Privacy Policy

While the Busymate DevTools VPN tunnel is active, the app records:

• Request URLs, HTTP method, status code, request and response headers, and timing for every connection your device makes through the tunnel.
• Response bodies, but only for the HTTPS domains you explicitly add to the SSL-proxy list inside the app. Domains not on that list are observed only at the TLS-handshake level (host name + timing); their contents are never decrypted.
• Connection metadata: the device's public IP address (used only to display its country flag in your dashboard), iOS version, app version, and a per-device UUID generated locally at first launch.

We do not record microphone, camera, location, photos, contacts, health, or any system data outside the network tunnel. The app contains no advertising SDKs and no third-party analytics SDKs.

Captured traffic is uploaded over TLS to the Busymate dashboard, which runs on Supabase Cloud (PostgreSQL + Realtime). The dashboard is private to your account — only authenticated users on your team can view it. Supabase acts as our managed-database and authentication processor on our behalf. We do not sell your data, and we do not share it with advertisers or analytics networks.

Two features involve additional, named sub-processors — our AI assistant (BusyBro) and Sign in with Apple. These are described in the sections below.

BusyBro is an optional AI assistant you can chat with inside the app and dashboard to help interpret your captures. When you send a message to BusyBro, the following is sent to our AI sub-processor, Anthropic (the provider of the Claude models), so it can generate a reply:

• The text of your chat messages and BusyBro's replies.
• Minimal device context to ground the answer: the device model, OS version, and app build. BusyBro is only sent the specific capture data you reference or that is needed to answer your request — it does not stream your entire traffic history.

Your conversations are persisted in your own account (in the busybro_threads store) so you can revisit them, and they are deletable in-app at any time. The data sent to Anthropic is used only to generate the reply you asked for — it is not used to train AI models and not used for advertising.

You can create your Busymate account with Sign in with Apple (SIWA) or another supported single sign-on (SSO) provider. When you do, we receive the identity data the provider returns to complete account creation:

• Your email address(or Apple's private relay address, if you choose to hide your email).
• Your name, if the provider shares it — stored as your account display name (profiles.display_name).

This identity data is used solely to authenticate you and identify your account. Authentication is handled by Supabase Auth, our authentication processor. Apple is the identity provider for Sign in with Apple.

If you enable notifications, the app registers a device push token with Apple Push Notification service (APNs) and stores it under your account so we can deliver notifications you've asked for (for example, capture alerts or assistant responses). The push token is an opaque device identifier; it is not used for tracking or advertising. You can turn notifications off at any time in iOS Settings, which revokes delivery.

The dashboard's default retention is 30 days. Workspaces can override this to a shorter window. Entries older than the retention window are deleted automatically. You can clear the full history of any device at any time from the dashboard's “Clear feed” control.

To remove captured data:

• Use the Clear feedbutton in the dashboard to wipe the active workspace's entries.
• Use the dashboard's device Unpair action to revoke the device's authentication token and stop further uploads.
• Delete your BusyBro conversations in-app — removing a thread deletes its messages from your account.
• To delete your account entirely, email support@busymate.net. We will purge all entries, device records, AI conversations, and account data within 30 days.

Network traffic frequently contains sensitive content: passwords, OAuth tokens, session cookies, personal messages, and other private data. Only enable SSL inspection for apps you own or have explicit authorization to inspect. You are responsible for ensuring you have the right to monitor traffic on the devices you connect.

Busymate DevTools is a developer tool intended for software engineers. It is not directed at children under 13, and we do not knowingly collect data from children.

The device's authentication token is held in the iOS Keychain (ThisDeviceOnly) and the App Group container with backup exclusion, so it does not migrate via iCloud Backup to other devices. All uploads use TLS. Captured data at rest in the Supabase database is encrypted by the provider.

If you are in the EU/UK, you have the right under GDPR (or equivalent national law) to access, correct, export, or delete your data, and to lodge a complaint with your national data protection authority. To exercise any of these rights, email support@busymate.net.

If we materially change what data the app collects or how it flows, we'll update this page, raise the consent-prompt version inside the app, and ask you to re-accept the disclosure on the next launch.

Questions, deletion requests, or anything else: support@busymate.net.