspaces with no activity for 7 days are switched off. Nothing is deleted; an admin can ask us at [email protected] to switch the workspace back on.
Your choices and rights
- Delete a report, a bug, a workspace or your whole account yourself (Settings), or ask us at [email protected].
- Ask for a copy of your data, or for us to correct it. We answer within 30 days.
- Disconnect AI assistants and issue trackers at any time.
If you are in the EU, the UK or another country with similar law: we use your account and workspace data to provide the service you signed up for (contract), and server logs to keep it secure (legitimate interest). You can ask to access, correct, delete or take a copy of your data, or object to its use, and you can complain to your data protection authority. Our providers store data outside the EU (Singapore and the United States) under their standard contractual clauses.
This website
bugreport.site sets no cookies and doesn't track you. It uses Cloudflare Web Analytics, which counts visits and page loads without cookies and without identifying you.
Children
Bug Report is a work tool and isn't meant for children under 16.
Changes
If we change how we handle data, we update this page and the date at the top, and tell signed-in users in the dashboard before the change applies.
Questions: [email protected]