Privacy Policy

While the Busymate DevTools VPN tunnel is active, the app records:

• Request URLs, HTTP method, status code, request and response headers, and timing for every connection your device makes through the tunnel.
• Response bodies, but only for the HTTPS domains you explicitly add to the SSL-proxy list inside the app. Domains not on that list are observed only at the TLS-handshake level (host name + timing); their contents are never decrypted.
• Connection metadata: the device's public (egress) IP address, approximate country, iOS version, app version, and a per-device UUID generated locally at first launch. How your IP and country are used is described below under “Approximate location & network information.”

We do not use GPS or iOS location services, the microphone, camera, photos, contacts, or health data. (We do derive your approximate country from your network IP address — see “Approximate location & network information” below.) The app contains no advertising SDKs and no third-party analytics SDKs; the only usage and diagnostic data we collect are the first-party events described below under “Diagnostics, usage & app-health data.”

To let you inspect your own HTTPS traffic, Busymate DevTools uses two things: a root certificate you install and trust on your device, and an on-device VPN. We describe both here accurately so there is no ambiguity about what happens on your device versus on our servers.

The root certificate. The shipped app embeds no certificate and no private key of any kind. During setup, the app fetches its HTTPS-debugging root certificate from Busymate's own server over an authenticated TLS connection — it is not generated locally on your device. The same root is common to installations (shared) rather than generated per device, and the corresponding key is held on our server, transmitted only to authenticated installations of our own app. We serve the root from the server rather than generating it on the device so that if you delete and reinstall the app you do not have to repeat the profile installation and trust steps, which iOS would otherwise require.

The certificate is used solely to decrypt traffic on your own device for inspection in this developer tool, and only for the HTTPS domains you explicitly add to the SSL-proxy list. It is installed only with your explicit consent through the standard iOS configuration-profile and Certificate Trust Settings flow, and you can remove it at any time from iOS Settings (see “Your consent & how to revoke it” below).

The VPN. Capture runs through an on-device VPN (a local packet tunnel). It is used solely for local capture and inspection of your own device's traffic. It captures only this device's own traffic and does not route your traffic through Busymate's servers for surveillance or for any other purpose — the interception happens locally, on your device. The request and response data the app records is then uploaded to your own private dashboard, as described in the next section; that upload — not the browsing itself — is what leaves the device.

Captured traffic is uploaded over TLS to the Busymate dashboard, which runs on Supabase Cloud (PostgreSQL + Realtime). The dashboard is private to your account — only authenticated users on your team can view it. Supabase acts as our managed-database and authentication processor on our behalf. We do not sell your data, and we do not share it with advertisers or analytics networks.

A small number of features involve additional, named sub-processors — Sign in with Apple and the IP-to-country lookup. These are described in the sections below.

Besides the dashboard, Busymate exposes your account's data through a REST API, a realtime WebSocket, and an MCP (Model Context Protocol) server at mcp.busymate.dev, so you can connect an AI agent or client of your choice (for example Claude, Cursor, VS Code, or ChatGPT) to work with your captures on your behalf. This is optional — nothing reaches an external agent unless you connect one and authorize it.

• Authorization. Access uses OAuth 2.1 (authorization code + PKCE) — there is no pasted API key and no shared secret. The token an agent receives is scoped to your own account and to your role's permissions: an agent can only read or change what you could do yourself in the dashboard, destructive actions require an explicit confirmation, and every tool call is written to your account's audit log.
• What it can reach. The data an agent can access is the same account data described elsewhere in this policy (captured traffic, devices, and settings). Secret values are never returned over the API — they are write-only and redacted.
• Your chosen client. We do not send your data to an MCP/agent vendor ourselves; your chosen client connects directly to our server with your authorization, and whatever that client then does with the responses (including sending them to its own AI provider) is governed by that client's and provider's own privacy terms, not ours.
• Revoking access. You can disconnect a client on its side and revoke its token from your account at any time, which immediately stops further access.

You can create your Busymate account with Sign in with Apple (SIWA) or another supported single sign-on (SSO) provider. When you do, we receive the identity data the provider returns to complete account creation:

• Your email address (or Apple's private relay address, if you choose to hide your email).
• Your name, if the provider shares it — stored as your account display name (profiles.display_name).

This identity data is used solely to authenticate you and identify your account. Authentication is handled by Supabase Auth, our authentication processor. Apple is the identity provider for Sign in with Apple.

If you enable notifications, the app registers a device push token with Apple Push Notification service (APNs) and stores it under your account so we can deliver notifications you've asked for (for example, capture alerts). The push token is an opaque device identifier; it is not used for tracking or advertising. You can turn notifications off at any time in iOS Settings, which revokes delivery.

To keep the app reliable and understand how it is used, the app sends first-party diagnostic and usage events about its own health, performance, and operation to Busymate's own backend (the device_events store, over TLS to api.busymate.net, under your device's own credential). This is first-party data — not a third-party analytics or advertising SDK, and it is never sent to any advertiser, data broker, or other third party.

These events fall into a few groups:

• Performance & health metrics — available memory, capture-engine health and status, and counts of dropped bytes and events, so we can tell whether HTTPS interception is working on your device and diagnose why it isn't when it fails.
• The shape of your SSL-proxy list, not its contents — the number of domains on your SSL-proxy list and a one-way hash of that list, never the domain names themselves. This lets us confirm your settings reached the device without ever collecting which sites you inspect.
• Product-interaction & usage events — a small set of app-lifecycle events such as app launches, the app moving to the foreground or background, and sign-in / sign-out, tied to your account so we can understand real-world usage and reliability.
• Device & app context — your device's pairing ID, a per-install identifier, a per-session identifier generated at each launch, the app build number, and your iOS version.

Before anything is sent, sensitive values are redacted on-device: URLs are stripped of their query values, credentials are guarded, and domain lists are hashed rather than transmitted. These events are consent-gated — nothing is collected until you accept the in-app capture disclosure and pair your device — and they are not used for tracking: there is no advertising identifier (IDFA) and no linkage across other apps or websites. Their sole purpose is to monitor and improve the reliability and usability of the app and its capture engine.

The app collects your device's public (egress) IP address and an approximate, country-level location derived from it. This is not precise location: the app does not use GPS or iOS location services and never determines your street-level position — it only resolves your network IP to a country.

This information is used to:

• show your device's country flag in the dashboard and on captured requests; and
• authorize traffic capture from your device's current network — our proxy only accepts capture from an IP your device has recently asserted, which keeps your account from being used from other networks.

Your IP address is sent to Busymate's own backend over TLS. To turn that IP into an approximate country, our backend performs a lookup with a third-party IP-geolocation service, ip-api.com; that service is used solely to map an IP address to a country — it is not an advertiser or data broker, and we do not sell this data. This collection is consent-gated on the same in-app disclosure and pairing as everything else in this policy.

The platform enforces a single global retention window of 10 days for captured entries, applied uniformly across every workspace. A workspace's own retention setting is not independently enforced and does not change how long its entries are actually kept. Entries older than the retention window are deleted automatically. You can clear the full history of any device at any time from the dashboard's “Clear feed” control.

Traffic capture and HTTPS inspection never begin without your explicit consent. On first launch the app shows a capture disclosure you must accept, and iOS separately requires you to approve the VPN configuration and to install and fully trust the certificate profile — each an explicit, user-driven step. You can withdraw that consent at any time:

• Stop capturing — turn off the PAC / VPN control in the app, which halts all collection.
• Remove the VPN configuration — from inside the app, or in iOS Settings → General → VPN & Device Management.
• Remove the trusted certificate — in iOS Settings → General → VPN & Device Management, delete the Busymate profile (and, under Certificate Trust Settings, turn off its trust). The app cannot remove the certificate for you; this is always a user action in iOS Settings.
• Unpair the device from the dashboard to revoke its upload credential and stop further uploads.

Withdrawing consent stops future collection. To remove data that was already captured, see the next section.

To remove data that has already been collected:

• Delete your account in the app — the account screen has a confirm-gated Delete account action that permanently deletes your account and all of its data (captured entries and device records).
• Use the Clear feed button in the dashboard to wipe the active workspace's entries.
• Use the dashboard's device Unpair action to revoke the device's authentication token and stop further uploads.
• You can also request deletion by email at support@busymate.net. We will purge all entries, device records, and account data within 30 days.

Network traffic frequently contains sensitive content: passwords, OAuth tokens, session cookies, personal messages, and other private data. Only enable SSL inspection for apps you own or have explicit authorization to inspect. You are responsible for ensuring you have the right to monitor traffic on the devices you connect.

Busymate DevTools is a developer tool intended for software engineers. It is not directed at children under 13, and we do not knowingly collect data from children.

The device's authentication token is held in the iOS Keychain (ThisDeviceOnly) and the App Group container with backup exclusion, so it does not migrate via iCloud Backup to other devices. All uploads use TLS. Captured data at rest in the Supabase database is encrypted by the provider.

If you are in the EU/UK, you have the right under GDPR (or equivalent national law) to access, correct, export, or delete your data, and to lodge a complaint with your national data protection authority. To exercise any of these rights, email support@busymate.net.

If we materially change what data the app collects or how it flows, we'll update this page, raise the consent-prompt version inside the app, and ask you to re-accept the disclosure on the next launch.

Questions, deletion requests, or anything else: support@busymate.net.