# Flusterduck Privacy Policy Canonical: https://flusterduck.com/privacy Effective date: June 14, 2026 ยท Last updated: August 20, 2026 This is a faithful markdown summary of the Privacy Policy; the canonical HTML page above is the authoritative text. ## Who we are Flusterduck is operated by Creayo LLC. The policy covers the Flusterduck website, dashboard, SDK, APIs, integrations, MCP tools, and related services. ## Account and business data For accounts we collect what is needed to run the product: login identity, organization and site settings, member roles, API key metadata, alert rules, integration settings, support messages, and billing status. Payments are processed by Stripe; we never store full card numbers, only billing identifiers, plan, subscription status, and invoice metadata. If someone unsubscribes from sales outreach, we retain that email address in a suppression list so we can honor the request and avoid contacting it again. ## End-user telemetry The SDK measures UX friction. It may send behavioral signals: clicks, taps, scroll patterns, timing, navigation paths, viewport size, browser information, element selectors, the signal type, and customer-provided metadata. Around a detected friction moment it may also send a short trail of cursor positions (page coordinates and timestamps only, sampled a few times per second) so the moment can be replayed as motion; no cursor data is sent for sessions without friction. It also sends the visible label of an element a visitor interacts with (button text, a heading, or an accessible name) so issues read in plain language. Before any label leaves the browser, the redactor masks email and web addresses, IBANs, and phone- or card-length digit runs. When something on the page breaks, the SDK sends technical error evidence: the message of a JavaScript error, rejected promise, or console-logged error (scrubbed in the browser of tokens, secrets, and common contact patterns, capped per session), and for failed network requests the request path and HTTP status code only. Never request or response bodies, never query strings. To attribute friction to traffic sources, the SDK captures standard UTM parameters from the landing URL and the hostname of an external referrer. Only the referrer's origin is kept; its path and query string never leave the browser. The SDK does not record session replay, video, screenshots, full DOM snapshots, values typed into form fields, passwords, or keystrokes. IP addresses are hashed before storage and never kept in raw form. ## Source code used by AI detection Source access is off by default and is granted per site. At Tier 2 or 3, Flusterduck reads only the GitHub repository mapped to that site through a token limited to that one repository and repository-contents reads. When a production deploy includes a commit SHA, code checks read that deployed commit. Short SHAs are resolved to a full GitHub SHA. Without a deploy SHA, a read may use the current default-branch tip, but that result is marked unpinned and cannot be the sole proof for a code-found issue. The detection model may receive a short source excerpt while investigating. Flusterduck stores only the receipt needed to reproduce the read: repository, ref, full SHA, file, line number, and a server-computed content hash. Source excerpts and diff patches are removed before the investigation transcript is saved. The GitHub App's write permission is used only by the separate Autofix path. AI detection receives a read-only token and cannot edit files, create branches, or open pull requests. ## Customer-controlled metadata Customers can call `identify()`, `track()`, and `signal()`. Do not send names, email addresses, phone numbers, addresses, free-form user text, or other personal data in those fields; use opaque internal IDs. As a backstop, metadata values that look like an email address, phone number, or payment-card number are redacted before leaving the browser and again on our servers, and `identify()` traits that read as contact information are dropped. This is a safety net, not a license to send personal data. ## Cookies and consent The SDK can use a first-party session identifier to group signals. Customers may enable cookieless mode or delay initialization until consent is granted; the SDK supports `setConsent()` and `optOut()`. On our own marketing pages, we run X's advertising pixel and Google's advertising tag to measure which ads lead to sign-ups. When a card-backed trial is confirmed, Google records a zero-value trial. When a paid plan is confirmed, X and Google record the plan and list price. Those confirmation events include a stable checkout or billing-attempt event ID so repeat responses count once. They do not track ordinary dashboard navigation. Our event payload has no name, email address, account ID, or Flusterduck visitor ID. X and Google may set or read their own advertising cookies. ## How we use data To provide and secure the service, authenticate users, calculate confusion scores, create issues, deliver alerts, support integrations, process billing, prevent abuse, debug reliability issues, and comply with legal obligations. ## Subprocessors Supabase (database and edge functions), Vercel (web application), Cloudflare (MCP and network services), Anthropic (AI models behind detection, diagnosis, Guide, and Autofix; when enabled, detection may receive short source excerpts from the site's mapped GitHub repository), context.dev (public page snapshots), Resend (transactional email), Stripe (billing), and X and Google (advertising measurement on marketing pages and confirmed trial or paid-plan actions). Full list with data details: https://flusterduck.com/subprocessors (markdown twin: /subprocessors.md). ## Retention Raw event data is retained for up to 90 days. Aggregated scores, issue history, account records, security logs, billing records, and integration records may be retained for the life of the account or longer where required for security, billing, legal, or compliance purposes. After cancellation, product data is deleted within 30 days unless retention is legally required. ## Security Frontend product data access goes through authenticated edge functions. API keys are hashed, secret-key comparisons use timing-safe checks, webhook signatures use HMAC verification, and browser clients do not query product tables directly. ## Your choices Account owners can request export or deletion of account data by contacting support. Customers are responsible for honoring end-user privacy requests for data they send to Flusterduck, including any opaque IDs attached through metadata. ## More detail Implementation-level privacy details: https://docs.flusterduck.com/privacy. Read together with the Terms of Service: https://flusterduck.com/terms (markdown twin: /terms.md).