GNOK BUG · DATA AND PRIVACY

Privacy Policy

Version: gnok-bug-2026-10-20-2 · Effective October 20, 2026. Permanent copy of this version.

This policy covers gnokbug.com, app.gnokbug.com and identity processing for Gnok Bug. Workspace content is controlled by the organization that supplies it.

What we collect and why

Gnok, Inc. collects account names, business email addresses, usernames, password hashes, multi-factor and passkey registration information, organization membership and access settings to provide identity and access. We record the terms version accepted, time, source IP and browser information as evidence of acceptance and to prevent abuse.

Workspace content includes issues, descriptions, comments, attachments, project and workflow settings, history and member or guest identifiers. We process it to provide Bug on the organization’s instructions. Administrators determine content, membership and sharing. We also process request IP addresses, browser information, timestamps, application errors, security and audit events, delivery and bounce information, and support correspondence to operate, secure and support the Service. Only give us information needed for these purposes; the Terms restrict specially regulated and high-risk data.

Who can see content

Members and guests can see content within permissions granted by their organization. Notifications may send permitted issue content to configured recipients. Authorized support personnel and providers may access information as needed to operate, secure and support Bug. Information may be disclosed when required by law, to protect rights and safety, or as part of a business transfer subject to continuing protections. We do not sell personal information or share it for targeted advertising. Recipients and external services may retain copies after access is revoked or a workspace is deleted.

Providers and location

We use Amazon Web Services for US-hosted infrastructure, encrypted database and object storage, content delivery, operational monitoring and transactional email. Authentication and email delivery support your Bug workspace. If you enable external integrations or AI features, the configured providers receive the content those features require. Your administrators should review destinations and provider terms before enabling them. Contact support@gnok.com for a processing agreement and applicable provider details before using Bug where your organization requires them. This policy does not claim a particular international transfer mechanism or regulatory certification.

Cookies and browser storage

The public website has no advertising or analytics cookies and loads its fonts and assets from the same site. Application sign-in uses essential cookies: __Host-gnok_bug_session identifies an opaque server-side session, and __Host-gnok_bug_flow binds the sign-in callback to your browser. Gnok’s hosted identity pages use essential verification, CSRF, authentication and MFA flow cookies. Infrastructure may use security cookies to prevent abuse.

Bug uses browser storage for interface preferences and a non-secret session identity marker that keeps tabs consistent. In the deployed hosted sign-in flow, OAuth access and refresh tokens are encrypted on the server; they are not stored in browser local storage. Blocking essential cookies may prevent sign-in. The public site does not use cross-site tracking.

Retention and deletion

Workspace content is retained while the workspace is provided. A free trial lasts 30 days from first sign-in after approval. Expired trial content is retained for at least 30 more days for an administrator to request an export or paid access; later deletion is coordinated with notice. Expiry alone does not immediately delete content. Ordinary deletion requests require verification and operator processing, including attachment objects. Account information needed for legal or security obligations may be retained as described below.

Bug application logs are retained for 30 days. Signup delivery records are retained for up to 30 days after creation once completed or failed, and abandoned unverified organization signups are removed seven days after their verification window expires, subject to pending notices. Terms acceptance and workspace audit history normally remain with the account or workspace. Security investigations, fraud prevention and legal obligations may require limited information to be kept longer.

Encrypted database backups rotate separately from live data; previous object versions can also persist after live content deletion. Automated Aurora backups have a 14-day retention window and previous attachment object versions expire after 30 days. Operator-managed recovery snapshots may remain longer and require separate review when completing a deletion request. We disclose any applicable retained-copy exception when confirming deletion. Backups are restricted to recovery purposes. If restoring a backup, we must reapply completed deletion requests before restoring user access. We retain a minimal record of deletion and any records legally required; copies already sent to recipients are outside our deletion controls.

Your choices and requests

Workspace administrators manage members, guests and sharing. Ask your organization administrator about workspace content and its lawful use. You can contact support@gnok.com to request access, correction, export or deletion, or exercise applicable privacy rights. We verify authority before disclosing or changing information and coordinate requests involving organization-controlled content. Depending on your location and applicable law, you may have additional rights to object, restrict processing or complain to a supervisory authority.

Bug is for business users aged 18 or older and is not directed at children. We will post policy updates with a version and effective date and notify administrators of material changes. Contact: Gnok, Inc., support@gnok.com; security concerns: security@gnok.com.