TesterAgentPrivacy policy
TesterAgent collects only what it needs to run your checks and bill subscriptions. We never see or store the passwords or one-time codes you type in the live login view, never receive full card numbers, and do not sell data or show ads. You can download or delete your data yourself on the Account page.
What we collect
- Account: email address, name (optional), password hash (scrypt — never the password itself), report language, the Terms version you accepted and when.
- Websites and apps: the addresses you add, your test settings, optional login-page addresses, your “I own this website” confirmation, the login steps learned during a checkpoint (step names and page paths only) and the names and sizes of APK files you upload.
- Audit results: reports, findings, test cases and screenshots of the pages and app screens we test — these can include logged-in areas and whatever those pages show.
- Uploaded APK files: analysed, then deleted right after the analysis.
- Free check without an account: a one-way keyed hash of your IP address (to allow one free check per 30 days) and the report.
- How you found us: the first-party
lnl_srccookie stores the campaign tag, the referring site’s domain and the landing page; we save it on your account at sign-up and count sign-ups per channel. No IP address or email in it. - Billing: your plan, status, renewal dates, the payment provider’s customer and subscription ids, card brand and last 4 digits. Your billing name, address and full payment details are collected and held by Lemon Squeezy (or PayPal), not by us.
- Misuse reports / opt-out requests you send with our form: your email, the domain and your message.
- Logs: server logs with time, account email or “no account”, the address being tested and errors. Our web server keeps no access log of IP addresses; IP addresses are held in memory for up to an hour for rate limiting. Cloudflare processes IP addresses to deliver and protect the site.
- Emails we send you (confirmation, password reset, “audit ready”, “login needed”) go through our email provider.
What we never collect
- Passwords, one-time codes or anything else you type in the live login view — it goes straight to the test browser or phone and is never logged, stored or forwarded.
- Full card numbers or bank details — Lemon Squeezy / PayPal handle payment.
- Data for advertising: no ads, no cross-site tracking, no sale or rental of personal data.
Why we use it (purposes and legal bases)
| Purpose | Legal basis |
|---|---|
| Running your account, checks and reports; sending account emails | Contract (providing the service you asked for) |
| Billing, invoices and tax (through Lemon Squeezy / PayPal) | Contract; legal obligation |
| One free check per visitor (IP hash), rate limits, blocking private networks and blocked domains, handling misuse reports | Legitimate interest (preventing abuse and protecting site owners) |
Counting sign-ups per traffic channel (lnl_src) | Legitimate interest (knowing which channels work); you can decline it in the cookie banner when shown, or block cookies |
| Optional analytics on public pages | Consent (only after you click Accept) |
| Keeping records of Terms acceptance and site-ownership confirmations | Legitimate interest; legal claims |
How long we keep it
Every retention period, with the automatic deletion jobs, is on the Data retention policy. Summary:
| Data | Kept |
|---|---|
| Account: email, name, password hash (scrypt — never the password), report language, accepted Terms version and date, how you first found us | Until you delete your account |
| Websites you add: address, test settings, optional login-page addresses, the login steps a checkpoint learned (step names and page paths — never what you typed), your “I own this website” confirmation | Until you remove the site or delete your account |
| Audit reports: scores, findings, HTML / Markdown / JSON report, test cases | In your history until you remove the site or delete your account (app reports: until you delete your account) |
| Screenshots of tested pages and app screens, including logged-in areas (stored on Cloudinary under random addresses) | Deleted automatically 90 days after the audit started (free check: 7 days) |
| Raw check files on our server (per-check results, audit log) | Deleted 90 days after the audit ended |
| Screenshot upload records (which image, size, upload status — not the image) | 365 days after the upload; deleted with your account |
| Uploaded APK file | Deleted right after the analysis (or when the audit is cancelled) |
| The app installed on our test phone, with its data | Deleted when the audit ends |
| Logged-in browser session of your site (cookies and storage after you log in) | Deleted when the audit ends — we never see or store your password or one-time codes |
| Free check without an account: the report | 7 days |
| Free check: one-way keyed hash of your IP address | 30 days |
| Sign-in session (random token, stored only as a hash) | 30 days, or until you sign out |
| Email links (confirm email, reset password) | Until used, or 48 hours / 2 hours |
| Monthly usage counters | Until you delete your account |
| Billing status: plan, status, renewal dates, provider customer and subscription ids, card brand and last 4 digits | Until you delete your account. Invoices and payment records are kept by Lemon Squeezy (or PayPal) under their own policies |
| Payment notifications (webhooks) from Lemon Squeezy / PayPal — contain your billing name and email | 90 days |
| Misuse reports and opt-out requests sent with our form (your email, the domain, your message) | 365 days |
| Blocked-domain list (domain, reason) | Until the block is removed |
| Sign-ups and free checks counted per traffic channel (no personal data) | 400 days |
How we protect it
- HTTPS everywhere; passwords hashed with scrypt; sign-in and email tokens stored only as SHA-256 hashes; cookies HttpOnly and SameSite.
- Reports are served sandboxed (they contain text from tested sites); screenshot addresses contain a random part; all ids are random UUIDs.
- Logged-in sessions live only in a private folder during the audit and are deleted when it ends; the live login channel never records what you type.
- Our test browsers cannot reach private networks. More: Security.
Your rights and how to use them
- Access and portability: Account → Download my data gives you a JSON file with your account, sites, audits, reports, billing status and upload history.
- Deletion: Account → Delete my account deletes your account, sites, audits, reports, screenshots on Cloudinary, upload history and sessions at once. Cancel a running subscription first (Billing page), so Lemon Squeezy does not charge you again.
- Correction: change your report language in the dashboard; for your name or email, write to us.
- Objection / restriction: decline the cookie banner, remove a site, or write to us.
- Write to [[OWNER: privacy email (PRIVACY_EMAIL)]] / the Contact page for anything else. We answer within 30 days. Depending on where you live (for example the EU/UK GDPR or Thailand’s PDPA) you may also complain to your data-protection authority.
Children
TesterAgent is a business tool and not meant for anyone under 16. We do not knowingly collect data from children; if you think we have, contact us and we delete it.
Changes
This is version 2026-10-07. When our processing changes we update this page and the date above, and email account holders about important changes.