Last updated September 30, 2026
Privacy Policy
This privacy policy in short
- We keep what it takes to sign you in, bill you and show you your test results, and nothing for advertising.
- Page text and screenshots go to AI models only through providers that keep no copy and do not train on them.
- Test-account passwords are encrypted and never reach the AI.
- Screenshots are deleted after 30 days on Free and 90 days on Pro, and everything goes when you delete an app or your account.
- You can ask for a copy of your data, or for its deletion, at any time.
1. About you
- Your Google account: email address, name and profile picture, used to sign you in and to reach you about payments and support.
- Your session: a random token in a cookie; the database stores only its hash.
- Plan, credits and purchases: your plan and renewal date, how many credits you have, what used them, and for each payment the order number, product, amount and date.
- API keys: a name you choose, when each key was created and last used, and a hash of the key. The key itself is shown to you once and never stored.
- Chat: the messages you exchange with TestRuna about each app.
- Support: the emails you send to our support address and our replies.
2. About the apps you test
- The address, the description you give us and your test settings.
- What our browser sees: screenshots, the text and structure of pages, console errors and the addresses of failed requests, plus the steps it recorded for each test.
- Test accounts: if you add one, its password is encrypted (AES-256-GCM) before it is stored. It is typed into your app's sign-in page by our browser and is never shown to the AI or to you again. The browser session created with it is deleted when the run ends.
- Report recipients: email addresses you add to receive a summary after each run. Every report has a one-click link that takes that address off the app's list.
If the app you test shows personal data, it can appear in screenshots and page text. Use test accounts and test data where you can.
3. How AI is used
To design and run tests and to answer you, we send page text, screenshots of the page being checked, your app description and your chat messages to AI models through OpenRouter. Every request is restricted to providers that keep no copy and do not use it for training (OpenRouter's zero data retention routing). Passwords are replaced with placeholders before anything reaches a model. Some failed checks get a second opinion from another model, TypeSafe's Jev, through the same routing; it sees the expected result, the page address and the page text.
4. Who else processes data
| Service | What for |
|---|---|
| Sign-in. We receive your email address, name and profile picture, never your password. | |
| Railway | Hosting of the app, the database and stored screenshots (servers in Singapore), and of the browsers that test your app (in the eastern United States). |
| OpenRouter and the AI providers it routes to | Page text, screenshots and your messages, to design tests, run them and answer you. Restricted to providers with zero data retention that do not train on prompts. |
| Stripe | Card payments, through our own payment service. Stripe receives your payment details; we receive only the result. |
| Cloudflare | DNS, forwarding of email sent to our support address, and delivery of test report emails. |
We do not sell or share personal data for advertising, and we do not use your apps or results to train anything.
5. Cookies
| Cookie | Purpose | Kept for |
|---|---|---|
tr_session | Keeps you signed in. Holds a random token; we store only its hash. | 30 days |
tr_oauth_state, tr_next | Protect the Google sign-in against forgery and remember where to send you back. | 10 minutes |
tr_access | Only set for the operator’s own access code. | 30 days |
All of them are needed for the site to work, so there is no cookie banner.
6. How long we keep it
- Screenshots and results of test runs: 30 days on Free, 90 days while you are on Pro. The latest result of each test stays until you delete the app, because the test map shows it.
- Apps, chats and recorded tests: until you delete the app or your account.
- Report recipients: until they unsubscribe, you remove them, or you delete the app. You can also switch an app's reports off at any time.
- Purchase records: kept after account deletion, because payments must stay reconcilable with the payment processor's records.
7. Deleting and getting your data
Delete an app from its Settings panel, and your whole account from the Billing page. Both take effect immediately and remove the screenshots from our storage. For a copy of your data, a correction, questions about this privacy policy or anything else (including the rights you have under the GDPR, the UK GDPR or California law), email support@testruna.com. We answer within 30 days.
8. Where data is processed
The app and its database run in Singapore; the browsers that visit the apps you test run in the eastern United States, and some of the services above process data in the United States. By using TestRuna from elsewhere, including the EU and the UK, your data is transferred there under those providers' standard safeguards.
9. How we protect it
- Every connection to TestRuna uses HTTPS, and the database is not reachable from the internet.
- Session tokens and API keys are stored only as hashes, and test-account passwords are encrypted (AES-256-GCM).
- Screenshots are served only to the account the app belongs to, and to us when we need to help with it or look into abuse.
- The browsers that visit your app run as a separate service that holds no database or payment credentials.
10. Email
We send no newsletters or marketing email. We write to you only about your account, payments or support, and run reports go only to the addresses added in an app's settings, each with a one-click unsubscribe.
11. Server logs
Like any website, our hosting provider records requests to testruna.com (IP address, browser, the page requested and the time). We use these logs to keep the service running and to investigate abuse, and the provider deletes them after a short period.
12. Children
TestRuna is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes to this privacy policy
When this privacy policy changes, the date at the top changes too. Significant changes will also be announced in the app.
14. Questions about this privacy policy
Write to support@testruna.com from the email address of your TestRuna account, so we can match the request to it.