BugBoard is a bug-tracking tool with a kanban board built in: your applications report bugs through our SDKs, and those bugs show up as cards your team can triage. This policy explains what information we collect when you use the BugBoard website, application, and SDKs, why we collect it, and the control you have over it.

The short version: we collect what we genuinely need to run the service, we don’t sell your data, we don’t use it for advertising, and the bug data your apps send us is yours. The rest of this page is the long version, written so you can actually read it.

Some information you hand to us on purpose when you sign up and use your account:

• Account details — your name and email address when you register, plus a securely hashed version of your password (we never store the password itself).
• Profile and settings — the preferences you choose, such as your notification settings and project configuration.
• Project and board content — the projects, tasks, comments, and file attachments you and your teammates create while working in BugBoard.
• Invitations — when you invite someone to a project, we store the email address you enter so we can send and track that invitation.
• Messages to us — anything you put in an email to support or a contact form, so we can help you and keep a record of the conversation.

The core of the service is the bug data your code reports through the BugBoard SDKs and ingest API. A typical report includes the message and type, the stack trace, a severity level, any tags or metadata you attach, and the counts we keep so we can deduplicate repeats and show occurrence trends.

Important: a bug payload contains whatever your application puts into it. That can accidentally include things like user identifiers, request bodies, or environment values. You decide what your code sends — see “Be careful what your SDK sends” below.

To run the service securely and fairly, a small amount of information is collected as you use it:

• Authentication cookies — a session cookie that keeps you logged in, plus a security token to protect against cross-site request forgery.
• Activity logs — an audit trail of who did what inside a project (created a task, changed a status, removed a member) so your team can see how things changed.
• Usage counts — how many events your projects ingest, so we can enforce plan quotas and per-minute rate limits.
• Basic technical logs — standard server records such as IP address and timestamps, used to keep the service stable and to investigate abuse.

BugBoard uses only the cookies it needs to work: the session cookie that signs you in, a CSRF token for security, and an optional “remember me” cookie if you ask to stay logged in.

We do not use advertising cookies, cross-site trackers, or third-party analytics that follow you around the web. Because the cookies we set are essential to logging in, disabling them will stop the application from working.

We use the information above to:

• Authenticate you and keep your account secure.
• Render your boards, group and deduplicate bugs, and escalate the ones that cross your thresholds.
• Send the email notifications you have switched on — and only those.
• Enforce plan limits, ingest quotas, and rate limits.
• Process payments and manage your subscription.
• Provide support, answer your questions, and fix problems with BugBoard itself.
• Detect, prevent, and respond to abuse, fraud, and security incidents.

We do not sell your personal data. We do not share it with advertisers, and we do not use your bug data or project content to build advertising profiles or to train machine-learning models. Your data is here to run your account, nothing else.

If your bug reports are especially sensitive, BugBoard lets you turn on payload encryption for a project. You generate a key pair, give us the public key, and your SDK encrypts each payload before it leaves your servers. Only someone holding your private key can read it.

When encryption is on for a project, the raw payloads we store are encrypted at rest in a form we cannot read, and they are decrypted in your browser using your key. It is a strong option for teams handling regulated or confidential data — and a reminder that, with it on, recovering data depends on you keeping your private key safe.

We don’t sell your data, but running BugBoard means a few trusted companies process some of it on our behalf, strictly to provide the service:

• Paddle — our payment processor and merchant of record, who handles checkout, billing, and invoices.
• Hosting and infrastructure providers — the servers and databases that store and serve your data.
• Email delivery — the provider that sends transactional emails such as notifications, invitations, and password resets.

Beyond the providers above, we may disclose information when the law requires it (a valid legal request), to protect the rights, safety, and security of our users and the service, or as part of a merger, acquisition, or sale of assets — in which case we will let you know before your information moves to a new owner. And of course, the people you invite to a project can see that project’s data; sharing within your team is the whole point.

Paid subscriptions are processed by Paddle, our merchant of record. Your card details go directly to Paddle and never touch BugBoard servers. From Paddle we receive only what we need to run your account — your subscription status and invoice metadata. Paddle’s own privacy policy governs how it handles your payment information.

We take security seriously: traffic is encrypted in transit with TLS, passwords are stored only as salted hashes, access to data is limited to what each project member is allowed to see, and sensitive projects can use the optional payload encryption described above.

No service can promise perfect security, and we won’t pretend otherwise. If a breach ever affects your personal data, we will notify you and the relevant authorities as required by law.

Because bug payloads can quietly pick up secrets and personal data, we recommend scrubbing anything sensitive before you report it. Strip credentials, tokens, and personal identifiers in your code, or turn on payload encryption. Whatever you send is stored as project data and is visible to your project members, so treat the SDK like any other place sensitive data could end up.

We keep your project data for as long as your account is active and you need it. Deleting a project permanently removes its tasks, bug data, comments, and attachments. Deleting your account removes your personal information and any projects you solely own.

After deletion, copies may linger briefly in encrypted backups before those backups rotate out on their normal cycle. We also keep limited records where the law requires it, such as billing history for tax purposes.

BugBoard is operated online and our providers may store or process data in countries other than your own, including places whose data-protection laws differ from yours. Wherever your information is processed, we apply the same protections described in this policy and use appropriate safeguards for international transfers.

You have real control over your information. From your account settings you can access and correct your details, export your data, and delete projects or your whole account. You can adjust which email notifications you receive at any time, and you can email us if you would rather we handle a request for you.

Depending on where you live, you may have extra rights under laws such as the GDPR or CCPA — including the right to know what we hold, to object to certain processing, and to lodge a complaint with a regulator. We honour reasonable requests regardless of where you are, and we will never charge you for asking.

BugBoard is a tool for developers and teams, not a service for children. It isn’t directed at anyone under 16, and we don’t knowingly collect personal information from children. If you believe a child has given us their information, contact us and we’ll delete it.

We’ll update this policy as the product evolves. When we do, we’ll change the “last updated” date at the top, and for any change that materially affects your privacy we’ll give you a heads-up by email or in the app before it takes effect.

Questions about this policy, your data, or a request you’d like to make? Email us at support@bugboard.dev and a real human will reply — usually within a business day.