Privacy
Last updated 20 October 2026
Draft. Plain-English terms written for launch; have a lawyer read them before taking real money at volume.
What we collect
The URL you give us, your email address and payment details (handled by Stripe; we never see your full card number), any test account you provide for a Deep run, and the screenshots, network logs and page captures our agents record while testing your app.
What we do with it
We use it to run your test, write your report, email you and handle support and refunds. We keep anonymised bug types and severities (for example "broken signup form, severe") to write about common problems in vibe-coded apps. Those never include your URL, your data or anything that identifies you or your app unless you ask to be named.
How long we keep it
Reports, screenshots and logs are deleted 30 days after delivery. Test account credentials are deleted when the run ends. Payment records are kept as long as tax law requires.
The free Sniff Score
When you use the free Sniff Score we store the homepage URL you gave us, the score and findings, and two screenshots of your homepage (desktop and phone). We don't store your IP address: we keep a salted one-way hash of it for up to 3 days, only to enforce the 5-scores-a-day limit. Your result page is unlisted (search engines are told not to index it) and is deleted, with its screenshots, 30 days after the score was run. If you tick the box to get tips by email, we keep your email address, the URL it relates to, the exact consent wording you agreed to and the time you agreed, until you unsubscribe. Every email has an unsubscribe link. Cloudflare Turnstile checks you're human when you submit the form.
Re-sniffs, badges, the Sniff Board and stats
When you run a score we set one cookie, bs_owner: a random ID that marks the results you ran, so you can re-sniff them sooner and choose to make them public. We store only a salted hash of it next to your scores. If you tick "Show my score publicly" and prove the domain is yours (a bugsniffer-verify meta tag or DNS TXT record, which we re-check weekly), your domain's latest score shows on a badge at bugsniffer.io/badge/<domain>.svg and on the weekly Sniff Board, search engines may index its result page, and those results are kept until you untick the box. After that the normal 30-day deletion applies. For our public stats pages we keep an anonymised record of each score (platform, score, which checks lost points and a salted hash of the domain so each app counts once), without the URL or anything that names the app. If you get an API key we store a hash of the key, never the key itself, and a salted hash of the IP address that created it.
Who sees it
Our AI agents and the model providers that power them, Stripe for payments, our email provider and our hosting provider. We don't sell data and we don't use advertising trackers on this site.
Your rights
Email [email protected] to see, correct or delete your data. Deletion requests are processed automatically and confirmed by email.
Operated by Nion Enterprises, ABN 74 510 442 749. Payments by Stripe.
Questions: [email protected]