What data we collect
Exactly what Buff records about how the product is used, what it does not record, and where to see it.
Buff counts what gets used and where people stumble. This page is the complete list of what is recorded, because “we respect your privacy” means nothing without a list.
Two counters, and they are different
| Public site | Product | |
|---|---|---|
| What it counts | page views, where visitors came from, device type | actions in the app, screens, service responses |
| Who is in the record | nobody: the visitor is anonymous | login and organisation — for registered users |
| Where it lives | our server next to the site | our data warehouse |
| Cookies | sets none at all | not applicable |
The site counter is our own, hosted on our servers. It sets no cookies and does not store the IP address: visitors are told apart by a value computed from the address, the browser and the domain with an irreversible transformation whose key changes every day. It can be used neither to identify a person nor to link their visits on different days.
What is recorded about work in the app
- Action — which command was executed: sign-in, creating a draft, a review decision, an “Ask” question. Both successful and rejected ones: refusals show where people hit a wall.
- Who and where — login and organisation. Without a login we cannot answer “it doesn’t work for me”, nor count how many people actually use the service.
- How long it took — processing time, to see what has become slower.
- Screens — which section was opened and from which device. Task and question identifiers do not go into this record: two opened tasks are one “task” screen.
- Deliveries — that an email or notification was sent (or was not, and with which error code).
What these records do not contain
- The content of tasks, questions, research and conversations.
- Code, diffs and file names from your repositories.
- IP addresses and browser strings — these exist only in the audit log, which has a different purpose: the organisation’s security.
- The text of search queries: the length of the query and whether anything was found are counted, but not what was searched for.
- Any values you type into forms.
This is not a promise but a property of the storage: the attribute field accepts only short values — a number, a flag, a short label. A nested structure through which text could leak is rejected at the input.
Reads by machines
Robot requests to llms.txt and to the pages’ markdown mirrors are counted separately and by agent class — AI agent, search crawler, utility. The browser string itself is not stored.
How long it is kept
Statistics records are kept for at least 400 days — a year plus the ability to compare with the same period of the previous year.
Where to see it
The service operator sees a summary in the “Usage” section of the admin panel. Your organisation’s data is not split out into a separate view for you — if you need one, write to us.
The legal side is in the Personal Data Processing Policy, clauses 4.1 and 4.4.