Privacy Policy
This Privacy Policy explains how BURSUsofts ("we", "us") handles your information when you use the BURSU Connection Manager desktop application ("the app") and the BURSUcloud service at bursucm.com ("the service").
1. Information we collect
- Account data. When you create a BURSUcloud account we store your email address, a securely hashed password, and optional profile fields (first name, last name, nickname).
- Sign-in with Google, Microsoft, Apple or GitHub. If you choose to continue with Google, Microsoft, Apple or GitHub, we receive the verified email address that provider shares with us, basic profile data and an account identifier, to create or link your account. We never receive your password for that provider.
- Two-factor authentication. If you turn it on, we store the secret your authenticator app makes its codes from, encrypted with a key kept on our server, together with the time of the last accepted code so that no code works twice, and your ten recovery codes only as SHA-256 hashes, each marked once it has been used. We use them only to check the codes you enter when you sign in with your password, and we delete them when you turn two-factor authentication off or delete your account.
- Service data. Connection catalogs you sync to BURSUcloud are stored in an isolated PostgreSQL database. Stored secrets (passwords, SSH keys) are encrypted at rest.
- Technical data. Standard web server logs (IP address, timestamp, user agent) and a session cookie required to keep you signed in.
- Cloud activity. When an app reaches BURSUcloud with your account (or a program user reaches one of your databases), we note the time of the last request on the account and on the database, and how many minutes a day they were in use. No address, request or content is kept with it, and the daily minutes are deleted after 90 days. We use it only to see how the service is used and when an account's apps last synced.
2. How we use it
- To create and operate your account and the service.
- To provision and connect your cloud database over our secure API.
- To secure the service and prevent abuse.
- To respond to support requests.
3. The desktop app and local data
Used in local mode, the app stores your connections and credentials only on your own computer (local SQLite, protected by a portable AES-256-GCM master password, or Windows DPAPI on Windows). That data never leaves your device unless you choose to sync it to BURSUcloud.
To know how many people use the app, we count its update checks — the automatic one it makes once a day while it is open (older versions: at start-up, at most every three days) and any you start yourself: one installation per day, by platform and country, kept for 13 months. The IP address is replaced by a pseudonymous code and is not kept in the usage records, and nothing else about you or your connections is sent. With automatic update checks turned off in the app's settings, only the checks you start yourself are counted.
The optional AI assistant sends your conversation — and, if you attach them, terminal output and files — directly from your device to the AI provider you chose, or to a local model on your own machine. Our servers never see this traffic. Secret Shield redacts detected passwords, keys and tokens before text is sent, provider API keys are stored encrypted, and the assistant does nothing until you add a key. A single setting turns the feature off completely.
4. Problem reports you send us
The apps and this website can send us a problem report. Nothing is ever sent automatically: a report leaves your device only when you press Send, and before you do, the app shows you the exact text and files it is about to transmit. After a crash, the desktop and mobile apps offer to send a report the next time they start — and it, too, leaves only when you press Send.
A report contains what you write (and an email address for our answer, if you give one), the app's version and interface language, your operating system and device type, how the app stores its data (local, PostgreSQL or BURSUcloud) and its theme, the failure itself where the program can describe it (error message and stack trace), and any log or screenshot you choose to attach. If you are signed in with a bursucm.com account, the report is linked to it. Passwords, master passwords, private keys and access tokens are removed on your device before the report is shown to you, and connection host names and user names are hidden unless you explicitly include them.
We record the country the report came from and a pseudonymous code of the network address — enough to recognise repeat reports and abuse; the address itself is not kept with the report. Reports are used only to diagnose the problem and to answer you, are never shared or sold, and are deleted after 90 days.
5. Sharing
We do not sell your data. We share information only with infrastructure providers needed to run the service, or where required by law.
6. Security
Passwords are hashed, stored secrets are encrypted, PostgreSQL is not exposed to the public internet, and access runs over our zero-knowledge API and HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.
Desktop and mobile apps send only ciphertext. Website vault actions process the master password temporarily on the server.
7. Data retention & your rights
We keep account and service data while your account is active. You may request access, correction or deletion of your data, or delete your databases and account at any time.
8. Cookies
We use an essential session cookie to keep you signed in and a cookie that remembers your language. Site traffic is measured with Google Analytics.
No third-party analytics in your account. Google Analytics runs only on our public pages. Your account and the site's administration pages load no third-party analytics, advertising or tracking scripts — no outside service can see what you do there or the data you keep there.
9. Contact
Questions about this policy? Contact us at support [at] bursucm.com.