Privacy Policy

Last updated 2026-07-06 · EU-hosted (Germany).

What we store

• Account: your username and a bcrypt hash of your password. No email is required or collected.
• Usage: the URLs you test, run metadata (devices, timings, status), screenshots, diffs and videos you generate.
• Flow credentials (optional): auth headers/cookies you save with a flow, stored encrypted at rest (AES-256-GCM) and decrypted only to run that flow. Never returned by any endpoint.

What we don't do

We don't collect email, we don't use third-party trackers or ad networks, and we don't sell or share your data. There are no analytics beacons on the app.

Where it lives

All data is stored on dedicated hardware in Germany 🇪🇺. Screenshots and run data are served from unguessable, unlisted URLs.

Retention

Runs, screenshots and videos are automatically deleted after 14 days. Visual-regression baselines are kept until you replace or delete them. Deleting your account immediately and permanently removes all of the above.

Third parties

When you run a test, our browsers fetch the target URL (and its sub-resources) you specify — that request goes to whatever hosts the page references. Optional Stripe billing, if enabled in future, would process payment data under Stripe's own policy. Webhook alerts you configure POST run results to the URL you provide.

Your rights

You can export nothing-to-export beyond what the API already returns, and you can erase everything by deleting your account. For any data question, contact us via your account.