Privacy policy
Last updated
This policy covers brightlabs.app and the products sold here. The data controller is Mark Delos Santos, trading as Bright Labs, who is responsible for your data. We collect only what a product needs to work, and we never sell personal data.
The short version: browsing this site sets no tracking cookies. PHPReady and FlakeRadar keep your data on your own site or in your own browser. We hold personal data only if you buy a paid plan or write to us, and the table below lists all of it.
| What | Why | How long |
|---|---|---|
| Your messages to hello@brightlabs.app | To answer you | As long as we need to answer you and meet legal duties such as tax records |
| Email address and a hash of it, Paddle customer and subscription ids, plan, status, paid-until date, whether a payment completed and whether your key was emailed | To issue, send and renew your license key | Not deleted automatically; removed when you ask, except what we must keep |
| Record that a payment was refunded or charged back | So a license key that should end cannot be renewed | Kept permanently |
| Link between a checkout and its subscription | To show your key on the page after you pay | 24 hours |
| Counters for key-resend requests | To limit abuse of the resend form | 10 minutes to 2 days |
1. This site
This site sets no tracking cookies. Our own code sets no cookies of any kind and stores nothing in your browser. It has no accounts, no sign-in and no advertising.
The site is hosted on Cloudflare. As with any website, delivering a page means Cloudflare's servers process your IP address and the request your browser sends. Cloudflare handles that under its own terms and privacy policy at https://www.cloudflare.com/privacypolicy/.
We use Cloudflare Web Analytics to see how many people visit and how quickly pages load. A small script from Cloudflare runs on every page and reports the page visited and timing figures. Cloudflare states that this service does not use cookies or local storage and does not fingerprint visitors. We see only totals, and we cannot pick out an individual visitor.
2. If you email us
If you email us, we keep your message and address for as long as we need to answer you and to meet legal duties such as tax records. Mail to hello@brightlabs.app passes through Cloudflare Email Routing and is stored in Google Gmail. Our replies are sent through Resend.
3. Payments
Paddle.com processes payments as Merchant of Record and handles billing data under its own privacy policy, at https://www.paddle.com/legal/privacy. We never see your full card details. Paddle tells us what we need to give you access: your email address, what you bought, and the status of your purchase. Paddle and we each act as independent data controllers for the data we each hold.
Paddle's script loads only on the page where a paid plan is on sale, as soon as you open that page. It comes from Paddle and may set its own cookies or similar storage, under Paddle's policy. No other page loads it.
4. License keys
If you buy a paid plan, our license service (a small program we run on Cloudflare Workers) receives notices from Paddle about your subscription. It stores your email address, your Paddle customer id, your subscription id, its status, the end of the paid period and which plan it is, in Cloudflare's key-value storage. We use these only to give you your key, to send it again if you ask, and to answer support and refund questions.
The license key itself is a signed token that holds your Paddle customer and subscription ids and an end date. It does not contain your email address, and we do not store a copy of it: the service makes it again when it is needed.
After your first payment, the service sends your key once by email through Resend, from hello@brightlabs.app. The email holds your key, a download link where the plan has one, and install steps. It has no tracking pixels and no images. Renewals do not send another one, and we do not use your address to send promotions.
After checkout, the Pro page asks the service for your key using Paddle's transaction id, and shows it on the page. If you use the "Resend my key" form, the email address you type is sent to the service, and a hashed copy is used to find your purchase and to limit repeat requests. To stop abuse, the service also uses your IP address for a short-lived rate limit. Our code does not write your IP address to storage or logs. Cloudflare keeps its own request logs under its own policy.
These records are not deleted automatically when a subscription ends, so that you can still recover a purchase or ask about a refund. Email us if you want them removed; section 10 explains what we may have to keep.
5. Our products
Each app or tool page says what data it reads and what, if anything, it sends to us. The next three sections set out the detail for each product we sell.
6. PHPReady
PHPReady is a WordPress plugin that runs on your own site. It sets no cookies, has no tracking and collects no personal data. Its settings and scan results stay in your site's own database, and deleting the plugin from WordPress removes them.
Its only external request is downloading an update package that WordPress has already offered your site, from the address in that offer, so that it can check the package before installing. It sends nothing of its own with that request: no site data, no list of your plugins and no usage data. The server hosting the package sees an ordinary download request from your site, as it does when WordPress downloads the update itself. The package is deleted after the scan.
7. PHPReady Pro
PHPReady Pro is a separate plugin on your own site. Nothing it finds is sent to us. Its scan results, logs and alert settings stay in your site's database.
- Once a week, and when you press the refresh button, it sends your license key to the Bright Labs license service to renew it. The request holds the key and nothing else. With no key saved, nothing is sent. The key is otherwise checked on your own site.
- Once a day, it asks api.wordpress.org about your installed plugins, by their WordPress.org directory names, to check for fixed versions. It downloads packages to scan from downloads.wordpress.org. WordPress.org's privacy policy applies to those requests.
- Alerts are plain-text emails sent by your own site through WordPress's own mail function, to the address you save or else your site's admin address. They do not pass through us.
When a Pro license ends, the Pro features stop and the plugin touches none of your data. The free PHPReady plugin keeps working.
8. FlakeRadar
FlakeRadar is a Chrome extension. It has no analytics and no telemetry. FlakeRadar is not affiliated with or endorsed by GitHub.
What FlakeRadar stores
- Your settings: on or off, display name, one-click re-run on or off, and the settings version.
- Your GitHub token. The settings page shows only whether a token is saved and the GitHub username it belongs to, never the token. Remove token deletes it and the cached GitHub responses.
- Your FlakeRadar Pro license key and the time of the last renewal check. When you activate a key, it is checked on your device and nothing is sent.
- The last pull request you checked and the result of each check (owner, repository, pull request number, check names and verdicts), plus cached GitHub responses.
- Cached GitHub responses, kept so a repeat request can ask whether anything changed.
- The number of GitHub requests left that GitHub last reported, with its reset time. It decides whether the hourly refresh runs.
- With Pro, pinned-repository history: the repositories you pin and what was collected for them. For the last 7 days that is the default-branch commits, the workflow runs of each job and the names of failing tests from check annotations; for older days, daily counts per job and per test. Days older than 400 are deleted. Unpin deletes a repository's pin and its history.
All of this stays on your device, in your browser profile. FlakeRadar does not use Chrome sync storage, so Chrome does not copy it to your Google account. If you remove the extension, its stored data is deleted.
What FlakeRadar sends
- Your GitHub token goes only to api.github.com, in the Authorization header. When you save a token, one request asks GitHub which account it belongs to. FlakeRadar shows the username and stores nothing from the answer.
- The owner, repository, pull request and run numbers travel in request URLs to api.github.com. The re-run request is sent only when you click Re-run failed jobs.
- Your license key goes only to the Bright Labs license service, and only to renew it. That happens when the key is within 7 days of its end date, at most once every 24 hours. The request body holds the key and nothing else. It carries no GitHub token. If you never activate a key, nothing is sent to the license service.
- Get Pro opens the checkout page in a new tab. Paddle handles checkout and billing there, and the extension sends nothing to it.
- See pricing opens brightlabs.app and Manage or cancel opens paddle.net, each in a new tab. The extension sends nothing to either.
- The button that opens GitHub's token page opens github.com in a new tab. The extension sends nothing to it.
- With Pro and at least one pinned repository, FlakeRadar reads each pinned repository from api.github.com once an hour, and once more right after you pin it. The requests carry repository, workflow, run and check-run ids and your token, and nothing else.
- With Pro, FlakeRadar can show a Chrome notification when a pinned repository's flaky tests spike. It is shown on your device; nothing is sent.
FlakeRadar reads the address of the active tab only after you click its toolbar button on that tab or while its side panel is open, to see whether it is a GitHub pull request. The address itself is not stored or sent anywhere; only the owner, repository and number of a pull request you check are kept on your device. It reads no page content and no browsing history.
When a Pro key ends, FlakeRadar returns to the Free limits. It deletes none of your stored data. Questions: hello@brightlabs.app.
9. Who else handles your data, and why it is lawful
| Company | What for |
|---|---|
| Paddle | Checkout, payments, tax, receipts and billing support, as Merchant of Record and an independent controller |
| Cloudflare | Hosting this site, web analytics, email routing, and running and storing the license service |
| Resend | Sending license key emails and our replies |
| Storing our mailbox (Gmail) |
These companies may process data outside the country where you live, including in the United States, under their own safeguards. We do not sell personal data or share it for advertising. We will disclose data if the law requires us to.
Where data protection law asks for a legal basis, ours are these. We process purchase and license data to perform our contract with you. We keep records where the law requires it, such as tax records. And we rely on our legitimate interests to answer your messages, keep the service secure, limit abuse and understand site traffic in totals.
10. Your rights
Email hello@brightlabs.app to see, correct or delete data we hold about you. For billing data, you can also contact Paddle.com at paddle.net.
Depending on where you live, you may also have the right to object to or restrict how we use your data, to receive a copy in a portable form, and to complain to your local data protection authority. We will answer within the time the law sets. We may need to confirm that a request really comes from you, usually from the address you used at checkout.
If you ask us to delete your license records, your key can no longer be sent again or renewed, so cancel any active subscription first. We may keep what the law requires, and the record that a subscription was refunded or charged back.
11. Security
This site is served over HTTPS with a strict content security policy. License key emails hold your key, so treat them as you would a password. No system is perfectly secure, and if we learn of a breach that affects you, we will tell you as the law requires.
12. Children
Our products are made for people who run websites and write software. They are not aimed at children, and we do not knowingly collect children's data. If you think a child has given us data, email us and we will delete it.
13. Changes and contact
If we change this policy, we will update the date at the top of this page. Questions about it, or about your data: hello@brightlabs.app.