Privacy Policy

Effective date: June 5, 2026 · Contact: privacy@pinbug.app

Summary

Pinbug is a Chrome extension that helps QA testers capture bug reports and submit them to issue trackers (YouTrack, Jira Cloud, GitHub, GitLab, ClickUp). The extension is bring-your-own-credentials: it talks directly to your tracker and, if you enable AI, your Anthropic API key. We do not operate a backend that stores your data.

Data	Where it lives	Who can see it
Tracker credentials (URL, token)	`chrome.storage` on your device, synced via your Google account	You
Anthropic API key (optional)	`chrome.storage` on your device	You
Bug report content (title, description, screenshots, video, telemetry)	Sent directly to your configured tracker over HTTPS	You and anyone with access to your tracker
Anthropic API requests	Sent directly to `api.anthropic.com` when you press Generate with AI	Anthropic (per their privacy policy)
Console logs, network logs, user actions	Captured locally in the browser tab; included in tracker tickets only when you check the corresponding box and submit	You and anyone with access to your tracker
Voice hint (optional)	Processed by your browser's built-in speech recognition; in Chrome this may involve Google's speech servers	Google (per Chrome's speech recognition)
Usage analytics, telemetry to our servers	None. We run no backend, no analytics, no telemetry pings.	—

How the extension uses Chrome permissions

activeTab — Used to read the URL/title of the active tab when you open the reporter, so the bug report can reference the page under test.
storage — Used to save your tracker URL, token, AI key, preferences, and unfinished draft (so you can resume after a tab reload). Nothing leaves your browser through this permission.
scripting — Used to inject the reporter UI into the page you're testing. The injected script runs in an isolated world and does not modify the host page.
tabCapture — Used only when you press Record to capture the visible tab plus tab audio. Recording stops automatically after 2 minutes; the video is kept locally in your browser until you attach it to a ticket, discard it, or close the session.
Optional host permissions (https://*/*, http://localhost/*) — Requested at runtime, only for the specific host you configure as your tracker URL (or api.anthropic.com for AI). We never request blanket access; you grant per-host.

Where your data goes

Your issue tracker. When you click Submit, the extension sends your bug report (title, description, screenshots as attachments, optional video, optional console/network logs, optional environment metadata) directly to the tracker you configured. The data does not pass through any server we operate.
GitHub note: GitHub Issues has no attachment API, so screenshots and recordings are committed as files into your repository under a .pinbug/ folder and linked from the issue. They follow your repo's visibility and history.
Anthropic API. If you provide an Anthropic API key and press Generate with AI, the extension sends your hint, captured telemetry, and page context directly to https://api.anthropic.com. Anthropic's data handling is governed by their privacy policy.
Browser speech recognition. If you use the optional voice hint, audio is handled by the browser's Web Speech API; Chrome may process it on Google's servers. Voice is never sent to us or to your tracker — only the resulting text, and only if you use it in the report.
Nowhere else. The extension makes no third-party analytics, error-reporting, advertising, or marketing calls.

Sensitive information

You decide what to include in a bug report. The PII auto-blur feature attempts to detect and blur input fields on the screenshot, and manual blur is always available — but redaction is best-effort: you are responsible for reviewing the screenshot/video before pressing Submit.

Data retention

The extension does not store your reports after submission. Local drafts (form content + screenshots) are kept in your browser until you submit, discard, or uninstall. Tracker tickets follow your tracker's retention policy.

Your controls

Delete credentials: Settings → tracker or AI section → Disconnect.
Uninstall: Removing the extension clears all local data (Chrome erases chrome.storage on uninstall).
Revoke host permission: chrome://extensions → Pinbug → Site access.

Changes to this policy

We will update the effective date above and post the new version at pinbug.app/privacy. Significant changes will also be noted in the extension's Chrome Web Store changelog.

Contact

Questions: privacy@pinbug.app