What leaves your machine, and what doesn't

During indexing: While you are signed in, the extension indexes the project you have open: once when VS Code starts, and again for each file you open or save. The text of each file, up to 50 KB per file and up to 500 files per run on any plan (Free keeps 200), is sent over HTTPS to DebugAI servers, where it is chunked and sent to Voyage AI for embedding generation. Code chunks and their embeddings are stored in your project index on our servers. Only files inside the workspace you have open are sent. Environment files (.env and the like), key and certificate files, and build or dependency folders are never sent, and neither is your git history. From extension 2.12.0, the extension tells you this the first time it runs, and the debugai.autoIndex setting turns it off. With it off, nothing is indexed until you run an Index command or a scan. Extension 2.11.0 and earlier index the same way and have no such setting and no notice.

During debugging: The error message and a relevant code snippet (up to 30 lines either side of your cursor) are sent for AI analysis, with the full path of the file you are in. So are a few facts about the project that the error message cannot carry: the dependency names and versions your manifest files (package.json, requirements.txt, pyproject.toml and the like) declare, which kinds of manifest were found (not where they are), the names of the Python modules in your workspace, whether a virtual environment or a node_modules folder is present, and the path of the Python interpreter VS Code has selected. File contents beyond the retrieved snippet and commit history are never sent. From extension 2.12.0 nothing about your git repository goes with a debug: no branch name, no changed file names and no diff text. Extension 2.11.0 and earlier sent the current branch name, up to 20 changed file names and counts of added, modified and deleted files, and up to 3,000 characters of git diff with each debug; our API received them and discarded them, and none of it reached the AI.

During a scan or Debug in Browser: A Proactive Scan indexes its files even with debugai.autoIndex off, sends their text to Claude (or OpenAI when Claude is unavailable) for review, and keeps each finding's file, line and severity. Debug in Browser (closed beta) sends a failed request's method, URL, status, headers and bodies; credential headers are removed first and bodies pass through secret redaction.

From an AI agent: The standalone MCP server (@debugai/mcp) and the one bundled with the extension send the same error text, up to three source files the stack trace names (40 lines either side of the failing line; a code snippet the agent passes itself replaces them), the file path, and the project facts above except the interpreter path, plus whether a .env file exists (never its contents). When the agent supplies one, the request also carries the command that reproduces the failure and the output expected once it is fixed.

Everything else: No code is sent except as described above. Outside of indexing and debugging, the extension asks DebugAI for your plan and usage and for product notices (when VS Code starts, after each debug, and at most every 15 minutes), and reports counts of its own errors. None of that includes your code or file names. While VS Code telemetry is on, the extension also sends product events (no code and no file names) to PostHog. No telemetry on your codebase. The extension keeps your API key in VS Code's encrypted SecretStorage; the MCP server keeps its own copy in a file only you can read (~/.debugai/config.json, mode 0600 on macOS and Linux).

01 Who we are

DebugAI ("we", "us", "our") operates the website at debugai.io, the DebugAI VS Code extension, and related APIs. This policy covers all of these services (collectively, the "Service").

For privacy questions, contact us at privacy@debugai.io.

02 Data we collect

Category	What	Why
Account	Email, name (via Clerk — Google, GitHub, or email sign-in)	Authentication, daily usage tracking, support
Indexed code chunks	Code chunks from files in the workspace you have open in VS Code (indexed automatically while you are signed in, or when you run an Index command), plus their embeddings	Stored in your project index on our servers to retrieve relevant snippets when you debug. Scoped to your account — never shared with other users.
Debug requests	Error message + relevant code snippet per request	Sent to AI for analysis. Cached short-term, then deleted
Git context	From extension 2.12.0: none. Extension 2.11.0 and earlier sent the current branch name, up to 20 changed file names and counts of added, modified and deleted files (never file contents or commit history), and up to 3,000 characters of git diff, with each debug.	Sent by those older versions only when a git repository was detected. Our API received these fields and discarded them: nothing read them, they were not stored, and they did not reach the AI.
Project facts	With each debug: the dependency names and versions your manifest files declare, which kinds of manifest were found (not where they are), the names of Python modules in your workspace, whether a virtual environment or node_modules folder exists, and the path of the Python interpreter VS Code has selected (never file contents)	So the answer does not tell you to install a package you already declare, or name a method your pinned version does not have. Used to answer the request, not kept with your account.
Debug history and error memory	The error text of each debug (credentials removed before it is stored), the path of the file you debugged and the files its stack trace names, the fixes offered, which one you applied, and whether it worked	Your dashboard history, and recognising an error your project has hit before so the fix that worked can lead the answer. Kept with your account.
Billing	Your plan, subscription status and the customer and subscription ids Paddle gives us. Your card number and security code go to Paddle and never reach us. Paddle's payment notifications can include the card's brand, last four digits, expiry date and the cardholder's name, and we keep each notification for audit.	Charging you, giving you the plan you paid for, and billing emails
Usage analytics	Product events: debug sessions, fix applied, limit hit — no code content and no file names. From the extension, only while VS Code telemetry is on.	Product improvement, feature prioritization
Error tracking	Stack traces from DebugAI itself — never from your code	Bug fixing and reliability

03 What we do NOT collect

This section describes extension 2.12.0 and @debugai/mcp 2.7.0. What earlier versions did differently is listed once, under "Earlier versions" at the end of it.

Your full filesystem — indexing and scans send only files inside the workspace you have open, and never environment files, key files or dependency folders. A debug sends the code around your cursor in whichever file is focused, except an environment file, a key or certificate file, or a credential file (such as .npmrc, .netrc, .git-credentials, or anything under .ssh or .aws), for which it sends no code, and except a window that holds a private key. Debug in Browser resolves a stack frame only to a file inside the workspace or the git repository that holds it. The MCP servers read only inside one project root: the folder or git repository the agent names, otherwise the folder VS Code has open (the bundled server) or the git repository or folder the standalone server started in. Your home directory, the folders above it and the filesystem root are never one, and the Windows profile as WSL shows it (/mnt/c/Users/<name>) is not one either.
Git history, branch names or diff text — from extension 2.12.0 a debug sends nothing from git. A Proactive Scan uses git only to choose files, and sends their paths, sizes and a recency score, never history, branch names or diffs. Extension 2.11.0 and earlier sent the branch name, up to 20 changed file names, counts and up to 3,000 characters of git diff with each debug; our API discarded all of it unread.
API keys or secrets — the extension keeps your DebugAI API key in VS Code's encrypted SecretStorage. The MCP server keeps its own copy in a file only you can read (~/.debugai/config.json, mode 0600 on macOS and Linux). Neither is written into a client config.
Telemetry on your code — none. Outside indexing and debugging the extension sends no code and no file names; it checks your plan, usage and product notices, reports counts of its own errors, and, while VS Code telemetry is on, sends product events to PostHog.
Your data shared with other users — code chunks in your project index are scoped to your account only.

Earlier versions. Extensions up to 2.11.0 did more than the above. They sent the branch name, up to 20 changed file names, counts and up to 3,000 characters of git diff with each debug (our API discarded it unread). They sent the code around the cursor of whichever file was focused, an environment file included, and our API redacts only the error text, so a focused .env was sent as it stood. They indexed a file opened from outside the workspace as part of the project, and a scan could take files from a parent or sibling git repository. The MCP servers did more too: the one bundled with the extension read whatever folder VS Code had open, and @debugai/mcp up to 2.6.0 read whatever folder it was started in, and both accepted a project root above your home directory or, under WSL, the Windows profile, so a server started in a home directory or the filesystem root with no project named could read files under it. Updating the extension and the MCP server gives the behaviour described above.

04 How your data is processed

Workspace indexing

While you are signed in, the extension indexes your open workspace when VS Code starts and each file you open or save (or you run "Index Entire Workspace" yourself). From extension 2.12.0, the debugai.autoIndex setting turns the automatic part off; earlier versions have no such setting.
The extension reads each file (never environment or key files) and sends the content over HTTPS to DebugAI servers.
The server chunks the content and sends chunks to Voyage AI for embedding generation.
Embeddings and code chunks are stored in your project index in our database, scoped to your account.

Debug analysis

You press Ctrl+Alt+D (Cmd+Alt+D on a Mac) in the editor, or right-click and pick a DebugAI command.
The extension takes the error message and up to 30 lines of code either side of your cursor, with the project facts above.
This data is sent over HTTPS to the DebugAI API.
The engine embeds the error text with Voyage AI to search your project index for related code.
The API forwards the request, with that related code, to Claude (Anthropic) for analysis, or to OpenAI when Claude is unavailable.
The response is cached short-term, then automatically deleted.
The fix is returned to your VS Code extension as a diff preview.

05 Subprocessors

We use the following third-party services to operate DebugAI:

Service	Category	Region
Anthropic	AI inference	United States
OpenAI	AI inference, only as a fallback when Anthropic is unavailable. It receives the same request.	United States
Voyage AI	Code embeddings	United States
Clerk	Authentication	United States
Paddle	Payments. Paddle is the merchant of record: it takes the payment and handles sales tax.	United Kingdom
PostHog	Product analytics	United States
Sentry	Error monitoring	European Union (Germany)
Railway	Infrastructure hosting (API, engine, database)	United States
Vercel	Website hosting	United States
Resend	Sending email (account, billing and product mail)	United States
Loops	Our newsletter list	United States

06 Data retention

Indexed code chunks: Retained while your project index is active. We delete it when you ask us to: email privacy@debugai.io from the address on your account.
Debug request cache: Short-term cache, automatically deleted.
Account data: Retained while your account is active. We delete it when you ask us to: email privacy@debugai.io from the address on your account.
Debug history and error memory: Kept with your account, with no fixed expiry, so your history and the memory of fixes that worked stay available. Deleted with the rest of your account data on request.
Analytics events: Retained per PostHog's data retention policy.
Error tracking: Sentry receives a report when our service fails: the error, the page or endpoint it happened on, and which app version made the request. Request contents, your code, credentials and email addresses are removed before the report is sent. Sentry deletes reports after at most 90 days.

07 Your rights

If you are in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, you have the following rights:

Access — Request a copy of the personal data we hold about you.
Rectification — Request correction of inaccurate data.
Deletion — Request deletion of your personal data.
Portability — Request your data in a machine-readable format.
Objection — Object to processing based on legitimate interests.
Restriction — Request restricted processing while we resolve a complaint.

To exercise any of these rights, email privacy@debugai.io. We will respond within 30 days.

08 Legal basis for processing (GDPR)

Contract performance: Account data and debug requests are processed to provide the Service you signed up for.
Legitimate interest: Error tracking, and the product events the extension reports, help us improve reliability and user experience.
Consent: Analytics on this website, which stays off until you choose "Accept all" on the cookie banner, and marketing email. You can withdraw it at any time.

09 Cookies and local storage

We use strictly necessary cookies for signing in (Clerk). We do not use advertising cookies and we do not sell data.

Website analytics is off until you choose "Accept all" on the cookie banner. With it on, PostHog keeps an anonymous visitor id in this browser's local storage (not in a cookie), and we keep which campaign link first brought you here, so we can tell which of our posts and listings are worth writing. We strip the query string from every address before it reaches PostHog.

Choosing "Necessary only", now or later through "Cookie preferences", stops analytics at once and deletes both. The browser keeps two small records of the refusal, ours and PostHog's own, so we do not ask again and PostHog stays off. A few other items are preferences and not tracking, such as dismissed banners and which changelog entries you have seen.

10 Security

All data is transmitted over HTTPS/TLS. The extension keeps your API key in VS Code's encrypted SecretStorage; a key starting with dbg_ that you type into the debugai.apiKey setting sits in your settings.json until DebugAI first uses it, then moves there. The MCP server keeps its own copy in ~/.debugai/config.json, a file only you can read (mode 0600 on macOS and Linux). Server infrastructure is hosted on Railway with managed PostgreSQL and Redis.

11 Children's privacy

DebugAI is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12 Changes to this policy

We may update this policy from time to time. We will notify users of material changes via email or an in-app notice. The "Last updated" date at the top reflects the most recent revision.

13 Contact

For privacy-related questions or data requests:

Email: privacy@debugai.io
General support: support@debugai.io
Website: debugai.io