How we collect, use, and protect your data.

Gotcha is operated by BRAIN 2.0 LTD, company number 15493887 (“we”, “us”, “our”). We operate the gotcha.cx website and the gotcha-feedback SDK. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

Account information

When you create an account, we collect your email address, name, and profile information from your authentication provider (e.g., GitHub).

Profile & segmentation data

During onboarding or profile updates, we may collect additional information such as company size, job role, industry, and use case. This data is used to improve the product experience and may be attached to feedback responses for segmentation purposes.

Feedback data

When end users submit feedback through the Gotcha SDK embedded on your website, we collect: the feedback content (text, ratings, votes, poll responses, NPS scores), bug reports, the element identifier, and any user id and user metadata you choose to pass. If you pass no user id, the SDK sends a random anonymous id instead.

Each submission also carries context collected by the SDK: the page URL (or the route template you set with contextPath), the browser user agent, the screen resolution and window size, the browser language, and the timezone. By default it also carries up to the last 10 JavaScript errors seen on the page (each message, source file and time, with text cut to 200 characters); the customer can turn this off with captureErrors={false}.

What the SDK stores in the end user’s browser

The SDK does not set cookies. It uses the browser’s localStorage, under keys that begin with gotcha_, for: the random anonymous id described above (created when the widget renders without a user id), submissions waiting for a network connection, and, when the customer enables them, per-element visit counts and “hide after submitting” dates.

Requests before a submission

By default the SDK sends nothing to us until someone submits, apart from earlier submissions that were waiting for a network connection. Two optional features make a request earlier: onePerUser checks whether the user has already answered, and GotchaScore fetches an element’s average rating. When the SDK draws a screenshot, it re-fetches the images, fonts and stylesheets the page already uses, from wherever the page loads them.

Screenshots

A screenshot may be attached to a feedback submission in two ways: when the end user pastes or drops an image (PNG or JPEG, up to 2 MB) into the feedback field, or when the customer enables screenshot capture and the end user chooses to attach one (for example, through the bug-report capture flow). One image is sent per submission. Screenshots are stored in a private Supabase Storage bucket scoped to the submitting project and are only viewable through short-lived signed URLs generated for authenticated members of the owning organization. When the SDK captures a screenshot itself, it captures only the visible viewport (not the full page) and does not capture any pixels outside the browser window.

Submitter email & notify-back

When the SDK is configured with the optional userEmail prop, we store the submitter’s email address alongside their response so that, when the customer marks the feedback as “Shipped” in the dashboard, we can send a one-off notification to the submitter. Notifications are HMAC-signed and include a one-click unsubscribe link that suppresses future notifications for that project/submitter pair.

Team & invitation data

When you invite team members to your organization, we collect and store the invitee’s email address, the role assigned, and the invitation status.

Usage data

We track response counts per organization for plan-limit enforcement.

Product analytics

We record a small set of first-party product events on gotcha.cx itself, so we can see which steps of signup and setup work and which do not. Each event stores the event name, a timestamp, the account and organization it belongs to where you are signed in, and any campaign tag from the link you arrived on.

On our marketing pages we also record a single anonymous event when a visitor interacts with the page, so we can tell a real visit apart from an automated crawl. That event carries no account, and is grouped by a random identifier held in your browser’s session storage, which is cleared when the browser ends the session. Neither your IP address nor your user agent is stored with the event, we set no cookies for it, we do not fingerprint your device, and none of this data is sent to a third-party analytics provider. Your user agent is used to filter automated traffic and then discarded. Your IP address is used to rate-limit the request: it is hashed before it reaches our rate-limiting provider, that hash is held only for the length of the rate-limit window, and the address itself is never written to our database.

• To provide, maintain, and improve our services.
• To process payments and manage subscriptions.
• To send transactional emails (welcome, usage warnings, notify-back).
• To enforce plan limits and prevent abuse.

We use the following third-party services to operate Gotcha:

Supabase

Authentication, database, and storage hosting.

Stripe

Payment processing.

Resend

Transactional email delivery, including bug-report emails to the customer’s team, which contain the feedback text.

Netlify

Website hosting.

Upstash

Rate limiting (Redis).

What each one receives and where it runs is on our sub-processor page. Each of these services has its own privacy policy. We do not sell your data to any third party.

When the customer promotes a response to a public-facing lifecycle state (“Planned”, “In progress”, “Shipped”), the curated title of that response becomes publicly visible on the customer’s roadmap page (e.g. gotcha.cx/roadmap/<slug>). Only the title is surfaced — the full response content, submitter email, metadata, user agent, URL, and any screenshots remain private to the customer’s dashboard. Anonymous visitors can cast upvotes on roadmap items. To count one vote per visitor, we store a salted SHA-256 hash of the visitor’s IP address and browser family and platform (for example “chrome/mac”); the IP address itself is not stored in our database. It is sent to our rate-limiting provider (Upstash) to cap how many votes one address can cast.

You may configure webhooks to send feedback data to external URLs (e.g., Slack, Discord, or custom endpoints). When webhooks are enabled, feedback data is delivered to the URLs you specify. You are responsible for the security and privacy practices of those endpoints. We validate webhook URLs to prevent delivery to private networks.

We use essential cookies for authentication session management. We also use short-lived httpOnly cookies to securely process team invitation links. We do not use tracking or advertising cookies. The Gotcha SDK does not set any cookies on your end users’ browsers; what it keeps in localStorage is listed in section 02.

We do not delete data on a schedule. Account data and feedback responses are kept until they are deleted in one of these ways:

• One end user. The account holder calls DELETE /api/v1/users/:id with the project’s management key. This deletes that user’s responses and screenshots in the project and removes their id, email, name and metadata from linked bug tickets. An address on the project’s notify-back unsubscribe list stays there so the opt-out keeps working. GET /api/v1/users/:id/export returns the user’s responses first, if needed.
• One project. An organisation owner deletes it in the dashboard. Its responses, bug tickets, webhooks, keys and screenshots are deleted with it.
• A whole account. Email us. There is no self-serve account or organisation deletion yet; we delete it by hand.

Copies in our database provider’s backups expire on that provider’s backup cycle. Customers who need a signed commitment can sign our Data Processing Agreement.

We protect your data using industry-standard measures including encrypted connections (TLS), API keys stored as hashes (a small number of older keys are still being migrated), and access controls. However, no method of transmission over the Internet is 100% secure.

If you are in the European Economic Area, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing of your data.
• Data portability.

Gotcha provides API endpoints for programmatic data export and deletion of end-user data scoped to individual projects. Account holders call them with the project’s management key to fulfil data subject requests from their own users.

To exercise your own rights, or for requests not covered by the API, contact us at info@braintwopoint0.com.

Our services are not directed to children under 13. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last updated” date.

If you have questions about this Privacy Policy, contact us at info@braintwopoint0.com.