Privacy policy

Last updated October 20, 2026

Squash is a bug reporting service made by Arctic Leaf Inc. This policy covers the Squash website and dashboard at squash.arcticleaf.com, the Squash widget that sites add to their pages, and the Squash Chrome extension. It says what we collect, why, who it's shared with, and what you can do about it.

Arctic Leaf Inc., 1120 S Rackham Way, Suite 300, Meridian, Idaho 83642, USA. For anything about your data, email privacy@arcticleaf.com.

What we collect

Your account

Your name, email and password. The password is only stored as a salted hash, so we can't read it. We also keep which workspaces you belong to and your role in each. When you sign in we set one cookie, squash_session, which keeps you signed in for 30 days.

Workspaces

The workspace's name, its members, and the email addresses of people invited to it. If an admin connects GitHub or Outpost, we keep the access token they give us so Squash can file reports there.

Billing

Payments are handled by Stripe. When a workspace owner starts a subscription we send Stripe the owner's email and the workspace name, and we keep the Stripe customer and subscription IDs. Card details go straight to Stripe. We never see or store them.

Bug reports

A report can include:

• its title, description and severity
• the reporter's name and email (optional in the widget, and the signed-in user's in the extension)
• the address of the page, the browser and the screen size
• a screenshot of the page, which the reporter can mark up or leave out
• the page's recent console messages and errors
• the page's recent network requests: the method, address, status and timing of each one, not what was sent or received, and not headers or cookies
• if the workspace allows it and the reporter includes it, a replay of roughly the last minute on the page

Replays record the page's structure and how it changed, plus scrolling, clicks and mouse movement. Everything typed into form fields is masked before it leaves the browser, scripts aren't recorded, and sites can hide any element from replays with the squash-block class.

Comments, assignments and status changes made in the dashboard are kept with the report.

What we don't collect

Squash doesn't keep IP addresses with your account or your reports. Cloudflare's request logs, which we use to find and fix problems, can include them and are kept for up to a week. Our pages don't run analytics, advertising or tracking scripts.

The Squash widget

Sites add the widget to their pages with a script tag. On those pages it keeps the console messages, errors and network requests in the page's memory, along with a rolling replay of the last 45 to 90 seconds unless the site turns replays off. None of it is sent anywhere unless someone sends a report.

The widget remembers the name and email you typed, and the last discussion you picked, in your browser's storage for that site so you don't have to enter them again.

If you report a bug through the widget on someone else's site, the report goes to that site's Squash workspace. We handle it on their behalf, so questions about it are best sent to them first.

The Chrome extension

The extension lets people with a Squash account report bugs from any page. Clicking its button takes a screenshot of the visible part of the tab. So that a report can include what happened before the click, it captures console messages, errors, network requests and a rolling replay the same way the widget does, on every page you load. That capture stays in the tab's memory and is thrown away when the page is closed or reloaded, unless you send a report. You can turn off either kind of capture in the extension's options.

Reports sent from the extension are filed under your Squash name and email. The extension keeps its settings, the last project you reported to on each site, and the last discussion picked for each project in your browser.

How we use it

Only to run Squash. That means signing you in, delivering reports to your workspace, filing them on GitHub or Outpost when your workspace asks us to, sending account emails (invites, welcome emails and password resets), and billing the workspace. Arctic Leaf staff only look at a workspace's data to give support someone in it asked for, to keep Squash secure, or when the law requires it.

We don't sell your data, use it for advertising, or use it to decide anyone's creditworthiness.

Who sees it

• Your workspace. Members of a workspace can see all of its reports.
• Screenshot links. Each report has an unguessable link to its screenshot so GitHub issues and Outpost bounties can show it. Anyone with that link can view the screenshot until the report is deleted.
• Integrations your workspace connects. If an admin connects GitHub, reports are filed as issues in the repository they pick, with the report's details. If they connect Outpost, Arctic Leaf's project board, reports are posted as bounties and the screenshot is attached to the project's Lobby discussion.
• Our service providers. Cloudflare hosts Squash, stores its data and handles every request, which includes your IP address. Stripe takes payments. Resend sends our emails. Our pages load fonts from Google Fonts, which sees your IP address when your browser fetches them.
• When the law requires it, or to protect people's safety or our rights.

Squash runs on Cloudflare's global network, so your data may be processed in the United States and other countries.

How long we keep it

Reports are kept until someone in the workspace deletes them. Deleting a report deletes its screenshot, replay and logs, and deleting a project deletes all of its reports. Sign-in sessions end after 30 days, and password reset links stop working after an hour. Accounts and workspaces are kept until you ask us to delete them at privacy@arcticleaf.com.

Security

Everything is sent over HTTPS, passwords are hashed, and data is stored on Cloudflare's infrastructure. Reports can only be opened by members of their workspace, apart from the screenshot links above.

Your choices and rights

You can change your password and delete reports in the dashboard. To get a copy of your data, correct it, or have your account or workspace deleted, email privacy@arcticleaf.com and we'll respond within 30 days. Depending on where you live, for example the EU, the UK or California, you may have other rights over your data too, and you can complain to your local data protection authority.

Children

Squash isn't meant for anyone under 16, and we don't knowingly collect their data.

Changes

When this policy changes we'll update the date at the top. If a change affects what we collect or how we use it, we'll email workspace owners before it takes effect.