Privacy Policy

Information We Collect

We may collect various types of information from you, including:

• Personal Information: This includes your name, email address, contact information, and any other information you provide when creating an account or using the Service.
• Usage Data: We may collect information about how you use the Service, including your interactions, preferences, and activities.
• Cookies and Tracking Technologies: We use cookies and similar technologies to gather information about your browsing activities. You can manage your cookie preferences through your browser settings.

How We Use Your Information

We use the information we collect for the following purposes:

• Providing and Improving the Service: We use your information to deliver, maintain, and improve the Service, and to personalize your experience.
• Communication: We may use your contact information to send you updates, notifications, and important information related to the Service.
• Analytics: We analyze user behavior and preferences to understand how the Service is used and to enhance its functionality.

BugSmash Drop Uploads

When you use BugSmash Drop, we process the files and information needed to validate, host, secure, and manage your preview. This may include:

• Uploaded HTML, CSS, JavaScript, images, fonts, and other static assets, together with filenames, file sizes, selected entry pages, and deployment identifiers.
• Technical and usage information such as IP address, browser or device information, request timing, and security events used for rate limiting, abuse prevention, troubleshooting, and analytics.
• Automated structural and content-safety checks designed to identify unsupported files, malicious code, phishing, credential collection, and other prohibited content.

Drop previews are hosted on a public, unguessable URL and can be accessed by anyone who receives that URL. Anonymous uploads are scheduled for deletion when their temporary link expires. If you claim a Drop through an account, its files and project records are retained and managed like other BugSmash account content until deleted under the Service's normal account and retention processes.

AI Assistant Connections (MCP) and Public API

You can connect BugSmash to an AI assistant through the BugSmash MCP server, or to your own software through the BugSmash public API. A connection lets the assistant or software read and change content in the BugSmash workspaces you choose, on your behalf. This section explains what we collect, what we return, who receives it, how long we keep it, and how you control it.

Information we collect when you connect

• Connection records: the name of the assistant or application you authorized, the BugSmash workspaces and permissions (scopes) you granted, the date of the grant, and security tokens that identify the connection. Tokens are stored as hashes.
• Usage logs: for each request, your user ID, the workspace ID, the name of the tool or endpoint that was called, the time, and whether the request succeeded or failed. We do not log the content of the request, such as comment text, file contents, or search terms.
• Temporary uploads: files that an assistant uploads to create a project, add a version, or attach to a comment are stored in a temporary location until they are attached to your workspace content.

Information the assistant sends to BugSmash

When you ask a connected assistant to act, it sends the inputs needed for that action, such as project and version names, website URLs, folder names, comment text, replies, status and priority changes, assignee and tag selections, search terms and filters, webhook URLs, and files or file links. We treat this information the same as content you enter in BugSmash directly.

Information BugSmash returns to the assistant

Tool responses are limited to the fields an assistant needs to do the work you asked for. Depending on the tool, a response can include:

• Workspace, folder, project, and version details: names, identifiers, type, sharing settings, anonymous-comment setting, review language, whether a project is password protected (but not the password), review and share links, status, version numbers, comment counts, and creation dates.
• Collaborator details: the display name, role, and user ID of people who have access to a project or folder, and the display name of the person who approved a version.
• Comment and reply content: the comment text, comment number, status, priority, tags, creation date, whether it is private, the display name of the author, and the display name and user ID of the assignee.
• Comment attachments: links to attached images, audio notes, and the screenshot captured when the comment was made, and links to project files such as PDF or document pages.
• Comment location and context: where the comment was placed: for websites, the page URL, page title, pin position, the selected element's tag, position, size, and text, and its CSS selectors; for documents and images, the page number, pin position, and drawn annotation; for video and audio, the timestamp. For website comments we also return the browser name and the viewport class (desktop, tablet, or mobile) recorded when the comment was made.
• Webhook settings: the webhook URL and the events it subscribes to, but not the signing secret.

Responses do not include email addresses, passwords, API keys, access tokens, webhook secrets, profile photos, billing information, internal database identifiers, or debugging information. Error responses contain only a status and a short message.

Who receives this information

Information returned by a tool is sent to the AI assistant or application you connected, and is then handled by the AI provider you connect under its own privacy policy. You decide which assistant to connect and which workspaces it can reach. We do not send your workspace content to an AI provider unless you connect that provider and ask it to act. Usage logs are processed by our error-monitoring and logging provider (Sentry) as a service provider to us.

How long we keep it

• Access tokens expire after 1 hour. Refresh tokens expire after 30 days of inactivity and are replaced each time they are used.
• Connection records are kept while the connection is active. When you revoke a connection, its tokens are invalidated immediately. Expired and revoked authorization records are deleted 30 days after they expire.
• Temporary uploads expire 10 minutes after they are created if they are not used, and are deleted shortly after they expire or are consumed.
• Usage logs are kept for up to 90 days.
• Content created or changed through a connection (projects, versions, comments, replies, folders, webhooks) is part of your workspace and is kept under the Service's normal account and retention processes until you delete it.

Your controls

• Choose workspaces: during authorization you select the workspace the assistant can use. An assistant can only reach workspaces where you are an owner, admin, or member and where the workspace owner's plan includes MCP access. Collaborators and guests cannot connect assistants.
• Revoke a connection: you can see and revoke every connected assistant or application at any time from your account settings. Revocation takes effect on the next request.
• Workspace controls: workspace owners and admins can turn MCP access off for a workspace, or disable individual tools, from the workspace settings. These controls apply immediately to every connection to that workspace.
• Data deletion: deleting a comment, project, or workspace in BugSmash removes it from future tool responses. To delete information already sent to an AI provider, use that provider's controls.

Data Retention

We keep your personal information and workspace content for as long as your account is active, or as needed to provide the Service. When you delete content, it is removed from the Service and from future tool responses. When you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must keep it to meet legal obligations, resolve disputes, or enforce our agreements. Retention periods for AI assistant connections are listed in the section above.

Sharing of Information

We do not sell, trade, or otherwise transfer your personal information to outside parties except as outlined below:

• Service Providers: We may share your information with third-party service providers who assist us in operating the Service and providing related services.
• AI Assistants and Applications You Connect: When you connect an AI assistant or application to BugSmash, we send it the workspace information described in the "AI Assistant Connections (MCP) and Public API" section, at your request.
• Legal Compliance: We may disclose your information to comply with legal obligations, protect our rights, or respond to lawful requests.

Data Security

We implement appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

Your Choices

• Access and Correction: You can access and update your personal information through your account settings.
• Communication Preferences: You can opt out of receiving promotional emails by following the instructions in those emails.
• Connected Assistants and Applications: You can review and revoke AI assistant and API connections from your account settings. Workspace owners and admins can turn MCP access and individual tools off in workspace settings.
• Deletion: You can delete comments, projects, and workspaces from within the Service, and you can contact us to request deletion of your account and personal information.

Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect or solicit personal information from minors.

Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties.

Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices or for legal or regulatory reasons. The latest version of the Policy will be posted on the Service.

Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us. Thank you for trusting BugSmash with your information.