Privacy Policy

Last updated: October 9, 2026

RUBY JOBS K.K. ("we") handles personal information according to our privacy policy (in Japanese). This page supplements it for the macOS app Bugoon Security (the "App") and the website sec.bugoon.com. Anything not covered here follows our privacy policy. The Japanese version of this page prevails.

1. Information the App sends to us

None. The App does not send usage metrics (telemetry), error reports or advertising data to us or to any third party. The bundled claude (Anthropic's Claude Code) is also started with its metrics, error reporting, surveys and automatic updates turned off.

2. Information kept on your Mac

The App stores the locations of registered repositories, scan results and settings on your Mac, in your user Library folder. An Anthropic API key is stored only in the macOS Keychain. We never receive any of this. If anything remains after you delete the App, you can remove it yourself.

3. Network connections

The App connects to the network only in these cases:

When using Claude: parts of the code under review and instructions are sent, with your own credentials, to the provider you chose: Anthropic, Amazon Bedrock (Amazon Web Services) or Google Vertex AI (Google Cloud). You can review the list of files to be sent beforehand, and values identified as keys or passwords are redacted. What is sent is handled under your agreement with that provider and its policies, and we do not receive it. These providers are outside Japan and may process the data outside Japan.
Downloading the vulnerability database (only if you allow it): osv-scanner downloads the public vulnerability database from OSV (operated by Google). Lockfile contents and code are not sent.

If we add a check for new versions in the future, we will describe what it sends on this page before adding it.

4. The website sec.bugoon.com

The website and downloads are served by Cloudflare, Inc. (United States). Cloudflare processes connection data such as IP addresses for delivery and protection against attacks.
To count downloads, we record only the file name and the time. We do not record IP addresses, browser types, cookies or countries.
We do not use cookies or analytics on the website. However, Cloudflare Turnstile, used in the announcement sign-up form on the top page, may use cookies or similar technologies on Cloudflare's domain to tell humans from bots. Turnstile is not loaded until you check the consent box in the sign-up form (see section 5).

The top page of the website accepts sign-ups for announcements. The email address you register is used only to send security and update announcements for Bugoon Security. Your sign-up is complete only when you click the link in the confirmation email.

Delivery and the mailing list are handled by Buttondown (United States), and bot detection at sign-up by Cloudflare Turnstile (United States). To detect bots and abusive sign-ups, the IP address you sign up from is passed to these two companies. Turnstile also receives information such as your browser type (User-Agent) and connection characteristics directly from your browser. Cloudflare states that it does not use this information to identify or track individuals, but it also uses it for its own purpose of improving its bot detection. We therefore treat what is passed to Cloudflare as a provision of personal data to a third party, and load Turnstile only after you give consent by checking the consent box in the sign-up form. Both process data outside Japan.

Provision to a third party in a foreign country: the recipient is in the United States. The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; instead it has sector-specific federal laws and state laws (such as the California Consumer Privacy Act). For details, see the survey of foreign personal data protection systems published by Japan's Personal Information Protection Commission. Cloudflare states that it participates in the EU-U.S. Data Privacy Framework and holds Global CBPR certification. You can unsubscribe at any time from any announcement email.

6. Email to the contact address

Names, email addresses and content received at the contact address are used only to reply and to handle bugs and vulnerabilities.

7. Requests and contact

Requests for disclosure and similar requests regarding personal data follow our privacy policy. For questions about the App or this page, contact:

RUBY JOBS K.K., Fukushi Kobayashi, Representative Director
Hirose Daisan Building 9F, 3-19 Kanda Nishikicho, Chiyoda-ku, Tokyo 101-0054, Japan
info+bugoon-security@rubyjobs.jp

8. Changes

When we change this page, we will post the new content and the date of the update here.