Last updated: April 28, 2026

This Privacy Policy describes how the Bubble.io Security Scanner Chrome extension ("the Extension") handles information. By using the Extension, you agree to this policy.

1. What the Extension Does

The Extension is a security auditing tool for Bubble.io applications. It operates entirely within Chrome DevTools and is intended for use only on Bubble.io apps that you own or have explicit permission to test.

2. Data We Access

When you run a scan, the Extension reads the following data from the currently inspected Bubble.io page:

• The Bubble app's configuration JSON (app ID, domain, pages, workflows, plugins, API connectors, option sets, data types)
• Network requests made by the page (used to detect PII such as email addresses and phone numbers in traffic)
• Publicly accessible API endpoints of the scanned app (Swagger/Data API)

3. Data We Do NOT Collect

The Extension does not:

• Send any scanned data to external servers
• Store any data beyond your current browser session
• Track your browsing activity
• Collect analytics, crash reports, or usage statistics
• Share any data with third parties

All processing happens locally in your browser. When you close DevTools or navigate away, no data is retained.

4. Network Requests

The Extension's background service worker may make HTTP requests on your behalf to:

• Bubble.io API endpoints of the app you are actively scanning (e.g. /api/1.1/obj/, /api/1.1/wf/)