Privacy Policy

While the Busymate DevTools VPN tunnel is active, the app records:

• Request URLs, HTTP method, status code, request and response headers, byte counts and timing for every connection your device makes through the tunnel.
• Request and response bodies, but only for the HTTPS domains you explicitly add to the SSL-proxy list inside the app, and only when you switch decryption on (it is off by default). Domains not on that list are observed only at the TLS-handshake level (the host name from the SNI, plus timing); their contents are never decrypted. Certain pinned system and Busymate domains are always passed through untouched.
• Connection metadata: the device's public (egress) IP address, the device model, Android version, app version, and a per-install device identifier generated locally at first launch.

Root vs. non-rooted decryption scope. On a standard (non-rooted) Android device, HTTPS decryption is limited to this app's own traffic and any other app that opts in to user-installed certificates — Android does not let a user-installed CA decrypt other apps by default. System-wide HTTPS decryption of other apps requires a rooted device on which you install the certificate into the system trust store yourself. Either way, decryption only ever happens for the domains you add to the SSL-proxy list.

We do not use GPS or Android location services, the microphone, camera, photos, contacts, SMS, or call data. The app contains no advertising SDKs and no third-party analytics SDKs; the only usage and diagnostic data we collect are the first-party signals described below under “Diagnostics & app-health data.”

To let you inspect your own HTTPS traffic, Busymate DevTools uses two things: a root certificate you install and trust on your device, and an on-device VPN. We describe both here accurately so there is no ambiguity about what happens on your device versus on our servers.

The root certificate. The shipped app embeds no certificate and no private key of any kind. During setup, the app fetches its HTTPS-debugging root certificate from Busymate's own server over an authenticated TLS connection — it is not generated locally on your device. The same root is common to installations (shared) rather than generated per device, and the corresponding key is held on our server, transmitted only to authenticated installations of our own app. We serve the root from the server so that if you delete and reinstall the app you do not have to repeat the certificate-install and trust steps.

The certificate is used solely to decrypt traffic on your own device for inspection in this developer tool, and only for the HTTPS domains you explicitly add to the SSL-proxy list. It is installed only with your explicit consent through Android's standard “install a CA certificate” flow, and you can remove it at any time from Android Settings (see “Your consent & how to revoke it” below).

The VPN. Capture runs through an on-device VPN (Android's VpnService, a local packet tunnel). In its default mode it captures only this device's own traffic and does not route your traffic through Busymate's servers — the interception happens locally, on your device, and packets continue directly to their real destination. The request and response data the app records is then uploaded to your own private dashboard, as described in the next section; that upload — not the browsing itself — is what leaves the device.

Optional Wi-Fi proxy mode. As an alternative to the on-device VPN, you can configure the app to route this device's traffic through a Busymate proxy server (a per-device <port>.busymate.net endpoint) — for example to capture from a device that cannot run a local VPN. This mode is optional and off unless you turn it on; when it is on, interception happens on that proxy instead of on your device, and the same captured records flow to your dashboard.

Captured traffic is uploaded over TLS to the Busymate dashboard, which runs on Supabase Cloud (PostgreSQL + Realtime) and is reached through api.busymate.net. The dashboard is private to your account — every request carries your device's own credential and is row-level-security-scoped, so only authenticated users on your team can view it. Supabase acts as our managed-database and authentication processor on our behalf. We do not sell your data, and we do not share it with advertisers or analytics networks.

Besides the dashboard, Busymate exposes your account's data through a REST API, a realtime WebSocket, and an MCP (Model Context Protocol) server at mcp.busymate.dev, so you can connect an AI agent or client of your choice (for example Claude, Cursor, VS Code, or ChatGPT) to work with your captures on your behalf. This is optional — nothing reaches an external agent unless you connect one and authorize it.

• Authorization. Access uses OAuth 2.1 (authorization code + PKCE) — there is no pasted API key and no shared secret. The token an agent receives is scoped to your own account and to your role's permissions: an agent can only read or change what you could do yourself in the dashboard, destructive actions require an explicit confirmation, and every tool call is written to your account's audit log.
• Your chosen client. We do not send your data to an MCP/agent vendor ourselves; your chosen client connects directly to our server with your authorization, and whatever that client then does with the responses (including sending them to its own AI provider) is governed by that client's and provider's own privacy terms, not ours.
• Revoking access. You can disconnect a client on its side and revoke its token from your account at any time, which immediately stops further access.

You create your Busymate account and sign in through Supabase Auth, our authentication processor. The Android app supports:

• Google Sign-In — using Android's Credential Manager. Google returns a signed identity token from which we receive your email address and, if available, your name (stored as your account display name). Google is the identity provider for this method.
• Email & password — a standard email/password sign-in. Existing Busymate Pro users may alternatively be signed in through Busymate's own single sign-on, which is brokered by our backend at api.busymate.net.

This identity data is used solely to authenticate you and identify your account. To capture traffic, the app then pairs your device with your account and receives a device-scoped access token, which is stored encrypted on the device (see “Security” below).

While the capture VPN is running, Android shows a persistent foreground-service notification so you always know capture is active; this uses the notifications permission and does not leave your device.

Separately, if you enable remote notifications, the app can register a device push token with Firebase Cloud Messaging (FCM), Google's push service, and store it under your account so we can deliver notifications you've asked for (for example, capture alerts). The push token is an opaque device identifier; it is not used for tracking or advertising. You can turn notifications off at any time in Android Settings, which revokes delivery.

The app includes an optional in-app assistant that can answer questions about your captures and your account. It is off unless you open it and use it. When you do, the message you type — and any files you choose to attach (images or PDFs) — are sent over TLS to Busymate's own backend and processed by an AI model to produce a reply, tied to your account. Attachments are stored under your account. We do not use these messages or attachments for advertising, and we do not sell them. If you never open the assistant, none of this data is collected.

To keep the app reliable, the app sends first-party operational signals about its own health to Busymate's own backend (over TLS to api.busymate.net, under your device's own credential). This is first-party data — not a third-party analytics or advertising SDK — and it is never sent to any advertiser, data broker, or other third party. These signals are:

• Device online status & capture state — a periodic heartbeat and the current capture / proxy mode, so the dashboard can show whether your device is connected and capturing.
• Per-request capture outcome — alongside each captured entry, whether it was decrypted, passed through, or dropped, so you can see why a given request was or wasn't inspected.

There is no advertising identifier and no cross-app or cross-site tracking. We do not integrate any third-party analytics, crash- reporting, or advertising SDK.

The app requests no location permission and does not use GPS or Android location services — it never determines your street-level position. The app does record your device's public (egress) IP address as part of connection metadata (see “What data is captured”); an IP address can indicate an approximate, country-level region, but the app does not use precise location.

The app requests only the permissions it needs to run the capture VPN:

• INTERNET — to upload captured records to your dashboard and reach the backend.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_SPECIAL_USE— to run the capture tunnel as a foreground service so Android does not kill it while you're debugging.
• POST_NOTIFICATIONS — to show the persistent capture-running notification and any notifications you enable.
• The VPN permission — you grant this yourself through Android's standard VPN-consent dialog the first time you start capture; Android then binds our VpnService as your active VPN.

The app requests no location, contacts, camera, microphone, storage/media, SMS, phone, or Bluetooth permissions.

The dashboard's default retention is 30 days. Workspaces can override this to a shorter window. Entries older than the retention window are deleted automatically. You can clear the full history of any device at any time from the dashboard's “Clear feed” control.

Traffic capture and HTTPS inspection never begin without your explicit consent. On first launch the app shows a capture disclosure you must accept, Android separately requires you to approve the VPN configuration, and you must install and trust the certificate profile yourself — each an explicit, user-driven step. You can withdraw that consent at any time:

• Stop capturing — turn off the capture / VPN control in the app, which halts all collection.
• Remove the VPN — in the app, or in Android Settings under Network & internet → VPN.
• Remove the trusted certificate — in Android Settings under Security → Encryption & credentials → Trusted credentials (User tab), or via “Clear credentials.” The app cannot remove the certificate for you; this is always a user action in Android Settings.
• Unpair the device from the dashboard to revoke its upload credential and stop further uploads.

Withdrawing consent stops future collection. To remove data that was already captured, see the next section.

To remove data that has already been collected:

• Delete your account in the app — the account screen has a confirm-gated Delete account action that permanently deletes your account and all of its data (captured entries and device records).
• Use the Clear feed control in the dashboard to wipe the active workspace's entries.
• Use the dashboard's device Unpair action to revoke the device's token and stop further uploads.
• You can also request deletion by email at support@busymate.net. We will purge all entries, device records, and account data within 30 days.

Network traffic frequently contains sensitive content: passwords, OAuth tokens, session cookies, personal messages, and other private data. Only enable SSL inspection for apps you own or have explicit authorization to inspect. You are responsible for ensuring you have the right to monitor traffic on the devices you connect.

Busymate DevTools is a developer tool intended for software engineers. It is not directed at children, and we do not knowingly collect data from children.

The device's authentication token and your session are held in Android's Keystore-backed encrypted storage (EncryptedSharedPreferences), and the app disables Android auto-backup, so credentials do not migrate off the device. All uploads use TLS. Captured data at rest in the Supabase database is encrypted by the provider.

If you are in the EU/UK, you have the right under GDPR (or equivalent national law) to access, correct, export, or delete your data, and to lodge a complaint with your national data protection authority. To exercise any of these rights, email support@busymate.net.

If we materially change what data the app collects or how it flows, we'll update this page, raise the consent-prompt version inside the app, and ask you to re-accept the disclosure on the next launch.

Questions, deletion requests, or anything else: support@busymate.net.