Privacy Policy

Data Controller

The data controller for personal data processed through ExecBro and execbro.com is:

• Ihor Zheludkov (Желудков Ігор Валерійович)
• Individual Entrepreneur (ФОП), Group 3, registered in Ukraine
• Tax ID (РНОКПП): 3327316054
• Address: 56 Nezalezhnosti St., Vinnytski Khutory village, Vinnytsia district, Vinnytsia region, Ukraine
• Email for privacy / data-protection inquiries: [email protected]

Overview

ExecBro ("the Tool") is an MCP server for AI-powered React Native debugging, paired with a web dashboard at execbro.com. This policy explains what data is collected by both the MCP package and the web platform, how it is used, the legal basis for processing, and how you can control it.

Legal Basis for Processing

1. Anonymous Telemetry

The MCP package collects anonymous usage metrics to improve the product:

Not collected: file paths, source code, network data, console log content, component names, app state, or personally identifiable information.

Telemetry can be disabled by setting the environment variable:

export EXECBRO_TELEMETRY=false

2. Auto-Registration & Device Fingerprinting

On the first tool use in each session, the MCP package automatically registers your installation with our backend. This enables license validation and optional account linking.

The device fingerprint is a one-way hash — it cannot be reversed to recover your username, CPU model, or hardware UUID individually. The raw components are never sent to our servers.

Registration data is stored in Google Firebase Firestore. Each installation creates a record with anonymous or linked status, free tier by default, and the data listed above.

Auto-registration is tied to telemetry. Disabling telemetry also prevents registration.

3. OCR Screenshot Processing

When the ocr_screenshot tool is used, a screenshot is sent via HTTPS to a Cloudflare Worker, which forwards it to Google Cloud Vision API for text recognition. The image is not stored — it is processed in memory and discarded immediately.

If the cloud service is unavailable, a local OCR fallback (EasyOCR) processes the image entirely on your machine.

Google Cloud Vision API usage is governed by Google Cloud's Terms of Service. Under their terms, Google does not use customer data to train its models.

4. Tap Failure Diagnostic Artifacts

When the tap tool fails or produces no visible change on screen (changeRate < 0.1%), the MCP package uploads diagnostic evidence so we can reproduce and fix tap reliability issues.

What is collected:

• A small JSON bundle (~5–30 KB, gzipped): the predicate, error category and message, the strategy chain, the chosen tap point if any, and device metadata.
• Up to three downscaled PNG screenshots (50% scale, ~50 KB each): before.png, after.png, and after-with-marker.png (post-tap screenshot with a red-cross marker drawn at the exact pixel where the tap landed).

When: only on tap failures and successful taps that produced no visible change. Successful, meaningful taps upload nothing.

Where stored: Cloudflare R2 (same Cloudflare account as the telemetry endpoint), accessed only via authenticated dashboard endpoint.

Retention: 10 days. Objects are auto-deleted by an R2 lifecycle policy.

Use: solely to diagnose and improve the tap tool. Not used to train AI models. Not shared with or sold to any third party.

Scope note: the Tool only operates against development environments (simulators, emulators, dev builds). Screenshots may include whatever is on your screen at the time of the tap. We do not run against production or release builds.

How to opt out:

"env": { "RN_AI_DEVTOOLS_DISABLE_FAILURE_ARTIFACTS": "1" }

Disabling telemetry (EXECBRO_TELEMETRY=false) also disables artifact upload.

5. Web Dashboard & Authentication

The web dashboard at execbro.com provides optional account management. You can use the MCP package without ever creating a web account.

If you choose to sign in, we use Google sign-in via Firebase Authentication. The following is stored:

Activation tokens (one-time codes for linking MCP installations to your account) are valid for 24 hours. Only a SHA-256 hash is stored server-side; the raw token is shown once in the dashboard.

6. Data Retention

7. Third-Party Services

API keys embedded in the MCP source code are write-only tokens — they cannot be used to read or access any stored data.

8. Local Storage

The MCP package creates the following files on your machine:

To delete all locally stored data:

rm -rf ~/.execbro/

9. International Data Transfers

The data controller is established in Ukraine. Personal data may be processed in Ukraine, the European Union, the United Kingdom, and the United States, depending on the third-party processors involved (Cloudflare, Google / Firebase, Paddle). Where data is transferred outside the EU/EEA, our processors rely on the European Commission's Standard Contractual Clauses or equivalent safeguards. By using the Tool, you acknowledge that your data may be transferred internationally.

10. Your Rights

Under GDPR and applicable data-protection laws, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Port your data to another service in a machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority (in Ukraine, the Ombudsman of the Verkhovna Rada; in the EU, your local Data Protection Authority)

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Practical controls built into the product:

• Delete your account: Use the delete_account MCP tool (requires confirm: "DELETE") to remove all server-side data.
• Delete local data: Remove ~/.execbro/ from your machine.
• Opt out of telemetry: Set EXECBRO_TELEMETRY=false.
• Avoid cloud OCR: Use ios_screenshot or android_screenshot instead of ocr_screenshot.
• Opt out of failure artifacts: Set RN_AI_DEVTOOLS_DISABLE_FAILURE_ARTIFACTS=1. Anonymous structured signals still flow under the telemetry opt-out.

11. Children's Privacy

This is a developer tool and is not directed at children under 13. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the "Last updated" date at the top of this page.

13. Contact

For questions about this privacy policy, data practices, or to exercise your rights, contact [email protected]. For technical issues, you may also open an issue on GitHub.