Privacy at this Bugoro Hub

This Hub is the web app Bugoro testers sign in to, and the place their QA builds send bug reports. Here is what it keeps, where, who can see it and for how long.

It describes what the Bugoro software does. It is a plain notice, not legal advice.

Who runs this Hub

Its operator runs it on their own server, for their own GitLab project. Bugoro is open source software that anyone can host, and it sends nothing to Bugoro's authors. Your data stays with this Hub's operator and their GitLab project.

For privacy questions, contact the operator of this Hub.

If you only visit

  • Reading these pages needs no account.
  • The Hub sets one cookie, its session cookie. It protects forms and, once you sign in, keeps you signed in. It expires 30 days after your last visit.
  • There are no ads, analytics or tracking scripts.
  • Like most web servers, the Hub logs each request with its IP address, and counts requests per address for a minute to stop abuse. The logs leave out what testers write and who they are: report text, notes, answers, names and tokens. How long the logs last depends on the operator's server.

What testers share, and why

Testers share this so their bug reports can be filed in GitLab as them, a fix can be made, and the fix can come back to their phone.

  • Your GitLab identity. When you sign in with GitLab: your user ID, username and name, and the access and refresh tokens GitLab gives the Hub (scopes api and read_user). The tokens are encrypted in the database. The Hub uses them to act as you in the connected project: file issues, comment, set labels, start the fix agent and approve a fix you verified. When that fix is the agent's, it also tells GitLab to merge it automatically. It never sees your password, and it doesn't store your email address.
  • Your phone. When you pair it: its model and Android version, and when it last contacted the Hub. The app gets a device token; the Hub keeps only a hash of it. The pairing code behind the QR code works once and expires after 10 minutes.
  • Your reports, only when you send one. What you type, the type and severity you pick, and a screenshot. Password fields and areas the app marks private are blacked out on the phone, before the screenshot leaves it. With it go the app's version and build; the phone's maker, model, Android version, language setting, font size, dark mode, screen size and orientation; the screen you were on and the element you pressed, with its text; your last 20 screens and taps; and the app's own last 200 log lines.
  • Crashes, only if you agree. After a crash the app asks, on its next start, whether to send a report. If you say yes, it sends the error, its stack trace, the phone and build details and your last screens and taps, but no screenshot or log lines.
  • What you do next. Verify, Still broken (a note and an optional screenshot) and your answers to the agent's questions become comments on the issue, posted as you.

Before a report leaves the phone, Bugoro replaces email addresses, tokens and long numbers such as card numbers in your note, the log lines, the crash details, the element's text and your screens and taps. The Hub does it again before it stores anything. This catches common patterns, not everything, so keep secrets and personal details out of your reports.

Where it is stored

  • On this Hub, in its database on the operator's server: your GitLab identity and tokens, your paired phones, and each report's details after scrubbing. Your screenshots pass through to GitLab; the Hub doesn't keep them. It also keeps the before and after screenshots CI takes of each build on emulators. GitLab's notices about the project's issues and merge requests, which carry their text, wait in the Hub's job queue; each is cleared a day after it is handled, or kept until the operator clears it if handling it fails.
  • In the operator's GitLab project. Each report becomes an issue filed as you, with your note, the screenshot and the report's details. GitLab Duo's agent reads it to propose a fix. GitLab's own terms and privacy policy apply there.
  • On your phone, until it is sent: reports wait in a queue while you are offline, and a crash waits until you answer.

Who can see it

  • The operator can see everything the Hub keeps.
  • On GitLab, whoever the project lets see its issues. In a private project, that is its members.
  • Anyone can open a project's public dashboard. It shows how many reports are in each state, the median times from report to fix, and the 20 most recently updated reports with their status and issue number. Titles stay hidden unless the operator turns them on for the project, because a report's title starts with the note you typed. It never names a tester.

The Hub sends your data only to the operator's GitLab. Nothing is sold, rented or used for ads.

How long it is kept

Nothing in the Hub deletes your data automatically. Your GitLab identity and tokens, your paired phones, pairing codes and reports stay in its database until the operator deletes them.

  • A pairing code stops working after 10 minutes, and a device token works until the operator revokes it. The records stay either way.
  • Signing out ends your session in that browser. It doesn't delete your account or your tokens.
  • Issues and comments stay in GitLab until someone allowed to delete them does.
  • If the operator uses Bugoro's backup script, it keeps the latest seven backups of the Hub's data.

You can stop the Hub acting as you at any time: in GitLab, open your user settings, then Applications, and revoke the Hub under Authorized applications.

Ask for a copy or deletion

Contact the operator of this Hub. The operator can tell you what the Hub holds about you, delete your account, tokens, phones and reports from the Hub, and delete the issues in GitLab. There is no button for this in the Hub yet.