What leaves your machine

This page is a plain summary. The privacy policy is the full statement and wins wherever the two differ. Both describe extension 2.12.1 and @debugai/mcp 2.7.0. Older versions sent more, and the policy lists what.

IndexingCopy Anchor Link

While you are signed in, the extension indexes the project you have open: when VS Code starts, and again for each file you open or save.

• Sent: the text of each source and config file in the workspace, up to 50 KB a file and up to 500 files a run. The free plan keeps 200 files per project.
• Where it goes: over HTTPS to DebugAI's servers, which split it into chunks and send the chunks to Voyage AI to be embedded. The chunks and embeddings are stored in your project index, scoped to your account and never shared with other users.
• Never sent: .env files and the like, key and certificate files, build and dependency folders, files outside the workspace, and your git history.
• To turn it off: set debugai.autoIndex to off. Then nothing is indexed until you run an Index command or a scan.

A debug from the editorCopy Anchor Link

• Sent: the error message, up to 30 lines of code either side of your cursor, and the full path of the file you are in.
• Also sent: facts the error cannot carry. These are the dependency names and versions your manifest files declare, which kinds of manifest exist (not where), the names of your Python modules, whether a virtual environment or node_modules folder exists, and the path of the Python interpreter VS Code has selected. They are used to answer the request and not kept with your account.
• Where it goes: the DebugAI API. Voyage AI embeds the error to search your project index, and Claude (Anthropic) analyses it, or OpenAI when Claude is unavailable.
• Never sent: nothing about your git repository (no branch name, no changed file names, no diff), and no file contents beyond the code around your cursor.
• No code at all: when the focused file looks like it holds credentials (an environment file, a key or certificate, .npmrc, .netrc, .git-credentials, anything under .ssh or .aws), or when the lines around your cursor hold a private key. The error text is still sent, and the status bar says the code was not.

The answer is cached for a short time, then deleted. What DebugAI keeps from a debug is under What is kept.

A Proactive ScanCopy Anchor Link

A scan indexes the files it picks, even with debugai.autoIndex off, and sends their text to Claude (or OpenAI when Claude is unavailable) for review. It uses git only to choose files, and sends their paths, sizes and how recently they changed, never history, branch names or diffs. DebugAI keeps each finding's file, line and severity.

Debug in BrowserCopy Anchor Link

Debug in Browser (closed beta) sends a failed request's method, address, status, headers and bodies. Credential headers are removed first, and the bodies go through secret redaction.

From an AI agentCopy Anchor Link

The standalone MCP server and the one built into the extension send:

• The error text.
• Up to three source files the stack trace names, read only inside the project, as the 40 lines either side of the failing line (a short file goes whole). A code snippet the agent passes replaces them.
• The file path, and the same project facts as the editor, without the interpreter path.
• Whether a .env file exists. Never its contents.
• When the agent gives them, the command that reproduces the failure and the output expected once it is fixed. DebugAI never runs the command.

The project is the folder or git repository the agent names, or else the folder VS Code has open (the extension's server) or the repository or folder the standalone server started in. Your home folder, the folders above it, the filesystem root, and the Windows profile as WSL shows it (/mnt/c/Users/<name>) are never treated as a project. A project folder inside any of them is fine.

From ChatGPT or CodexCopy Anchor Link

The DebugAI plugin receives only what each tool call carries: the error text, and for an analysis optionally a code snippet, a file name, a language and a project name, or your report on whether a fix worked. It never receives your conversation. Before a file name is used, your home folder is removed from it and only its last three parts are kept. Credentials DebugAI recognises in the error text are removed before it is analysed or stored. A code snippet is analysed as it was sent, so leave secrets out of it.

Everything elseCopy Anchor Link

• The extension asks DebugAI for your plan, usage and product notices (when VS Code starts, after each debug, and at most every 15 minutes), and reports counts of its own errors. None of that includes your code or file names.
• While VS Code telemetry is on, the extension sends product events to PostHog, with no code and no file names. Turn VS Code telemetry off and it sends none.

Where your key is keptCopy Anchor Link

Neither the extension nor npx -y @debugai/mcp setup writes your key into a client's config file.

What is keptCopy Anchor Link

• Your project index: while it is active, until you ask for it to be deleted.
• Debug history and error memory: the error text of each debug with credentials removed, the file you debugged and the files its stack trace names, the fixes offered, which one you applied and whether it worked. Kept with your account with no fixed expiry, so the fixes that worked stay available. See Error memory.
• Short-term caches: deleted on their own.

To have your data deleted, email privacy@debugai.io from the address on your account.

Who processes itCopy Anchor Link

Regions and the rest of the detail are in the privacy policy.