Who is responsible
The operator of bugbounty.fyi is responsible for the data described here. Contact: the contact address on the About page.
When you visit
The server receives your IP address, the page you ask for, the time, your browser's user agent and the referring page. This is needed to send you the page and to protect the site from abuse (legal basis: legitimate interest, GDPR Article 6(1)(f)). It is kept in short-lived server logs and in rate-limit counters that expire within minutes. It is not used to build profiles and is not shared, except with the hosting provider that runs the server.
The site sets only the cookies it needs to work; see the cookie list.
Company logos
Company logos are loaded from Logo.dev's image service, so your browser asks Logo.dev for those images and Logo.dev receives your IP address and browser details as part of that request. Platform logos come from the platform's own servers in the same way.
When you write to us
If you email us, we use your address and message only to answer and to make the correction you asked for, and delete them when that is done, unless the law requires us to keep them.
Data about programs
Program pages hold facts that companies and platforms publish: program names, rewards, scope, security contacts in security.txt files and public CVE records. They don't contain personal data about hunters. If a public security contact names you personally and you want it removed, ask and we will remove it.
Your rights
Where the GDPR or a similar law applies, you can ask for access to, correction or deletion of your data, object to its processing, and complain to your data protection authority. Because the site holds almost nothing that identifies a visitor, most requests are answered by "we hold nothing". Write to the contact address on the About page.
Changes to this policy
The date at the top changes when this page does. Material changes are described here for 30 days.
Visitor statistics
To see which pages are useful, the site counts visits with: Google Analytics 4 (sets _ga cookies, IP addresses anonymised). These counts are aggregated and are never used for advertising.