Legal

Privacy notice

What we collect, why, for how long, and how to make us delete it. The short version: no tracking, and as little as the service needs.

This website

No cookies, no analytics, no tracking and no third-party scripts, fonts or images. Cloudflare, which serves the site, sees standard web-request data (your IP address and the page you asked for) to deliver it. No consent banner is needed because nothing is set or tracked.

The site's two forms. If you join the email list, we store your email, the list you chose, your optional answer to "what do you need to test?" and which button brought you, so we can email you about that and nothing else; ask us and we take you off the list. If you ask for help migrating, we also store your app's address, your current tool, what you wrote, your team size, whether we may quote you, and the files you upload, so we can do the migration and reply. Both live in Cloudflare (its D1 database and R2 storage). Nobody else sees them, and we delete them on request, or when the migration is done if you ask.

The web app: what we collect

Account: your email, name and sign-in identity (through WorkOS).
Your content: projects, tests, recordings, run results and evidence, and encrypted secrets, which you put there.
Usage: runs, credits and the cost of each action, so we can bill and show you your usage.
Billing: handled by Dodo Payments as merchant of record. We never see your card number; we receive the subscription status and invoice details.
Emails: the alerts you ask for and receipts. Emails that arrive at a hosted test inbox are kept only as long as a test needs them.
One cookie: a session cookie that keeps you signed in and protects your changes from other sites. No advertising or tracking cookies.

Why we use it

To run the service you asked for, to bill you, to keep it secure and prevent abuse (for example, one free allowance per person), and to answer you. We don't sell personal data, and we don't use your content to train AI models.

How long we keep it

Run results and evidence: your plan's retention (Free 7 days, Cloud (your own key) 14 days, Solo Dev 14 days, Pro Dev 30 days, Team 90 days), then deleted daily.
Tests and recordings: until you delete them or your account.
Account and billing records: while your account exists, then as long as the law requires for invoices.

Deleting your account or a workspace

You delete them in the app's settings, after signing in again (within the last 10 minutes). Export a copy first if you want one: the app gives you a zip of your tests, recordings and run history.

Right away: your subscription ends, runs, monitors and browser sessions stop, and the workspace becomes read-only, showing the date it will be deleted.
For 7 days you can undo it. Everything comes back except the subscription, which you'd start again.
After 7 days it's deleted from the live service for good. Copies in our backups are gone within 31 days (nightly backups are kept 30 days; our database provider's own history, up to 7). If we ever restore a backup, what you deleted is deleted again before the service uses it.

What we keep, and why. Only this:

A one-way keyed hash of the verified email address and the sign-in identity that received a free allowance. It's how we stop deleting and re-joining from giving free credits twice. It's made with a secret key, it can't be turned back into your email address, and on its own it identifies no one: it only matches if the same address signs up again.
A record that something was deleted and when: the internal ids, never a name or email address.
Invoices and payment records, which Dodo Payments keeps as merchant of record for as long as the law requires.

Who processes it

The companies on our subprocessors page (9 today), each for the purpose listed there. Customer data is processed in the United States.

Your rights

You can see, correct, export and delete your data, and object to or restrict its use, wherever you live. Delete a project or your account in the app, or email [email protected]; we'll act within 30 days. If you think we've got it wrong, you can complain to your data protection authority. [Controller details, legal bases and transfer mechanisms: to be completed on legal review.]