BugSpray
Overview & Data Philosophy
BugSpray ("BugSpray," "we," "us," or "our") delivers automated frontend error monitoring, WebAssembly-driven session replay, and AI-assisted root cause diagnostic infrastructure for software engineering teams. We are committed to transparency, data minimization, and the strict protection of personal information.
Unlike legacy consumer analytics trackers that harvest behavioral fingerprints for marketing or ad-targeting, BugSpray operates solely as a diagnostic telemetry engine. Our technical architecture is founded upon the following core tenets:
- Purpose Limitation: We collect and process data exclusively to reproduce software defects, analyze runtime anomalies, benchmark Core Web Vitals, and generate automated diagnostic summaries.
- Client-Side First Scrubbing: Any field identified as sensitive (passwords, credit cards, authentication tokens) is masked or discarded locally inside the user's browser before being transmitted across the wire.
- Customer Data Ownership: All recorded session streams, logs, and screenshots remain the intellectual and operational property of our customer organizations. We do not monetize or sell customer data under any circumstances.
Categories of Data We Process
Depending on how you interact with the BugSpray platform (as a dashboard user, team administrator, or end-user of a recorded web application), we process distinct categories of information:
A. Account & Identity Information
When engineering team members sign up or log in via GitHub OAuth or Google OAuth:
- Full name, primary email address, profile avatar URL provided by the OAuth identity provider
- Hashed session tokens stored in secure, HTTP-only cookies
- Organization memberships, team roles (Admin, Member, Viewer), and project permissions
B. Technical Diagnostics & Session Streams
When a developer records a session via our browser extension or web SDK:
- DOM Mutation Graph: Incremental tree modifications encoded via WebAssembly for 60 FPS visual replay.
- Console Logs: Messages logged via
console.error,console.warn,console.info, and uncaught exceptions with JavaScript stack traces. - Network Interceptions: HTTP method, URL, response status code, timing waterfall, and request/response payloads (subject to automated client PII redaction).
- Performance Benchmarks: Web Vitals metrics including Interaction to Next Paint (INP), Largest Contentful Paint (LCP), and Cumulative Layout Shift (CLS).
C. User Annotations & Issue Tickets
Screenshots marked up with arrows, boxes, text annotations, linked Kanban ticket descriptions, priority labels, and comments submitted by team members.
Client-Side PII Masking & Scrubbing
Our highest technical priority is ensuring that Personally Identifiable Information (PII) is intercepted at the source. BugSpray’s telemetry engine applies automatic client-side filters before any data leaves the end-user’s local JavaScript execution context:
Automated Form Input Masking
All input fields with type="password", autocomplete="cc-number", name="cvv", or
HTML attribute data-bugspray-mask are replaced with masked asterisks
••••••••.
HTTP Authorization Stripping
Network request headers including Authorization, Proxy-Authorization, Cookie, and Set-Cookie are automatically redacted into [SCRUBBED_AUTH_TOKEN].
Credit Card & SSN Regex Regex
Regex patterns matching Visa, Mastercard, Amex, Discover, and 9-digit Social Security Numbers are scrambled in flight using the Luhn validation algorithm detector.
Custom Domain Blocklists
Organization admins can define global domain blocklists (e.g., banking portals, internal auth pages) where BugSpray is forcefully inhibited from recording.
AI Diagnostics & LLM Zero-Training Guarantee
BugSpray features automated AI root cause analysis powered by state-of-the-art reasoning models (Google Gemini Pro and Anthropic Claude). When a developer clicks "Analyze Root Cause" or creates a bug ticket:
Zero Training Commitment
We maintain commercial zero-data-retention enterprise agreements with AI model providers. No customer telemetry, session frames, code extracts, or console logs are ever used to train, fine-tune, or reinforce foundation models. API requests are stateless and discarded immediately after generating the diagnostic summary.
Furthermore, organizations have granular controls in the Settings Dashboard to select their preferred model tier or entirely disable AI telemetry synthesis for strict compliance environments.
Chrome Extension & Browser Permissions
The BugSpray browser extension operates under Google Chrome Manifest V3 (MV3) security specifications. It only activates when explicitly engaged by the developer:
| Permission | Technical Purpose | Data Safeguard |
|---|---|---|
| activeTab | Captures DOM state & screenshots only on the specific tab you are recording | Cannot inspect other tabs or browsing history |
| storage | Persists local user preferences and active recording buffers | Stored locally on your device; never sent to third parties |
| debugger / webRequest | Captures console messages & network latency waterfalls for active recording | Auto-detached immediately when recording stops |
Note: The extension derives its identity directly from your web portal session (GET /auth/extension/token) and never requires storing plaintext passwords.
Storage, Cloudflare R2 & Encryption Standards
We enforce modern cryptographic controls across the entire data lifecycle:
Recorded video segments, DOM snapshots, and annotated screenshot blobs are stored in Cloudflare R2 Object Storage, offering distributed edge durability with zero egress-based profiling. Relational metadata, tickets, and user accounts are maintained in high-availability PostgreSQL databases.
Data Retention Schedules & Purge Routines
Data retention is strictly tied to your active plan and team configuration:
| Plan Tier | Session Retention Window | Automated Deletion Mechanism |
|---|---|---|
| Starter (Free) | 7 Days | Hard delete from DB & R2 blob storage via daily cron purge |
| Pro Plan | 90 Days | Hard delete from DB & R2 blob storage via daily cron purge |
| Enterprise Tier | Custom (e.g., 30, 180, 365 Days or Immediate) | Custom automated lifecycle policies + manual instant purge API |
When a recording is deleted (either automatically via the retention schedule or manually by a team administrator), all associated DOM mutation logs, network streams, and storage blobs are permanently purged within 24 hours. Backups are cycled out within 14 days.
Authorized Subprocessors
To provide our managed cloud infrastructure, BugSpray contracts with third-party service providers ("subprocessors") that meet rigorous security and privacy benchmarks:
| Subprocessor | Service Role | Data Location | Compliance Safeguard |
|---|---|---|---|
| Cloudflare Inc. | R2 Object Storage & Edge CDN | Global / US & EU | SOC 2 Type II, ISO 27001 |
| Neon / Supabase | Serverless Managed PostgreSQL | US / EU regions | SOC 2 Type II, HIPAA ready |
| Google Cloud Vertex / Gemini | AI Root-Cause Inference (Stateless) | United States | Zero Data Retention Agreement |
| GitHub / Google | OAuth Authentication Provider | United States | Standard OIDC Protocol |
Your Global Privacy Rights (GDPR, CCPA & CPRA)
Regardless of your geographic location, we respect your fundamental data rights under the European General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act (CCPA as amended by CPRA):
You may request a machine-readable export (JSON/CSV) of all recordings, tickets, and user profile data associated with your organization.
You may permanently delete individual recordings, project workspaces, or your entire user account at any time through the Settings console.
We will never discriminate against you, alter service availability, or degrade quality for exercising your lawful privacy rights.
BugSpray does not sell or share personal information for cross-context behavioral advertising. There is no need to opt out because we never participate in advertising data exchanges.
To submit a formal Data Subject Access Request (DSAR), please email bugspray@dhanifytech.com. We respond to verified requests within thirty (30) calendar days.
Enterprise & Self-Hosted Deployments
For organizations operating in tightly regulated industries (Financial Services, Healthcare, Defense, Critical Infrastructure), BugSpray provides private VPC and self-hosted on-premises packages:
Run the BugSpray FastAPI container cluster and storage sinks entirely within your own AWS, Azure, GCP, or Kubernetes private subnet. Zero telemetry packets leave your perimeter.
Encrypt storage blobs and database backups with your own AWS KMS or HashiCorp Vault cryptographic keys.
Contact Information & Data Protection Officer
If you have questions, inquiries, or security disclosures regarding this policy or our data practices, please reach out to our dedicated compliance and security engineering staff:
Questions regarding DSARs, DPAs, CCPA, GDPR, or compliance audits.
bugspray@dhanifytech.comPGP-encrypted bug bounty disclosures, security incidents, or penetration testing reports.
bugspray@dhanifytech.com