1. What this covers
This policy covers the Bug Reporter widget, the service at bugs.compass.st, and
this website including its contact form. Compass's other products have their own policy at
compass.st/privacy.
2. Who is responsible for what
When someone files a bug report on a customer's website, that customer decides that the widget is there and why. They are the controller of that data; we process it on their behalf and on their instructions. If you filed a report on somebody's site and want it removed, the fastest route is to ask them — though you can also ask us and we will pass it on or act on it.
For this website and its contact form, we are the controller.
3. What a bug report contains
Two parts. What the person writes, and what the widget measures.
What they write
A description, optionally a summary, a type and severity, and optionally their name and email so they can be followed up. Optionally a screenshot, which they choose to attach — by capturing the tab, uploading a file, or pasting an image. Nothing is captured without them pressing a button.
What the widget measures
- Page — URL, title, referrer, and the application version if the site publishes one
- Browser — user-agent string, browser brands, platform, vendor, language preferences
- Display — viewport and screen dimensions, pixel ratio, orientation, scroll position, zoom, colour scheme, reduced-motion and forced-colours settings
- Environment — timezone and UTC offset, whether cookies and local storage work, device memory, processor count, touch points, online status
- Connection — effective connection type, downlink, round-trip time
- Performance — time to first byte, DOM ready, load time, transfer size
- Console — the most recent errors and warnings, uncaught exceptions with stack traces, unhandled promise rejections, failed resource loads
- Requests — the most recent network requests with method, URL, status and duration
- Recent actions — clicks, which form fields changed, and navigations
What our server adds
Recorded from the request itself, so it cannot be altered by the page: IP address, approximate location from that IP (country, region, city, postal area), network operator, the Cloudflare location that handled it, HTTP protocol and TLS version, and the time we received it.
The panel shows a "what gets sent automatically" summary before the person presses send, so this is visible to them at the moment it matters, not only here.
4. What is deliberately not collected
The contents of form fields. The action trail records that a field changed and what it is called — never what was typed into it. Field values are where passwords, card numbers and personal details live, and a bug report travels by email and sits in a database. The name of the field is enough to reproduce a problem; the value is a liability.
We also do not use cookies in the widget, do not track people across sites, do not build profiles, and do not fingerprint for advertising.
Two honest caveats. Console messages and request URLs are captured as they are — if an application writes personal data into a log line or a query string, it can appear in a report. And a screenshot shows whatever was on screen when it was taken. Both are why the customer installing the widget carries the responsibilities in our Terms.
5. The contact form on this site
The form on our home page collects your name, email, optionally a company or team, and your message. Submitting it also records your IP address, country and browser user-agent alongside the message — the ordinary technical information any web request carries, kept to identify and block automated abuse. The form is protected by Cloudflare Turnstile, which is anti-spam and not a tracker; it sets no cookies. Messages are emailed to us and stored for 180 days.
6. Why we hold it
- To deliver reports to the customer whose software is being tested — the purpose of the service.
- To make reports diagnosable. The technical detail exists so a defect can be reproduced without an exchange of emails.
- To keep the service working and stop abuse — rate limiting, origin checks, blocking floods.
- To answer enquiries sent through the contact form.
Where the law requires a lawful basis, ours is legitimate interest: running a testing tool for people who have chosen to install it. We do not sell personal data, and we do not use reports to train machine-learning models.
7. How long we keep it
- Bug reports and their screenshots — 90 days, then deleted automatically by a daily job. Reports can be pinned to survive that, which is a deliberate act.
- Contact form messages — 180 days.
- Rate-limiting counters — minutes. They hold an IP address and are discarded as soon as their window closes.
Deleting a project deletes its reports and screenshots.
8. Who else processes it
- Cloudflare — hosting, storage and the anti-spam challenge. Reports and screenshots are stored on Cloudflare's D1 and R2 services.
- Twilio SendGrid — delivers contact-form messages to our inbox.
We are based in the United States and data is processed there. We do not share reports with anyone else, and never with advertisers or data brokers.
9. Cookies
This website sets no cookies and runs no analytics. The widget sets no cookies either. It does use the browser's local storage on the host page for one thing: remembering the name and email a tester last used, so they do not retype it on every report. That stays in their browser and is never sent anywhere except as part of a report they choose to file.
10. Your rights
Depending on where you live, you may have the right to ask for a copy of your personal data, to correct it, to have it deleted, or to object to how it is used. Email us and we will act on it. If the data is in a report filed on somebody else's website, we may need to refer you to them as the controller — we will tell you who, and we will not simply drop the request.
11. Contact
warreng@ecropolis.com
Ecropolis LLC, Texas, United
States.