Privacy Policy

Last updated: September 17, 2026

This policy explains what information The AI, Inc. ("we", "us") collects when you use Bugmole ("Bugmole"), how we use it, and the choices you have. Bugmole includes this website (bugmole.com), the Bugmole dashboard (app.bugmole.com), the Bugmole registry API (api.bugmole.com), and the Bugmole CLI and project worker you run on your own machines.

The short version

We collect what we need to sign you in and to coordinate your test runs.
The evidence your tests produce — screenshots, videos, logs — is stored where you choose: on your machine, in your own cloud bucket, or in Bugmole storage when you run tests on Bugmole Cloud.
This website only runs analytics if you accept them, and it asks first.
We do not sell personal information, and we do not use your test data to train AI models.

Information we collect

Account information

You sign in with The AI Inc. identity service (id.theaiinc.com). When you do, we receive your account identifier, your email address, whether it has been confirmed, and the organizations (tenants) you belong to. The sign-up page uses Cloudflare Turnstile to tell people from bots; Turnstile processes your IP address and browser signals for that check. When you connect the CLI to your account, we also record the email address used and the IP address the request came from, so we can protect the pairing flow against abuse.

Workspace and project information

We store the workspaces, projects, apps, and environments you create, including the names and URLs you enter, who created them, and who is a member of them. We store the API keys you create as one-way hashes; we never keep the key itself after showing it to you once.

Test runs

For each run we store its plan, status, progress, step results, timings, the browsers and devices it ran on, the environment URL it ran against, error messages, and who requested it. For coding tasks you ask Bugmole to perform, we store the task description, progress messages, and a summary of the files changed.

Test evidence

Runs capture evidence about the application being tested: screenshots, screen and browser recordings, step logs, page errors, console errors, and result files. Evidence can contain whatever your application displays or receives during a test, including information you type into it. Please use test accounts and test data.

Where evidence is stored depends on your configuration:

Local storage (the default): evidence is written to a folder on the machine that runs the test. The dashboard reads it directly from your machine through a local connection and does not upload it to us.
Cloud storage you configure (for example Amazon S3, Google Cloud Storage, or Cloudflare R2): evidence is written to your own bucket under your own account.
Bugmole storage: projects set to Bugmole storage keep their plans, flows, and evidence in storage we operate on Cloudflare. Runs on Bugmole Cloud always use it. Run history and its evidence are deleted automatically after your plan's history period (for example 7 days on Free).
Cloud workers you host: when a run executes on a worker you run in the cloud, its evidence is stored in the object storage configured for that worker.

Billing

If you buy a plan, PayPal processes the payment. We don't receive your card or bank details; we receive the subscription and payment identifiers, amounts, and the payer's email address, and we keep the invoices and receipts we issue. Owners can add a billing name, email, address, and tax ID to appear on receipts. We also record your usage (cloud minutes, AI credits, and device minutes) to apply your plan's allowances and bill additional usage.

Bug reports and feedback

When you report a bug or send feedback from the dashboard, we store what you write, your rating, any screenshots or photos you attach, the page you were on, your browser details, and recent console and network activity from the dashboard, with anything that looks like a password or access token removed first. We also note your workspace and plan. We file each report as an issue in our own GitHub issue tracker so our team can act on it; issues there are not deleted automatically. Contact details are included only if you enter them.

Integrations you connect

GitHub: if you install the Bugmole GitHub App, we store the installation, the GitHub account it belongs to, the repositories it can access, and the issues you link to findings (repository, issue number, title, and URL). We use it to search, read, and create issues on your behalf. Unlinking an issue never modifies it on GitHub.
TestFlight feedback: if you forward TestFlight feedback to Bugmole, it may include the tester's name, email, device model, operating system, and screenshots. It is held in memory to display in the dashboard and is not written to our database.
Slack: if you connect Slack, we store the workspace and channel you chose and an access token, encrypted, and post alerts about your runs and usage to that channel.
Single sign-on and SCIM: if your organization sets up single sign-on, its identity provider tells the identity service your name, email address, a user identifier, and the groups you're in. Bugmole uses your groups to choose your role in the workspace. If your organization uses SCIM, its identity provider can create, update, and deactivate your account; when it deactivates you, we remove your workspace access and revoke your API keys. Identity provider settings, including connection secrets, are kept by the identity service, encrypted.
GitHub pull request checks: if you turn them on, we receive pull request numbers, branch names, commit identifiers, and deployment URLs from GitHub, and post the results of your runs back to GitHub as checks.
Temporary email inboxes: if a test flow requests a temporary inbox to test sign-up or email links, Bugmole creates a disposable inbox with the mail.tm service, reads the messages sent to it during the run, and deletes it afterwards.
AI model providers: Bugmole's planning and analysis features call the AI provider you configure (for example OpenAI, Anthropic, a local Ollama model, or your Cursor agent), using your own credentials. What those providers do with the data is governed by your agreement with them.
Bugmole AI: if you use AI credits instead of your own key, the relevant part of your test (for example a failing step, its error messages, and a summary of the page) is sent to our AI provider, Anthropic, to produce the answer. Anthropic processes it on our behalf and does not use it to train models.

Cookies

This website (bugmole.com) asks before it runs any analytics. Until you choose Accept, no analytics cookies are set and nothing is loaded from Google or Microsoft. Choosing Decline loads nothing at all. We remember your choice for a year in your browser's local storage, and you can change it by clearing that storage.

Cloudflare, which serves this website, counts page views with its own analytics. It sets no cookies, identifies nobody, and runs on every visit, so there is nothing to consent to.

If you accept, these run:

What	Who	What it does	Cookies
Google Analytics 4, through Google Tag Manager	Google	Counts visits and shows which pages people read and where they leave	`_ga`, `_ga_*`, up to 2 years
Clarity	Microsoft	Heatmaps and replays of how pages are used, so we can see what confuses people	`_clck`, `_clsk`, up to 1 year

Both collect the pages you view, rough location from your IP address, and your device and browser. We use them only to improve the site, and we don't use them for advertising. Clarity masks text in its replays by default. The product demo video is embedded from YouTube's privacy-enhanced domain (youtube-nocookie.com) and only loads when you choose to play it.

The dashboard uses cookies that are strictly necessary to sign you in:

Cookie	Purpose	Lifetime
`bugmole_aegis_session`	Keeps you signed in. Encrypted and HTTP-only.	Up to 8 hours
`aegis_oauth_state`, `aegis_oauth_verifier`, `aegis_return_to`, `aegis_device_id`	Complete a sign-in securely. HTTP-only.	10 minutes, removed after sign-in

The dashboard also keeps small preferences, such as a collapsed menu or your last browser selection for a run, in your browser's local storage. They never leave your browser.

How we use information

We use the information above to:

sign you in and keep your account secure;
run, coordinate, and display your tests and their results;
connect the integrations you choose;
prevent abuse, investigate problems, and keep the service reliable;
communicate with you about your account and the service.

We do not sell personal information or use it for advertising, and we do not use your projects, runs, or evidence to train AI models.

Service providers

We rely on these providers to operate Bugmole:

Provider	What it does for us
Cloudflare	Hosts this website, the dashboard, and the registry, including their database, storage, and logs, and counts page views without cookies
The AI Inc. identity service	Sign-in and account management, including single sign-on and SCIM for organizations that set them up
GitHub	Issue tracking and pull request checks if you install the GitHub App; our own tracker for bug reports and feedback
PayPal	Payments, subscriptions, and invoices for paid plans
Anthropic	AI features when you use Bugmole AI credits
Brevo	Account, usage, and billing emails
Slack	Alerts, only if you connect Slack
mail.tm	Disposable inboxes, only if a test flow requests one
YouTube	Plays the demo video, only if you choose to play it
Google	Website analytics (Google Analytics and Tag Manager), only if you accept analytics on this website
Microsoft	Website heatmaps and session replay (Clarity), only if you accept analytics on this website

Retention and deletion

We keep account, workspace, project, and run information for as long as your account or project is active, except that run history and evidence in Bugmole storage are deleted after your plan's history period. We keep invoices and payment records as long as tax and accounting law requires. Project owners can delete a project's plans, runs, run history, and tasks at any time with Reset project. Running bugmole reset in the CLI also deletes the evidence stored on your machine. Evidence stored in your own cloud bucket stays under your control. To delete your account or anything reset does not cover, contact us at info@theaiinc.com and we will delete it unless we are required to keep it.

Your choices and rights

You can review and update your account details in your account portal, disconnect integrations at any time, and revoke API keys from the dashboard. Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to how we use it. To make a request, email info@theaiinc.com. We will not treat you differently for exercising these rights.