Legal

Privacy

The short version: one IP address, kept for thirty days, and nothing else. No accounts, no cookies, no analytics, and no third party involved in any of it.

Effective date

2026-07-28

Operator

Bug Plowman

Contact

bug@thebugreport.dev

Infrastructure

Montreal, Quebec, Canada

1. What is collected

The source IP address of an upload, retained for 30 days and then discarded. It exists so that abuse — infringing uploads, CSAM, flooding — can be attributed and blocked. It is the only identifier the Service records, and it is recorded only for writes.

Ordinary web server logs for requests to these pages, containing the request path, timestamp, response code, and user agent.

The content you upload, together with its size, MIME type, and the hash of its encrypted form.

That is the complete list. There is no account, so there is no name, email, or password to collect — unless you write in to join the beta, in which case what you send in that email is what I have.

2. What is not collected

• No cookies. Not for sessions, not for preferences, not for anything.
• No analytics. No page-view counting, no fingerprinting, no session recording.
• No third-party assets. Every stylesheet, script, and image on this site is served from this domain. No font CDN, no tag manager, no embedded anything. Nobody else learns you visited.
• No tracking pixels, no advertising identifiers, no data brokers.
• No read-side IP logging tied to content. Fetching a blob is not associated with the address that uploaded it.

3. Who can see your content

This deserves precision rather than reassurance.

Donor nodes cannot. Volunteers store ciphertext with no keys and no filenames. This is what "donor-blind" means, and it is a property of the architecture rather than a promise about behaviour.

The operator can. The coordinator holds the master key and decrypts on every read — that is how an ordinary image tag works at all. Donor-blind is not operator-blind. If your threat model includes me, run your own coordinator; the software is Apache-2.0 and the setup is documented.

Anyone with the URL can, because uploads to this deployment are public by default. The upload page says so before you drop a file.

4. What it is used for

Running the Service, and nothing else. Specifically: storing and serving your content, generating resized derivatives, replicating across donor nodes, and handling abuse reports.

Your content is not sold, not licensed to anyone, not used for advertising, and not used to train machine-learning models. The Terms put that in operative language at section 6.

5. Who it is shared with

No one, with two unavoidable exceptions.

Donor node operators receive encrypted copies of content. They cannot read it. They are bound by the same terms and hold no keys.

The hosting provider operates the physical infrastructure in Montreal and can technically access the machine, as is true of any hosted service anywhere.

There is no processor, no CDN, no backup service, and no analytics vendor. Lawful compulsion — a valid subpoena or court order — is the remaining case, and it is the reason retention is thirty days rather than indefinite: data that no longer exists cannot be produced.

6. Your rights

Depending on where you live, you may have rights of access, correction, deletion, portability, or objection under laws including the California Consumer Privacy Act, Quebec's Law 25, PIPEDA, and the GDPR.

Exercise any of them by writing to bug@thebugreport.dev. There is no form and no verification hoop.

One honest limitation: because uploads are anonymous, the Service usually cannot tell which uploads are yours. To have something deleted, send the URL or content identifier. Deletion is cryptographic erasure of the per-blob key, after which the stored bytes are unreadable even though they may sit on volunteer disks for up to 30 days while the unpin propagates.

7. Children

The Service is not directed at children and collects no information from them knowingly. There is no account system through which a child could register.

8. Security

Content is encrypted per blob with XChaCha20-Poly1305 before it leaves the coordinator. Transport is TLS throughout. The federation authenticates its members with mutual TLS over a private overlay, and donor nodes expose no public ports.

No system is perfectly secure, and this one is a beta run by one person. Section 3 of the Terms explains why nothing here should be your only copy.

9. Changes

Revisions are recorded on the changelog with their effective date.

10. Contact

bug@thebugreport.dev — privacy requests, questions, and complaints all reach the same person.