Privacy policy
Updated
This is an English translation provided for convenience. If there is any conflict, the Portuguese version at breakpane.com/privacidade prevails.
This policy explains how Breakpane handles personal data under the LGPD (Brazil’s General Data Protection Law, Law 13,709/2018). It applies to the Breakpane app, the breakpane.com website and the api.breakpane.com license server.
Who the controller is
SFAL Solutions Ltda., CNPJ (Brazilian company registration) 69.320.527/0001-08, R. Particular Itapoá, 130, apto 7011, Carvalho, Itajaí/SC, CEP 88307-280, Brazil. Contact for any privacy matter: support@breakpane.com.
As a small-scale processing agent, SFAL has not appointed a data protection officer (Resolution CD/ANPD No. 2/2022, from the ANPD, Brazil’s National Data Protection Authority), and keeps the email above as the communication channel with data subjects.
What the app never sends
Breakpane sends nothing about your projects to us or to third parties: code, files, the addresses you open on the device, page content, screenshots and your project list stay on your computer. On its own, the app does not write to your project folders; it reads package.json to find the command and runs the dev script the way you would in the terminal. The exception is what you allow a coding agent to ask for, described in the next section.
Coding agents (Beta)
Coding agents come turned off. If you turn them on in More options › Coding agents, the app opens a server that only accepts connections from your own computer (127.0.0.1), from tools that have a key created for each of them. On each tool’s first action, the app asks for your permission. You can pause the agents or revoke a tool’s key at any time, in the same panel.
Before you allow it, a tool can only learn the app’s status (version, license, whether it is paused), the list of devices it simulates and the names of the devices you have open. With your permission (for example in Claude Code, Codex, Cursor, VS Code or Windsurf), it receives what it asks for about the pages open on the devices it opened itself: screenshots, the page’s text and structure, console messages, network requests and the audit results. It also sees the list of local servers running (address, page title and project name) and the address open on your devices, but it does not act on them. Agent devices share your devices’ sessions (logins and cookies), and an agent can open any address, not only your computer’s: it can see and use pages you are signed in to, including websites on the internet. This data goes to the tool, on your computer, not to us. What the tool does with it, including sending it to the provider of the model it uses, follows the terms and privacy policy of that tool and that provider, which you chose. SFAL does not receive or process this data.
With coding agents on, the app writes to your computer the audit reports, in the app’s own folder (the 20 most recent), a diary of each agent session (the 10 most recent, with numbered screenshots and a summary; never the typed text or the address parameters, and no screenshots of screens where something was typed; you can turn it off in the same panel), and the screenshots and reports the tool asks to save to a folder inside your user folder, which may be a project folder. When you click Connect, the Breakpane configuration (the local address and that tool’s key) goes into the tool’s configuration: for Codex, Windsurf and, in some cases, Cursor and VS Code, the app writes the tool’s configuration file and keeps a copy of the previous file; for Claude Code, the claude command itself writes it; for VS Code and Cursor, when the app opens the install link, the tool writes it after you confirm. When it cannot write it, and always for Claude Desktop and Copy configuration, the app copies that configuration, including the key, to the clipboard for you to paste.
What data we handle, why and on what legal basis
| Data | Purpose | Legal basis (LGPD, art. 7) |
|---|---|---|
| Computer identifier (a code derived from the system identifier that cannot be used to find out which computer it is), app version, operating system, interface language and license status (trial or subscription), once a day | counting installs and usage, without identifying the person | legitimate interest (art. 7, IX), with an option to turn it off in the app |
| Computer identifier and trial start date | managing the 14-day trial and preventing abuse | legitimate interest (art. 7, IX) and performance of a contract (art. 7, V) |
| Email, confirmed by a code on day 3 of the trial | creating your account, sending the code and service notices | performance of a contract and of preliminary procedures (art. 7, V) |
| Opt-in to product news by email | sending new versions and tips | consent (art. 7, I), optional and revocable at any time |
| License key, subscription status, plan, and the name and operating system of the activated computers | making the license work on up to 3 computers and letting you recognize and deactivate each one | performance of a contract (art. 7, V) |
| Email, country and purchase data received from Paddle | linking the purchase to the license, sending the key and providing support | performance of a contract (art. 7, V) and legal and tax obligations (art. 7, II) |
| IP address and technical data from requests to the license server | security, fraud prevention and rate limiting | legitimate interest (art. 7, IX) |
| Clicking to download the app on the website: the day, the file’s operating system and whether the request looks like a bot, plus a scrambled mark kept for 48 hours (see “This website”) | knowing how many people download the app, without counting bots or the same person twice in a day | legitimate interest (art. 7, IX) |
| Where the visit to the website came from (the link’s utm_ parameters or the domain of the website that sent you), a random visit code and, when the app is first opened within 48 hours of a download made from the same network, that origin linked to the computer identifier (see “This website”) | knowing which promotions bring people who download, install and subscribe, without identifying anyone | legitimate interest (art. 7, IX) |
| Messages you send to support@breakpane.com | replying and providing support | performance of a contract and legitimate interest |
| Browsing on the website measured by Google Analytics (pages viewed, where the visit came from, device, browser, language, approximate region, and clicks to download, subscribe and switch language) | learning which pages help people decide and improving the website | consent (art. 7, I), asked for in the cookie notice and revocable at any time |
| Browsing on the website measured by the Meta Pixel (pages viewed and clicks to download the app and subscribe) | measuring Breakpane’s ads on Facebook and Instagram and showing them to people who have visited the website | consent (art. 7, I), asked for in the cookie notice (“Accept all”) and revocable at any time |
We do not use data for third-party advertising, we do not sell or rent personal data, and we do not make automated decisions that affect you beyond the license rules described in the terms of use.
Payment
Purchases are handled by Paddle.com Market Ltd., Breakpane’s authorized reseller (Merchant of Record). Card, PayPal or Pix details stay with Paddle and never pass through us. Paddle tells us the email, country, plan and subscription status. Paddle’s own processing follows Paddle’s privacy policy.
Partner program
People who apply to become partners at breakpane.com/en/partners give us their name, email (confirmed by code), a link to their main profile, their country, the code they want and, optionally, a description of their audience. Once an application is approved, we also keep the payout details (payout method, Pix key or account email, account holder name and CNPJ), stored encrypted and opened only to pay, and the record of commissions and payouts. We use this data to review the application, count visits through the link and subscriptions with the code, calculate and pay commissions and meet tax obligations (performance of a contract and of preliminary steps, art. 7, V, and legal obligation, art. 7, II). Partners never receive data about the people who subscribed with their code, only numbers. Declined applications are deleted.
If you arrive through a partner link (breakpane.com/?p=CODE): the website removes the code from the address before any measurement, keeps it in your browser (bp_ptn, in local storage) for 60 days to fill in the field on the pricing page, and counts the visit for the partner once per tab, without storing your IP (the same scrambled network mark, for 48 hours). With Global Privacy Control or Do Not Track, the visit is not counted. If you subscribe with the code, the partner’s identifier goes with the subscription at Paddle so the commission can be paid.
How long we keep data
- License and purchase data: while the subscription exists and for 5 years after it ends, to cover the claims period under the CDC (Brazil’s Consumer Protection Code) and tax obligations.
- Account (email) without a subscription: until you ask for deletion or for up to 2 years without using the app, whichever comes first.
- Opt-in to product news: until you revoke it.
- Daily usage count: per-day data is kept for up to 100 days; the per-computer summary (first and last day of use and how many days it was used) is kept while the app is in use and for up to 2 years after.
- Server technical logs (IP): up to 30 days.
- Visit origin: the visit code, 7 days; the link between a download and the network, 48 hours; the origin inherited by a computer, together with its usage summary (up to 2 years without use); the totals per origin and per day are just numbers.
- Google Analytics (only with consent): 14 months, the period set in the account; the Google Analytics cookies in your browser last up to 13 months.
- Meta Pixel (only with “Accept all”): for the period set by Meta; the _fbp cookie in your browser lasts up to 3 months.
- Partners: while the partnership lasts and, after that, for the legal retention period of payment records and tax obligations (5 years); declined applications are deleted when declined; visits through the link are kept only as daily counts.
- Database backups: 30 days.
After these periods, the data is deleted or anonymized.
Where the data is stored (international transfer)
We use providers that store or process data outside Brazil:
- Supabase (database): United States.
- Hetzner (license server and backups): Germany.
- Vercel (website and visit counts): United States.
- Resend (sending email): United States.
- Paddle (payment): United Kingdom.
- GitHub (app download and update checks): United States.
- Google (Google Analytics, only if you accept in the website’s cookie notice): United States.
- Meta Platforms (Meta Pixel, only if you choose “Accept all” in the website’s cookie notice): Ireland and United States.
These transfers are made to perform the contract with you and are based on these providers’ contractual data protection guarantees (LGPD, art. 33, II and IX). The Google Analytics transfer also relies on your consent (art. 33, VIII) and, for visitors from the European Union, on the EU-US Data Privacy Framework, in which Google participates. Each one handles the data only to provide the contracted service.
This website
The website counts visits and downloads in four ways, and only one of them depends on you:
- Cookieless count, always: Vercel Web Analytics counts visits without cookies and without identifying visitors.
- Download count, without cookies: the download buttons go through api.breakpane.com, which counts the download and sends you to the file on GitHub. We keep only the day, the file’s operating system and whether the request looks like a bot. So the same person isn’t counted twice on the same day, we keep for 48 hours a scrambled mark of the IP address together with the browser, made with a random key that changes every day and is deleted with it: the mark can’t be used to find out the IP address or who you are.
- Visit origin, without cookies: on the first page of each visit, the website reads where you came from (the utm_ parameters of a promotion’s link or the domain of the website that sent you) and sends it to api.breakpane.com with a random code, kept only in this browser tab and deleted when it closes. The download buttons carry this code. If the app is first opened within 48 hours, from the same network, the computer inherits the download’s origin: we compare the scrambled mark of the network (the same random daily key, deleted within 48 hours), never the IP address. That way we know, per promotion, how many visits turn into downloads, installs, trials and subscriptions, without knowing who you are. With Global Privacy Control or Do Not Track, none of this is sent.
- Google Analytics 4, only with your consent: on your first visit a notice appears in the corner of the screen, with “Decline”, “Measurement only” and “Accept all” buttons of the same size; the last two turn on Google Analytics. Before you choose, nothing from Google is loaded; if you decline, it never is. If you accept, Google Analytics measures the pages viewed, where the visit came from, the device type, operating system, browser, language, approximate region (country and city), and clicks to download the app, subscribe and switch language. It does not store your IP address. Google Signals and ad personalization are turned off, and none of this is used for advertising. Google handles this data as a processor, on our behalf, in the United States, and keeps it for 14 months.
- Meta Pixel, only with “Accept all”: before that choice nothing from Meta is loaded, and “Measurement only” turns on Google Analytics alone. With “Accept all”, the Pixel records the pages viewed and clicks to download the app and subscribe, so we can measure Breakpane’s ads on Facebook and Instagram and show them to people who have visited the website. Meta receives these events with technical browser data and may link them to your Facebook or Instagram account; for that part it also handles the data for its own purposes, as a controller, under Meta’s Privacy Policy. The click to download the app also reaches Meta through our server (Conversions API), with your IP address, browser and the _fbp cookie, so the same download is not counted twice or lost when the browser blocks the Pixel; this too happens only with “Accept all”, and we do not store this data. Declining or choosing “Measurement only” later turns the Pixel off right away and deletes the _fbp cookie.
- Browser privacy signals: if your browser sends Global Privacy Control or Do Not Track, the website treats it as a refusal and does not show the notice.
- Changing your mind: the “Cookie preferences” link in the footer of every page reopens the notice. Declining after having accepted stops the measurement right away and deletes this website’s Google Analytics cookies.
Cookies the website may set:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| bp_consent | the website | storing your choice in the cookie notice (“all” for everything, “yes” for measurement only, or “no”) | 12 months |
| bp_lang | the website | storing the language picked in the switcher at the top (“pt” or “en”), so the site does not switch the language based on your location; set only if you use the switcher | 1 year |
| _ga and ga followed by the account code | Google Analytics, only if you accept | telling visits and sessions apart | up to 13 months |
| _fbp | Meta Pixel, only if you choose “Accept all” | telling browsers apart to measure ads | up to 3 months |
Paddle’s checkout loads only when you click to subscribe and, from then on, may use Paddle’s own cookies, which are needed for the payment. To work offline, the website keeps a copy of the pages you visited in your browser (service worker), which stays on your device only.
Your rights
Under the LGPD (art. 18), you can ask at any time for:
- confirmation that we handle your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data handled in breach of the law;
- data portability;
- deletion of data handled based on your consent, and withdrawal of consent;
- information about who we share the data with;
- objection to processing based on legitimate interest.
To exercise these rights, write to support@breakpane.com from your account or purchase email. We reply within 15 days (LGPD, art. 19). On the website, you withdraw consent for Google Analytics and the Meta Pixel under “Cookie preferences” in the footer. Some things you can do directly in the app: turn off the anonymous count in More options › Anonymous usage statistics, turn off product news in More options › License, and deactivate a computer.
Deleting the account ends the license linked to it; data we must keep by law is retained only for the required period. If you believe your rights have not been respected, you can also file a complaint with the ANPD.
Security
Data travels encrypted (HTTPS). The database runs in a separate environment with no public access, and only the license server can reach it. Access to the server is by cryptographic key only, with a firewall and automatic security updates. The license uses a digital signature, and the access keys for our providers are kept out of the code. If a security incident occurs that may cause significant risk or harm, we will notify the affected data subjects and the ANPD, as the LGPD requires.
Children and teenagers
Breakpane is a professional web development tool, it is not directed at anyone under 18, and buying it requires legal capacity.
Changes to this policy
When this policy changes, the date at the top is updated. Significant changes are announced by email to account holders and in the website’s changelog before they take effect.