Privacy Policy

Last updated: September 2026

What we collect

When you sign up, we collect your email address and a hashed password. When your application sends error events, we store the error data you transmit (stack traces, exception messages, request metadata, and any context you include).

How we use it

Your data is used solely to provide the booboo.dev error tracking service. We do not sell, rent, or share your data with third parties. Error data is displayed only to authenticated members of the project that generated it.

End-user data in error events

Error events sent by your application may contain personal data of your end users. This includes data explicitly set via SDK features such as set_user (usernames, email addresses, user IDs), as well as data that may appear in exception messages, request headers, IP addresses, and other request metadata.

You can enable server-side scrubbing on a per-project basis to automatically redact email addresses, usernames, IP addresses, and other PII from event context and request data before storage. Stack traces and error messages are not affected by scrubbing, as they are needed for debugging and issue grouping.

End-user data in events is retained according to your plan's retention period (30 days for free and starter accounts, 90 days for team accounts) and is then automatically deleted.

Third-party services

We use Stripe to process payments. Stripe has access to the billing information you provide (name, email, payment method) but does not have access to your error data. We use Scaleway, a European cloud provider, for hosting and data storage; our infrastructure runs in the European Union (the Netherlands, with transactional email sent from France).

We use Reddit advertising services in two ways: (1) a Reddit tracking pixel is loaded on our landing and documentation pages after you consent via our cookie banner, and (2) when you sign up, we send a server-side conversion event to Reddit's Conversions API that includes your SHA-256 hashed email address, IP address, User-Agent string, and — if you arrived from a Reddit ad — that ad's click identifier. This data is used solely to measure the effectiveness of our advertising campaigns.

We use Google Ads conversion tracking: after you consent via our cookie banner, Google Tag Manager and a Google tag (gtag.js) are loaded on our landing and documentation pages, and when you sign up after arriving from a Google ad, a conversion event is sent to Google Ads. This is used solely to measure the effectiveness of our advertising campaigns.

We use Tidings (tidingshq.com) for first-party product analytics, to understand which features are used and improve the service. Our pages and app send usage events (page names and product actions such as "project created") directly to Tidings; no advertising networks are involved and nothing is shared with them. Before you sign in, these events carry only a random identifier stored in your browser for up to 13 months (see Cookies). After you sign in, events carry your internal account number — pseudonymous personal data that we process on the basis of our legitimate interest in understanding and improving our own product — and the random identifier from before you signed in is merged into it, so the visit that led to your signup is not counted as a separate stranger. On our public marketing and documentation pages, Tidings also records where visitors click and how far down a page they scroll, so we can see which parts of a page are read and which are ignored. This is limited to the position of the click and a short label for the element (for example the text of a button); it never records what you type, and password fields are ignored entirely. It is not enabled in the signed-in dashboard. Analytics events never include your email address or the contents of your error data.

We use Cloudflare Turnstile on our login, signup, and password reset pages to protect against bots and abuse. When you interact with these pages, Turnstile may collect your IP address, browser metadata, and interaction data, and send it to Cloudflare for verification. This is processed under Cloudflare's privacy policy.

Data retention

Free and starter accounts retain event data for 30 days. Team accounts retain event data for 90 days. You can delete your projects and associated data at any time.

Your rights

You have the right to access, correct, delete, and export your personal data. To exercise any of these rights, email [email protected]. When you delete your account, all associated data is removed in accordance with our retention schedule.

If you are an end user whose data may be included in error events, you can contact us or the organization that operates the application to request erasure of your personal data from stored events.

Cookies

Essential cookies: We use a session cookie to keep you logged in and a CSRF token cookie for security. Cloudflare Turnstile may also set cookies required for bot protection on login, signup, and password reset pages. These are always active and required for the service to function.

Campaign attribution cookie: We set our own first-party booboo_attr cookie, valid for 30 days, which stores the campaign labels (such as utm_source) from the link you arrived on, so that a later signup can be attributed to the campaign that brought you here. These labels describe the campaign, not you, and contain no personal data. Only with your consent does this cookie additionally store the advertising network's click identifier (such as gclid or rdt_cid).

Tracking cookies: With your consent, we load a Reddit tracking pixel, Google Tag Manager, and a Google tag (gtag.js) on our landing and documentation pages. These set cookies used to measure advertising performance. You can accept or reject these cookies via the banner shown on your first visit. To withdraw consent, clear your browser cookies and localStorage, and the consent banner will reappear on your next visit.

Product analytics: Our Tidings analytics (see Third-party services) stores one random identifier, tidings_anon_id, in your browser's local storage, with a first-party cookie of the same name as the fallback. It is scoped to .booboo.dev so that a visit which begins on our marketing site and continues into the dashboard is counted once rather than twice, and it lasts 13 months, after which it is replaced with a new one. It tells us that two visits came from the same browser; it is never sent to any third party and is not used for advertising, which is why it is not consent-gated. If your browser sends a Global Privacy Control signal, the identifier is never stored at all and click and scroll recording is switched off. To clear it, clear your browser's cookies and site data for booboo.dev.

Security

All data is transmitted over HTTPS. Passwords are hashed using Django's default PBKDF2 algorithm. DSN keys authenticate event ingestion.

Data location

Your data is stored in the European Union. Payment data is processed by Stripe in accordance with their own privacy policy.

Data Processing Agreement

If your organization requires a DPA for GDPR compliance, email [email protected] and we'll send you a signed copy.

Contact

Questions about this policy? Email [email protected].