What FirstUsers collects, and what it never does.

Your account

Signing in with GitHub gives us your GitHub id, login, display name, avatar and primary email (scopes read:user and user:email). We use the email for in-app notifications and nothing else. We never post on your behalf.

Repo access

Issues are filed into the repo you pick through a per-user viaSocket connection. If you choose the fallback “Use my GitHub login”, GitHub asks you for the repo scope on a second consent screen, and we store that token encrypted at rest. Both can be disconnected from your app's Settings tab.

The script, during a test

When a tester opens your app with a test session, the script records:

• console errors and warnings (message, first 10 lines of stack, URL, time)
• failed requests: method, URL without query string, status, duration
• clicks: a short CSS selector, visible text up to 40 characters, position
• route changes, viewport, user agent and a heartbeat with active time

It never records input values, keystrokes, request or response bodies, cookies, storage, or anything from password fields. With no test session open it sends one “installed” ping per page load with your app id and nothing else.

Voice notes

Recordings are capped at 30 seconds, transcribed by Sarvam AI, turned into an issue by a language model, and deleted from storage after 30 days. The transcript is kept with the issue so the developer can read the tester's exact words.

Retention and deletion

Event data is dropped after 30 days. Deleting an app removes its tests, events and reports; the credits ledger is kept so balances stay correct. Ask in the builder group to delete your account entirely.