You're trusting us with bug reports and access to your repositories. Here is exactly how we handle that responsibility.
All traffic between the widget, your browser, and our API uses TLS. Reports and account data are stored in access-controlled databases, and dashboard sessions use signed, expiring tokens. Cross-origin access to authenticated endpoints is restricted to our dashboard origins.
AI fixes use a GitHub App, not a personal access token. You choose exactly which repositories the app can see; we request only Contents and Pull request permissions. Access tokens are minted on demand and expire within an hour — no long-lived repository credentials are ever stored. Uninstalling the app from GitHub revokes everything instantly.
AI analysis is read-only. A pull request is only created after you review the root cause, the explanation and the full line-by-line diff, and explicitly approve it. Nothing is committed to your repository automatically, and bug report text is always treated as untrusted input — never as instructions.
The embed script never records passwords, and automatically masks emails, phone numbers, card-like fields and anything marked with a data-bt-private attribute. The widget's context capture excludes secrets-looking files (like .env) from anything sent to the AI.
Slack and Trello are connected via OAuth — you never paste API keys into our dashboard. Tokens are stored server-side, are never sent to the browser, and can be revoked from your widget settings (or from Slack/Trello directly) at any time.
Bug reports go only to the destinations you configure. We don't sell data, we don't train models on your code, and you can delete widgets — and their reports — at any time from the dashboard.
We take reports seriously and respond fast. Email support@example.com with the details — please don't disclose publicly until we've had a chance to fix it.
See also our Privacy Policy and Terms of Service.