Privacy Policy

Last updated: October 2, 2026

This policy explains what information The AI, Inc. ("we", "us") collects when you use Bugmole ("Bugmole"), how we use it, and the choices you have. Bugmole includes this website (bugmole.com), the Bugmole dashboard (app.bugmole.com), the Bugmole API (api.bugmole.com), and the Bugmole CLI and project worker you run on your own machines.

The short version

• We collect what we need to sign you in and to coordinate your test runs.
• The evidence your tests produce — screenshots, videos, logs — is stored where you choose: on your machine, in your own cloud bucket, or in Bugmole storage when you run tests on Bugmole Cloud.
• This website only runs analytics if you accept them, and it asks first.
• We do not sell personal information, and we do not use your test data to train AI models.

Information we collect

Account information

You sign in with The AI Inc. identity service (id.theaiinc.com). When you do, we receive your account identifier, your email address, whether it has been confirmed, and the organizations (tenants) you belong to. The sign-up page uses Cloudflare Turnstile to tell people from bots; Turnstile processes your IP address and browser signals for that check. When you connect the CLI to your account, we also record the email address used and the IP address the request came from, so we can protect the pairing flow against abuse.

Workspace and project information

We store the workspaces, projects, apps, and environments you create, including the names and URLs you enter, who created them, and who is a member of them. We store the API keys you create as one-way hashes; we never keep the key itself after showing it to you once.

Test runs

For each run we store its plan, status, progress, step results, timings, the browsers and devices it ran on, the environment URL it ran against, error messages, and who requested it. For coding tasks you ask Bugmole to perform, we store the task description, progress messages, and a summary of the files changed.

Test evidence

Runs capture evidence about the application being tested: screenshots, screen and browser recordings, step logs, page errors, console errors, and result files. Evidence can contain whatever your application displays or receives during a test, including information you type into it. Please use test accounts and test data.

Where evidence is stored depends on your configuration:

• Local storage (the default): evidence is written to a folder on the machine that runs the test. The dashboard reads it directly from your machine through a local connection and does not upload it to us.
• Cloud storage you configure (for example Amazon S3, Google Cloud Storage, or Cloudflare R2): evidence is written to your own bucket under your own account.
• Bugmole storage: projects set to Bugmole storage keep their plans, flows, and evidence in storage we operate on Cloudflare. Runs on Bugmole Cloud always use it. Run history and its evidence are deleted automatically after your plan's history period (for example 7 days on Free).
• Cloud workers you host: when a run executes on a worker you run in the cloud, its evidence is stored in the object storage configured for that worker.

Billing

If you buy a plan, PayPal processes the payment. We don't receive your card or bank details; we receive the subscription and payment identifiers, amounts, and the payer's email address, and we keep the invoices and receipts we issue. Owners can add a billing name, email, address, and tax ID to appear on receipts. We also record your usage (cloud minutes, AI credits, and device minutes) to apply your plan's allowances and bill additional usage.

Bug reports and feedback

When you report a bug or send feedback from the dashboard, we store what you write, your rating, any screenshots or photos you attach, the page you were on, your browser details, and recent console and network activity from the dashboard, with anything that looks like a password or access token removed first. We also note your workspace and plan. We file each report as an issue in our own GitHub issue tracker so our team can act on it; issues there are not deleted automatically. Contact details are included only if you enter them.

Integrations you connect

• GitHub: if you install the Bugmole GitHub App, we store the installation, the GitHub account it belongs to, the repositories it can access, and the issues you link to findings (repository, issue number, title, and URL). We use it to search, read, and create issues on your behalf. Unlinking an issue never modifies it on GitHub.
• TestFlight feedback: if you forward TestFlight feedback to Bugmole, it may include the tester's name, email, device model, operating system, and screenshots. It is held in memory to display in the dashboard and is not written to our database.
• Slack: if you connect Slack, we store the workspace and channel you chose and an access token, encrypted, and post alerts about your runs and usage to that channel.
• Single sign-on and SCIM: if your organization sets up single sign-on, its identity provider tells the identity service your name, email address, a user identifier, and the groups you're in. Bugmole uses your groups to choose your role in the workspace. If your organization uses SCIM, its identity provider can create, update, and deactivate your account; when it deactivates you, we remove your workspace access and revoke your API keys. Identity provider settings, including connection secrets, are kept by the identity service, encrypted.
• Microsoft Teams: if you connect a Teams channel, we store the workflow webhook URL you paste, encrypted, and post alerts about your runs and usage to it.
• GitLab merge request checks: if you connect a GitLab project, we store its path and host and the access token you create (the token encrypted), and receive merge request events (numbers, branch names, and commit identifiers) from it. We use the token only to post your runs' results back as commit statuses.
• Jira: if you connect a Jira Cloud project, we store its site address, project key and account email, and the API token you create (the token encrypted). We create and update tickets for your tests, read comments that mention Bugmole to retest a ticket, and post results to those tickets.
• Device clouds: if you connect BrowserStack, Kobiton, or AWS Device Farm, we store the credentials you enter, encrypted, and send your test runs and any app builds you upload to that provider. If you use Bugmole's own real devices, your runs and app builds are sent to AWS Device Farm under our account.
• GitHub pull request checks: if you turn them on, we receive pull request numbers, branch names, commit identifiers, and deployment URLs from GitHub, and post the results of your runs back to GitHub as checks.
• Temporary email inboxes: if a test flow requests a temporary inbox to test sign-up or email links, Bugmole creates a disposable inbox with the mail.tm service, reads the messages sent to it during the run, and deletes it afterwards.
• AI model providers: Bugmole's planning and analysis features call the AI provider you configure (OpenAI, Anthropic or a local Ollama model), using your own credentials. What those providers do with the data is governed by your agreement with them.
• Bugmole AI: if you use AI credits instead of your own key, the relevant part of your test (for example a failing step, its error messages, and a summary of the page) is sent to our AI provider, Anthropic, to produce the answer; if Anthropic is unavailable to us, we may use OpenAI instead. They process it on our behalf and do not use it to train models.

Cookies

This website (bugmole.com) asks before it runs any analytics. Until you choose Accept, no analytics cookies are set and nothing is loaded from Google or Microsoft. Choosing Decline loads nothing at all. We remember your choice for a year in your browser's local storage, and you can change it by clearing that storage.

Cloudflare, which serves this website, counts page views with its own analytics. It sets no cookies, identifies nobody, and runs on every visit, so there is nothing to consent to.

If you accept, these run:

Both collect the pages you view, rough location from your IP address, and your device and browser. We use them only to improve the site, and we don't use them for advertising. Clarity masks text in its replays by default.

Accepting also lets us remember which link brought you here. If you arrived through a partner's link (?ref=) or a campaign link (utm_ tags), or from another website, we set our own bm_attr cookie on bugmole.com for up to 90 days. It holds the partner code, the campaign tags, the first page you opened (without its query string), the other website's domain, and when you arrived. If you then sign up, the dashboard saves that once with your new account, so we can tell which partners and campaigns bring people to Bugmole, and deletes the cookie. It is never sent to anyone else, and it is never added to an account older than a day. The product demo video is embedded from YouTube's privacy-enhanced domain (youtube-nocookie.com) and only loads when you choose to play it.

The dashboard uses cookies that are strictly necessary to sign you in:

The dashboard also keeps small preferences, such as a collapsed menu or your last browser selection for a run, in your browser's local storage. They never leave your browser.

How we use information

We use the information above to:

• sign you in and keep your account secure;
• run, coordinate, and display your tests and their results;
• connect the integrations you choose;
• prevent abuse, investigate problems, and keep the service reliable;
• communicate with you about your account and the service.

We do not sell personal information or use it for advertising, and we do not use your projects, runs, or evidence to train AI models.

Service providers

We rely on these providers to operate Bugmole:

Retention and deletion

We keep account, workspace, project, and run information for as long as your account or project is active, except that run history and evidence in Bugmole storage are deleted after your plan's history period. We keep invoices and payment records as long as tax and accounting law requires. Project owners can delete a project's plans, runs, run history, and tasks at any time with Reset project. Running bugmole reset in the CLI also deletes the evidence stored on your machine. Evidence stored in your own cloud bucket stays under your control. To delete your account or anything reset does not cover, contact us at info@bugmole.com and we will delete it unless we are required to keep it.

Your choices and rights

You can review and update your account details in your account portal, disconnect integrations at any time, and revoke API keys from the dashboard. Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to how we use it. To make a request, email info@bugmole.com. We will not treat you differently for exercising these rights.

Security

We protect information with encryption in transit, hashed credentials, and access checks on every project. See our Security page for details. No system is perfectly secure, so please report any concern to info@bugmole.com.

Children

Bugmole is a tool for software teams and is not directed at children under 16. We do not knowingly collect their personal information.

International transfers

Our providers may process information in countries other than yours. When they do, we rely on their contractual and technical safeguards to protect it.

Changes

We will post any changes to this policy on this page and update the date above. If a change materially affects how we use your information, we will let you know before it takes effect.

Contact

Questions about this policy: info@bugmole.com.