Privacy Policy

This policy explains how Vasyl Harastei (“we”) handles personal data. We are the controller for the data about you as our customer (your account). For the data inside the apps you test, we act as your processor; see the Data Processing Agreement.

What we collect

• Account data: your email address, a hash of your password, your workspace name, your role, and the teammates you invite.
• Sign-in with Google or GitHub (optional): only if you choose it. We receive your email address and your account ID at that provider, and use them to sign you in. We never get your password there, and we don’t store the provider’s access tokens.
• Signup source: which plan you picked on our site, the campaign tags in the link you followed (for example utm_source), and your optional answer to “How did you hear about us?”. We use it to understand which channels bring customers.
• Usage events: a few milestones of your account: completing signup, your first passing test run, creating a schedule, a schedule still running after a week, starting a subscription, and asking to be told when a paid plan opens. They are sent from our servers to PostHog (EU), linked to your account ID, and never include your app’s content or the free-text answer to “How did you hear about us?”.
• Billing data: payments are handled by Sold through Link, LLC (Stripe), our merchant of record. We see your plan, status, period, billing country and, if you buy as a business, the business name and VAT ID — never your card. We keep the business name you confirm when you buy (also in Stripe metadata).
• Support email: what you send us.

Our website

testwatch.dev sets no cookies and stores nothing on your device. We count page views without identifying you: our analytics relay forwards each page view, with your IP address and browser user agent, to PostHog (EU) in cookieless mode to derive country and device and a visitor count that changes every day; we don’t store them. We also use Cloudflare Web Analytics, which doesn’t use cookies.

The dashboard

app.testwatch.dev uses one strictly necessary cookie to keep you signed in. If you sign in with Google or GitHub, a second strictly necessary cookie protects that sign-in and expires after 10 minutes. It uses browser storage for your theme, layout choices, checklist progress and unsent drafts. The sign-up, verification and password-reset forms load Cloudflare Turnstile to block bots. It has no analytics or advertising cookies and no session recording.

Why we process it (legal bases)

• To provide the service you signed up for: account, billing, support (contract).
• To keep the service secure and prevent abuse, and to understand how people find and use TestWatch (our legitimate interests).
• To meet tax and accounting duties (legal obligation).

Who we share it with

Only the service providers listed on the sub-processors page, for the purposes stated there. We don’t sell personal data.

Where it is stored

Our servers are in Vienna, Austria (EU). Some providers, including the AI model providers (Google Vertex AI for Gemini; TypeSafe AI or DigitalOcean for Jev, reached through the Vercel AI Gateway), are based in or process data in the United States; where data leaves the EU we rely on the EU–US Data Privacy Framework or standard contractual clauses. These AI providers keep no prompts or outputs (zero data retention) and don’t train on your data.

How long we keep it

• Account data: while your account exists, and then for up to 30 days in our nightly backups.
• A deleted workspace: restorable for 7 days, then purged; then for up to 30 days in our nightly backups.
• Run evidence (screenshots, videos, page snapshots, logs): 30, 90 or 180 days depending on your plan, except evidence still awaiting your review. Results and run history: while the workspace exists.
• Server logs: 30 days.
• Emails received in test inboxes: 24 hours.
• Billing records: as long as tax law requires.

Your rights

You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on our legitimate interests. You can do much of this yourself in the dashboard under Settings → Data & privacy: download your runs and results as JSON, delete a workspace you own (restorable for 7 days), and delete your account. For anything else, email privacy@testwatch.dev. You can also complain to a data protection authority; in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).

Contact

privacy@testwatch.dev, or by post to the address in our imprint.