Your debugging evidence stays local.

Who operates Debrix

Debrix is operated by Prateek Goyal in Karnataka, India. Privacy and support questions can be sent togprateek015@gmail.com.

Account and release safety data

The invite-only desktop service processes your email address to send a one-time sign-in code and operate your account. It also stores random installation, session, release-policy, and revocation records needed to enforce private access and safe updates. Passwords and hardware identifiers are not used.

Authentication is provided server-side with Supabase. Email delivery is provided by Resend. Private desktop release files are stored in Amazon S3. The desktop talks only to the Debrix API; it does not contain direct Supabase or S3 credentials.

Product analytics

Product analytics is enabled by default. Debrix sends an allowlisted set of workflow milestones and exact counts for newly recorded traces and spans, Failure promotions and resolutions, experiment attempts, verification, regressions, authentication, updates, and diagnostics. Events also include app version, coarse operating-system and release labels, actor channel, reviewed outcomes, and coarse durations.

Signed-in analytics uses your Gate account ID as the PostHog person and sets your email as a person property. Reviewed Failure lifecycle events include the exact Failure ID. Signed-out trace activity uses the random installation ID as unattributed activity and is not later merged into an account. Events never include trace or span IDs, prompts, evidence, payloads, tool inputs or outputs, URLs, paths, free-form errors, clicks, screens, DOM or network data, or session replay. Geo-location enrichment is disabled in every event and provider IP storage is disabled.

Analytics is processed by PostHog Cloud in its US region (Virginia). Debrix uses the free product-analytics tier and does not enable autocapture, session replay, surveys, heatmaps, advertising, or sale of analytics data. Raw product events are kept for no more than 12 months before deletion or aggregation.

Crash reporting

Sanitized crash reporting is enabled by default and has a separate opt-out from product analytics. Debrix can send Sentry a random event ID, fixed error marker, closed error, component, and severity codes, app version, production environment, coarse macOS label, release channel, and event time. A fixed non-routable IP sentinel prevents Sentry from deriving your location and is scrubbed to null by the hosted project.

When you are signed in, reports include only the Gate account ID and email as user identity. They do not include Failure or installation IDs, exception text, stack frames or variables, breadcrumbs, requests, URLs, paths, diagnostics, prompts, evidence, payloads, tool data, attachments, console or network capture, DOM data, or session replay. The desktop uses no automatic Sentry or browser telemetry SDK.

Reports are processed by Sentry Cloud in its US region. Server-side scrubbing, enhanced privacy, IP-address prevention, and default sensitive-data scrubbers are enforced. Events are retained for no more than 90 days; the free plan may use a shorter retention period. Changing the product-analytics setting does not change crash reporting.

Your choices and deletion

You can opt out of either provider and use the full product. You can change both choices independently in Desktop Settings → Privacy at any time. Opting out of analytics stops future delivery and deletes pending analytics rows. Opting out of crash reporting stops future reports and invalidates queued crash work. Historical provider data follows the retention periods above and applicable deletion-request handling.

You can ask for access, correction, or deletion of account data by emailing the privacy address above. Signed-in PostHog and Sentry data can be located by account ID or email for an applicable deletion request. Unattributed installation activity may not be linkable to an email after local installation identity is unavailable.

Security and changes

Debrix uses encrypted transport, private release artifacts, rotating sessions, narrowly scoped service credentials, and redacted audit records. Authentication, update, analytics, or provider failures do not delete or rewrite local forensic evidence.

This notice is effective 4 August 2026. Material changes to collected categories or purposes will be disclosed before they are enabled and, where required, will ask for a new choice.