Privacy policy

1Who we are and our two roles

BugOtter is a monitoring service for people who run apps: uptime, analytics, revenue and errors in one place. "We" means BugOtter. "You" means the person with a BugOtter account. "Your visitors" and "your customers" are the people who use the sites and apps you connect.

We play two roles, and this page covers both.

• For your account (your email, your settings, your billing), we decide what is collected and why. We are the controller.
• For data about your visitors and customers (analytics, errors, revenue, status page subscribers), you decide to collect it, and we process it for you, only to show it back to you. You are the controller and we are your processor.

2What we collect about you

Your account

• Your name and email address. If you sign up with a password, we store only a salted hash of it, never the password itself.
• If you sign in with Google or GitHub, we receive your name, email address and profile picture from them. Google sign-in asks only for your email and basic profile.
• When you sign in, we keep a session: a cookie in your browser, plus the IP address and browser of that sign-in, so you can spot a sign-in that isn't yours. A session lasts up to 30 days.

One trial per person

To keep the free trial fair, we store a normalized form of your email address (lowercase, without a +tag, Gmail dots removed) and a salted hash of the network address you signed up from. We never store that address itself. This record stays after you delete your account, so deleting and signing up again doesn't restart the trial. It holds nothing else.

Billing

Payments go through Creem, our merchant of record (or Stripe, in some setups). They collect your card and billing details. We never see or store your full card number. We keep your plan, its status and renewal date, and the customer and subscription ids they give us.

What you set up

• Your apps and their URLs, extra checks, heartbeats, maintenance windows, incidents and status page text.
• Alert channels: email addresses, a Telegram chat, Slack or Discord webhook links, and browser push subscriptions.
• Custom request headers for uptime checks, which can hold secrets. We store them encrypted.
• Source maps you upload, so stack traces become readable.
• Agents you connect over MCP or the API, and the permissions you gave them.

Keys and tokens you connect

When you connect Stripe, Polar, Lemon Squeezy, Creem, Vercel, Netlify, Cloudflare or Google Search Console, we store the key or token encrypted (AES-256-GCM) and use it only to read. See revenue data below.

Emails we send you

We keep a copy of each email we send you (to, subject, content and whether it was delivered), so you and we can see what went out. These copies are deleted with your account.

3Analytics: what the script collects on your sites

BugOtter's analytics script (bo.js) is cookieless by default. It doesn't build profiles of people and doesn't follow them from one site to another. It sends nothing when the browser has Do Not Track turned on.

For each page view or event, we store

• The page path, with query strings and #fragments removed.
• The referring site's domain only (for example news.ycombinator.com), and any utm_source, utm_medium, utm_campaign, ref or via tag in the address.
• Device type (from the screen width), browser and operating system names, and the browser's language.
• Country, region and city, looked up by our hosting provider from the IP address as the request arrives.
• Time on page, how far down the page the visitor scrolled, and page speed (LCP, INP, CLS).
• Events: file downloads, clicks to other sites (the domain only), form submissions (the form's name only, never what was typed), pages that look like "not found", and custom events you send, with up to 10 short properties you choose.

How visitors are counted without cookies

• Unique visitors: a one-way hash of the IP address, the browser's user agent and the site, mixed with a secret that changes every day. The same person gets a new id the next day, and the hash can't be turned back into an IP address. We don't store the IP address or the full user agent.
• Visits: random ids kept in the tab's session storage, not in a cookie. A visit ends after 30 minutes without activity, and the ids disappear when the tab closes. They let a purchase in the same visit be linked to where the visitor came from.

The optional cookie

If a site owner adds data-attribution="cookie" to the script, it also sets one first-party cookie, bo_vid, holding a random id for up to one year. That links a purchase to the first visit even weeks later. It's off unless the site owner turns it on, and in some countries it needs the visitor's consent. That consent is the site owner's to ask for.

Keeping bots out

As each request arrives, we use its IP address to check whether it comes from a data center and to slow down floods. This happens in memory and the address is not saved. The list of data center ranges comes from public routing data (RIPE NCC). We send nothing about your visitors to anyone to do this.

Linking payments to visits

If you pass the script's random id into your checkout (as bugotter_visitor_id in its metadata), the payment is linked to that visit, so you can see which source brought revenue. It is a random id, never a name or email.

4Error tracking

Errors arrive from bo.js or from any Sentry SDK pointed at BugOtter. Before anything is stored:

• Email addresses, API keys (like sk_live_…), GitHub tokens and JSON web tokens in error messages are replaced with [redacted].
• User ids and IP addresses become salted, one-way hashes, used only to count how many people an error affected.
• Breadcrumbs keep only page paths and failed request paths with their status code. Console output, clicked text, form values, cookies, request bodies and headers are dropped.

We keep the error type and message, the stack trace, the page path, the release, the environment, the browser and operating system names, and the random visit id when there is one.

Redaction catches the common patterns, not every possible one. Please don't put other personal data (names, addresses, health or payment details) in error messages.

5Revenue data

BugOtter is read-only toward payment providers. We ask for a read-only key (a restricted key on Stripe). Whatever key you give us, BugOtter only ever makes read requests with it: it never charges, refunds or emails your customers.

From Stripe, Polar, Lemon Squeezy or Creem we copy products, payments, refunds and subscriptions: amounts, currency, dates, status, the provider's customer id, and a cancellation reason when the provider has one. We don't copy your customers' names, email addresses or card details.

Keys are stored encrypted (AES-256-GCM). When you disconnect a provider, we delete its key and everything we copied from it.

6Status pages, subscribers and things you share

• Status pages show an app's uptime, its parts and incidents. Never revenue, traffic, errors or private check URLs.
• Status page subscribers give an email address to get updates for that one app. They confirm it with a link first, and every update has a one-click unsubscribe. We use these addresses only to send that app's status updates.
• Badges, share links and milestone cards are public by design, and only exist when you create them. You can turn each one off at any time.

7How we use data

• To run BugOtter: check your apps, show your dashboards, and send the alerts, digests and status updates you set up.
• To send account emails: email confirmations, password resets, trial and plan notices, and usage warnings near your limits.
• To keep the service safe: stopping abuse, spam, bots and repeat free trials.
• To answer you when you write to us.

We don't sell data. We don't show ads, and we don't share your data or your visitors' data with advertisers. We don't use it to train AI models.

Your coding agent. When you connect an agent (Claude Code, Cursor, Codex or another) over MCP or the API, it can read what you allowed it to read. What the agent and its AI provider do with that data is covered by their terms, not ours.

8Cookies on bugotter.com

Our own site uses only first-party cookies needed to work. No advertising or tracking cookies.

Our marketing pages are measured with BugOtter itself, cookieless, as described above. Nothing is measured inside the app.

9Who helps us run BugOtter

These companies process data for us, only to provide their part of the service.

The payment providers and hosts you connect (Stripe, Polar, Lemon Squeezy, Creem, Vercel, Netlify, Cloudflare) are your own accounts. We only read from them, with the key you gave us.

10Where data is stored

Our servers and database run in the United States (US East). Uptime checks also run from Europe (Frankfurt) and US West, and our providers may process data in other countries. Where the law asks for it, we rely on our providers' standard contractual clauses for transfers outside the EU and UK.

11How long we keep data

• Single page views and events (what filters and single visits are built on): 90 days. By then they are already added into daily totals.
• Daily traffic totals and error events: your plan's history (Starter 6 months, Builder 1 year, Pro 2 years). During the trial, and after it ends without a plan, we keep the Pro length (2 years), so choosing a plan later loses nothing.
• Single uptime checks: 8 days, then rolled into daily uptime, which is kept for as long as the app exists.
• Revenue copies: for as long as the provider stays connected. Disconnecting deletes them.
• Your account and settings: until you delete your account.
• The trial record (normalized email and hashed network): kept after deletion, as explained above.

Deleted data can stay in our database provider's backups for a short time before those backups expire.

12Deleting your data and your rights

Delete everything yourself. In Settings, choose "Delete my account" and type your email to confirm. That deletes your account and everything it owns: apps, analytics, errors, uptime history, revenue copies, connections, keys and the email log. If you're on a paid plan, cancel it first in Plan and billing, so you're not charged again. Creem or Stripe keep their own billing records, as tax law requires.

Smaller steps. Remove one app, disconnect a provider, delete an alert channel or turn off a share link at any time. Each deletes what belongs to it.

Your rights. Depending on where you live, you can ask to see, correct, export, restrict or delete your personal data, and object to how it's used. Your data is also readable any time through the Stats API, the CLI or MCP. For anything else, email hello@bugotter.com. We answer within 30 days. You can also complain to your local data protection authority.

If you visited a site that uses BugOtter, the site owner decides what is collected. Please contact them first. We help them answer you.

13Security

• Everything travels over HTTPS.
• Passwords are salted and hashed. Third-party keys, tokens and custom check headers are encrypted at rest (AES-256-GCM).
• Visitors and error users are stored as one-way hashes, never as IP addresses or raw ids.
• Payment access is read-only, and agents get only the permissions you approve.

14Children

BugOtter is a tool for people who run websites and apps. It isn't meant for anyone under 16, and we don't knowingly collect their data.

15Changes to this policy

When this policy changes, we update the date at the top. If a change matters for how your data is used, we email account holders before it takes effect.

16Contact

Questions, requests or worries about privacy: hello@bugotter.com.