Privacy policy

Introduction

Snapbug ("we," "us," or "our") operates the website snapbug.ai, the Snapbug SDK, the inspector and its local daemon, the Chrome extension, and RecorderApp (collectively, the "Services"). This Privacy Policy explains what data we collect, what never leaves your machine, and your rights regarding that data.

Snapbug is local-first, but it is not server-less. Your debugging data — network logs, crash reports, screenshots, recordings, and source code — is captured and stored on your own machines, and we never store it. We do operate servers for the parts that cannot work any other way: sign-in and licensing, the free-report allowance, and the optional relay that connects a device to an inspector across networks. Sections 5 and 6 describe exactly what those servers see.

1. Snapbug SDK (Android, iOS, Flutter, React Native, Web)

The Snapbug SDK is embedded in your mobile or multiplatform application. It collects the following data for debugging purposes:

• Network requests and responses (URLs, headers, status codes, bodies)
• Analytics events
• Crash reports and stack traces
• Screenshots and screen recordings
• Shared preferences / local storage entries
• Device metadata (OS version, device model, app version)

By default this data travels only over a direct local connection — a WebSocket on port 9023 and HTTP on port 9024 — to the Snapbug inspector running on the same network. In that mode nothing is uploaded to Snapbug. If you deliberately start a remote session with a room code, the same data travels through our relay instead; see section 5.

2. Snapbug Chrome Extension

The Chrome extension captures:

• Screenshots and annotated images of web pages
• Screen recordings
• User-created annotations and notes

This data is stored locally in the browser's IndexedDB and sent to the inspector over a local connection. In a remote session it travels through our relay instead (section 5). It is never uploaded to a storage server of ours.

3. Snapbug Inspector and Local Daemon

The inspector runs in your browser, in the Chrome extension, or in a desktop window; the work behind it happens in a daemon on your own machine (port 9090). The daemon receives debugging data from connected devices and extensions, stores it in a local SQLite database, and reads your source code locally when you ask it to.

Optional AI features: If you enable AI analysis or Ask AI, the daemon sends the prompt — which may include your source code, logs, screenshots, and the bug report — to the AI provider you configure, using your own API key or a command-line agent installed on your machine. That request goes from your machine directly to the provider. We do not proxy it, do not store it, and never see it.

4. RecorderApp

RecorderApp captures mobile screenshots and screen recordings for bug reporting. All captured media is processed and stored locally on the device. When shared, data is transmitted to the inspector over a local connection, or through our relay if you started a remote session.

5. Remote Sessions (Relay and TURN)

A device and an inspector on different networks can be paired with a six-digit room code. In that mode the connection is brokered by a relay we operate and, when no direct peer-to-peer path is available, carried by a Cloudflare TURN server under our account. In practice this means:

• Your report passes through our infrastructure in transit. It is forwarded between the two ends; it is not written to disk and not retained.
• We hold the room code, the roles connected to it, and connection timestamps in memory for the lifetime of the session, and nothing after it ends.
• Our hosting providers log request metadata — IP address, timestamp, user agent — the way any web server does.

Local sessions never touch this path. A remote session is something you start deliberately, with a code you share yourself.

6. Accounts, Licences, and Billing

Sign-in, licensing, and the free allowance run on servers we operate. Those servers hold:

• Your email address, licence key, plan tier, and expiry date.
• A machine identifier for each device a licence is activated on, with activation and last-validation timestamps. The identifier is derived from the device and carries no name or contact details.
• A count of free bug reports used per machine identifier, so that the free allowance can be enforced.
• Referral codes and the referrals attributed to them.
• Customer and subscription identifiers issued by our payment processor. We never receive or store your card details.

If you sign in with Google, authentication is handled by Supabase; we receive your email address and an account identifier, never your Google password.

The inspector and the CLI ask our server whether a newer version exists. That request carries the component, release channel, platform, and the version you are running.

7. Website (snapbug.ai)

When you visit snapbug.ai:

• We run no analytics or advertising trackers and set no tracking cookies. A cookie is used only to remember your language choice.
• Our hosting provider (Vercel) logs requests, including IP address and user agent, in order to serve and protect the site.
• If you submit the waitlist or contact form, we store the email address you enter along with the form's source and language.

We do not sell your personal information and we do not share it for advertising.

8. Third-Party Services

We rely on the following third parties:

• AI providers: OpenAI, Anthropic, OpenRouter, or any OpenAI-compatible endpoint you point us at, plus the Claude Code and Codex command-line agents. Used only when you configure them. Ollama and other local models keep everything on your machine.
• Supabase: Sign-in with Google.
• DodoPayments: Payment processing and merchant of record for paid plans.
• Cloudflare: TURN servers used by remote sessions.
• Vercel and Railway: Hosting for the website and the licence server.

When you use your own AI provider, data is sent directly from your machine to that provider under its own privacy policy. We are not an intermediary in those requests and have no access to their contents.

9. Data Retention

Your debugging data is stored on your own machines and devices. You control retention by managing your local database and files. None of it is kept on our servers, and a relay session leaves nothing behind once it ends.

Licence and activation records are kept for as long as the licence exists and for as long as tax and accounting law requires. Encrypted backups of that database are retained for up to 90 days. Email addresses you give us are kept until you ask us to delete them.

10. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data.
• Portability: Request your data in a portable format.
• Opt-out: Opt out of the sale of personal information (we do not sell your data).

To exercise any of these rights, contact us at hello@snapbug.ai. We will respond within 30 days.

11. Children's Privacy

Our Services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at hello@snapbug.ai and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at hello@snapbug.ai.