DebugtWhat leaves your machine, in full.
Last changed 2 November 2026.
Debugt is a tool for looking at your own services, and what it sees is yours. This page lists everything that is sent anywhere, by the extension and by this website, and what is kept. If something is not on this page, it is not sent.
What Debugt does not collect
- Your code, your file paths, and the names of your services and projects.
- Your requests and responses, their headers and their bodies.
- Traces, hops and execution recordings.
- Usage data, crash reports or analytics of any kind. There is no telemetry.
All of that is kept in a folder on your own machine (~/.debugt), outside your repositories, and is never uploaded unless you share it yourself — a send, or what you share with your team — below, and then only encrypted. Credentials — Authorization, Cookie, API keys and the like — are redacted before a hop is recorded even there.
On the Free plan
Nothing is sent, unless you share a send or sign in to join a team. There is no account, no activation and no check: the extension works with no network at all.
With a license
The extension calls the license server to activate a license and to renew it once a day. These calls carry the following, and nothing else:
| Sent | When | Why |
|---|---|---|
| Your license key | When you activate, once | To find your license |
| A hash of your machine's id | When you activate, at each daily renewal, and when you remove a machine | To count the 3 machines a license is good on. The id itself is not sent, and the hash cannot be turned back into it |
| The extension's version | When you activate, and at each renewal | To know which versions are in use |
| Your current license token | At each renewal, and when you remove a machine | To show that this machine was activated |
As with any request over the internet, the server also sees the IP address it came from. It is used to limit repeated attempts at guessing a key, and appears in short-lived server logs.
When you share a send
Sharing is something you do, one send at a time, from its menu: nothing is shared otherwise. Before it leaves your machine, a send is redacted again with your project's current rules, then compressed and encrypted there, with a key made for it alone. The key is only in the link you copy, after the #, which browsers never send to a server: we cannot read what you share.
- Sent: the encrypted send, its size, how many days the link should last, a hash of your machine's id, the extension's version, and your license token if you have one — to count your open links against your plan.
- Kept: the encrypted send, in Cloudflare R2 storage, until the link expires — 3 days at most on Free, 7 on Pro, 14 on Team — or you revoke it, when it is deleted at once. Beside it, a record of who shared it (that machine hash, your license if any, and a hash of the IP address it came from), its size and when it expires; kept for 30 days after the link ends, so that a late visitor is told it expired rather than that it never existed.
- Opening a link — in a browser at
debugt.dev, or in Debugt — downloads the encrypted send and decrypts it on that device, with the key from the link. Anyone with the whole link can open it until it ends.
When you share with your team
Teams are in beta. Sharing with a team is something you do, item by item: a saved request, a canvas, an environment profile, an override or a project's redaction rules, each shared when you choose to. Each is encrypted on your machine, with AES-256-GCM, under a key that only your team's machines hold — it is never sent to us unsealed, and we cannot read what your team shares. A profile's personal variables go by name, never by value.
- Sent to sync, our team service: your email address, to join and to show your teammates who is in the team; your machine's public key; and the team's key, sealed by your teammates' machines to each other's public keys, so that only those machines can open it.
- Kept by sync: each team's name and number of seats; its members' email addresses and roles; invites, with the email each is for and whether it was taken; each member machine's public key; the sealed copies of the team's key, one for each machine, and one for the owner's recovery key; and, for a team that was bought, its subscription's id, what it is paid through, and whether it was cancelled or refunded.
- Sent to content, and kept there: each encrypted item, with what is needed to keep the team's machines in step — its id and kind, its version, the email of whoever changed it last and when, and its size. An item deleted from the team is kept, encrypted, for 30 days so it can be restored, then removed; a project no longer shared with the team is removed with everything in it.
- Kept by the license server: your account — your email address — each machine signed in to it, and that machine's public key, which the license server signs so your teammates' machines can check it before sharing the team's key with it.
These are kept in MongoDB Atlas, each service in a database of its own.
What is kept about a customer
- Your email address, and the id Paddle knows you by.
- Your license: its plan, what it is paid through, and whether it is cancelled. The key itself is kept only as a hash — it cannot be read back, by us or by anyone who got hold of the database.
- For each machine it is active on: the hash of its id, the extension's version, and when it was activated and last renewed.
- A record of what happened to the license — made, activated, removed from a machine, renewed, cancelled — kept for thirteen months.
- For a team you bought: the team's name, its number of seats, what it is paid through and whether it is cancelled, and which account bought it — told to sync, so it can make the team and keep its seats.
Payments
Debugt Pro and Team are sold through Paddle, which acts as the reseller: you pay Paddle, and Paddle's own privacy policy covers what it collects to take the payment and work out tax. Debugt Labs never receives your card details. Paddle tells us that a subscription began, was renewed, changed, cancelled or refunded, and your email address so that the key can be sent; for Team, also the number of seats and the name you gave the team.
Your license key, or word that your team is ready, is emailed to you through an email delivery service, which handles your address and the message in order to deliver it. We do not send marketing email.
This website
These pages load no analytics, trackers or fonts from anyone else, and set no cookies until you sign in to your account: that sets one, which keeps you signed in for thirty days and does nothing else. The one exception is the checkout: pressing Buy or Buy Team loads Paddle's checkout from paddle.com, which may set cookies of its own to take the payment and prevent fraud.
Your choices
- To stop the license calls, remove the license from the machine under Settings → License. Debugt goes on working, on the Free plan.
- To see, correct or delete what is kept about you, write to us. Deleting an account ends its license.