Privacy Policy

1.1 This Privacy Policy applies to TestApp.io LLC ("TestApp.io", "we", "us") and to our website, Portal, mobile app ("App"), command-line and API tools, Share Links and other services (the "Services"). Words with capital letters have the meanings given in our Terms of Use.

1.2 It covers people who have a TestApp.io account, and people who do not but who visit our website, open a Share Link, install a build, or contact us.

1.3 For account, billing, website and support data, TestApp.io decides how and why the data is used. Under laws such as the GDPR, we are the "controller" of that data.

1.4 Teams use the Services to distribute their apps and to collect information about their testers, for example through Share Links, install records, comments and feedback. For that data, the Team decides how it is used, and we process it on the Team's behalf. If you are a tester and have questions about how a Team uses your data, please contact that Team. We will help them answer your request where we can.

1.5 TestApp.io does not offer an SDK, and we do not collect data from inside the apps that Teams distribute through the Services.

Our contact details are:

3.1 Account and profile data (you give it to us):

• Name, email address and profile picture.
• Password. We store only a one-way hash of it, not the password itself.
• If you sign in with a third-party sign-in provider, the account identifier, name and email address that the provider shares with us.
• Team memberships, roles and app permissions.
• Notification and email preferences.
• Optional answers to onboarding questions, such as your role or how you plan to use TestApp.io.

3.2 Content you or your Team upload:

• App builds (APK, AAB, IPA) and app icons.
• Information we read from each build, such as app name, version, version code, package name or bundle ID, minimum and target operating system or SDK version, file size, signing details such as provisioning profile expiry, and, for iOS builds, the list of provisioned device identifiers (UDIDs).
• Release notes, comments, attachments, tasks, activity, playbooks, launch details and other content you add.

3.3 Device data from our App:

• Device model, manufacturer and device name.
• Operating system and version, language and region (locale), time zone and screen size.
• App version and the store the App was installed from.
• Device identifiers, including an app-generated device ID and, if you register an iOS device for testing, its UDID.
• Push notification token and whether notifications are enabled.

The App does not collect your precise location or your contacts. It asks for access to your photos, microphone or local network only when you use a feature that needs it, such as attaching media to a comment, and only with your permission. Owners and Admins of the Teams you join can see the devices you use with the App and their identifiers, because Teams need them to install iOS test builds.

3.4 Install, visit and usage logs (collected automatically):

• IP address and an approximate location derived from it, such as city, region, country, time zone and approximate coordinates. This is not your precise location.
• Browser and device details (user agent).
• When you sign in, install or download a build, or open a Share Link.
• How you use the Portal and the App, such as pages viewed, features used and errors you encounter.

We collect install and Share Link visit data even when the person has no account, and we show it to the Team that owns the app.

3.5 Integration and storage data:

• When you connect a third-party tool, the access credentials it gives us and the data we sync with it, such as task titles, descriptions, statuses, priorities and assignees.
• When you connect External Storage, your storage provider, bucket details, region and access credentials (see Section 7).
• API and upload tokens you create, and when they were last used.

3.6 Payment data:

Our payment processor collects your payment details. We do not receive or store your full card number. We receive and keep billing records from the processor, such as your plan, amounts, currency, payment status, billing country and subscription dates.

3.7 Communications:

Messages you send us through email, support chat, our contact form or in-product feedback, newsletter sign-ups, and survey answers.

3.8 Cookies and similar technologies:

See Section 15.

3.9 We do not ask for sensitive personal data, such as health, biometric, racial or religious data. Please do not include it in content you upload.

4.1 We use personal data to:

• a) create and run your account and Teams, and provide the Services you ask for, such as distributing builds, sending notifications and syncing integrations.
• b) show install, visit and device information to the Teams that need it.
• c) process payments, trials and plan changes.
• d) keep the Services and our users secure, prevent fraud and abuse, and fix errors.
• e) understand how the Services are used, so we can improve them.
• f) send service and security messages and, where allowed, product news and offers (see Section 14).
• g) provide support and answer your requests.
• h) comply with the law and enforce our Terms.

4.2 If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performance of our contract with you (4.1 a to c, g); our legitimate interests in running a secure, reliable and improving service (4.1 b, d, e, f for existing customers); your consent, where the law requires it, for example for some cookies and marketing (4.1 e, f); and legal obligations (4.1 h). Where we rely on consent, you can withdraw it at any time.

4.3 We use data to understand how groups of users use the Services, and we may use it to send you tips or offers based on how your Team uses the Services. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

5.1 Some optional features use an AI model to generate suggestions, such as tasks drafted from your release notes. When you use them, we send the content you chose, such as the release notes, to an AI model provider that processes it on our behalf and returns the result.

5.2 We keep a record of the input and the result to run the feature, measure its quality and fix problems. Do not include personal or confidential data in content you send to AI features unless you need to.

6.1 We do not sell your personal data.

6.2 We share personal data only in these cases:

• a) With your Team: Owners, Admins and Members can see information needed to work together, such as your name, email, role, comments, installs and devices.
• b) With people you share with: anyone who opens a Share Link can see the install page, release notes and other content the Team chose to show.
• c) With integrations you connect: we send data to the third-party tools your Team connects, such as task and release details. Those tools handle the data under their own privacy policies.
• d) With our service providers: companies that process data for us under contract, listed by category in Section 6.3.
• e) For legal reasons: when the law requires it, for example in response to a valid court order, or when needed to protect the rights, property or safety of TestApp.io, our users or others.
• f) In a business transfer: as part of a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.

6.3 We use service providers ("Processors") in these categories:

• Cloud infrastructure: hosting, databases, file storage, content delivery and upload processing.
• Payment processing: checkout, subscriptions, invoicing and taxes.
• Email delivery: service, security and marketing emails.
• Analytics: product and website analytics, including tag management on our website.
• Error monitoring: finding and fixing errors in the Services.
• Real-time messaging and push notifications: live updates in the Portal and notifications on your devices.
• Sign-in providers: third-party sign-in when you choose it.
• Customer support: support chat, help center and community tools.
• Security: bot protection, abuse prevention and IP-based location lookup.
• AI model providers: generating suggestions in AI-assisted features.

Processors may use personal data only to provide their services to us. You can ask for the current list of our Processors at support@testapp.io.

7.1 If your Team connects External Storage, your Team's builds, icons and attachments are stored in a bucket that we create in your own storage account, in the region you choose where your provider offers a choice. Your storage provider's terms and privacy policy apply to that data. Apart from the settings described in Section 7.2, you control its location, retention and security settings.

7.2 Files in that bucket are uploaded as public-read objects. Anyone who has a file's direct URL can download it. For Amazon S3, we change the new bucket's public access settings so that public-read files work, and we confirm this by uploading and deleting a small test file, as described in Section 9.3 of our Terms of Use.

7.3 We store the access key and secret you give us in our systems, and we make them available only to the parts of the Services that need them to upload, read and delete your files. We do not show the secret again in the Portal after you save it.

7.4 You should rotate your storage keys regularly. On paid plans, we email your team's owners and admins a reminder when a storage key is more than 6 months old, and again every 6 months until it is rotated. When you rotate a key, update it in the Portal.

7.5 If you disconnect External Storage, we delete the bucket we created and its files, as described in Section 9.7 of our Terms of Use. We also delete the storage key and secret you gave us. We keep a record of the connection, such as the provider, bucket name and region, as described in Section 8.4.

8.1 We keep personal data for as long as your account or the relevant Team is active, and afterwards only for as long as we need it for the purposes in this Privacy Policy, such as security, resolving disputes, keeping financial records, and meeting legal obligations.

8.2 Deleting your account. You can delete your account from your account settings. When you do, we ask you to confirm by email first. Before you can delete it, you must leave every Team, or transfer or delete any Team you own. When the deletion is confirmed, we:

• remove your name, email address, password, profile picture and sign-in connections from your user profile.
• sign you out on all devices.
• delete your sign-in record held by our sign-in provider, if you used third-party sign-in.

We keep a record of the deletion, including the email address, name, profile settings and sign-in identifiers that were on the account, to show that we completed it, to handle disputes and to prevent abuse. Comments, activity and other content you added to a Team stay with that Team and are shown as coming from a "Deleted User".

8.3 Releases, apps and Teams. On plans that limit how long releases stay available, releases are archived automatically and their build files are deleted. Release details stay visible to the Team until the Team deletes them. When a Team deletes a release, app or Team, we delete the related files from storage, delete install and Share Link visit logs for that app, and mark the remaining records as deleted.

8.4 Records marked as deleted. Many records are marked as deleted rather than erased immediately, so that we can keep usage counts accurate, investigate abuse, and recover from mistakes. We will erase or anonymize personal data in these records when you make a valid erasure request (see Section 10), unless we need to keep it for a reason the law allows.

8.5 Backups. Deleted data may stay in backups for a limited time until they are replaced.

9.1 We use reasonable technical and organizational measures to protect personal data. They include:

• a) encryption of data in transit (HTTPS/TLS).
• b) one-way hashing of account passwords and Share Link passwords.
• c) access controls that limit our staff and systems to the data they need.
• d) signed sign-in tokens that expire, and the ability to revoke API tokens.
• e) bot protection on public forms.

9.2 No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9.3 You also play a part. Use a strong, unique password. Keep API tokens, upload tokens, and External Storage keys secret, and rotate or revoke them regularly. Only share Share Links and file URLs with people you trust.

9.4 If we become aware of a security breach that affects your personal data, we will notify you and the relevant authorities as required by applicable law.

10.1 Depending on where you live, you may have the right to:

• a) Know and access: learn what personal data we hold about you and get a copy.
• b) Portability: receive your data in a structured, commonly used, machine-readable format.
• c) Correct: fix inaccurate or incomplete data. You can update most profile data yourself in the Portal.
• d) Delete: ask us to delete your data. You can delete your account yourself (see Section 8.2).
• e) Object or restrict: object to, or ask us to limit, how we use your data, including for direct marketing.
• f) Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect what we did before.
• g) Opt out: of targeted advertising, sale of personal data, or profiling with legal or similarly significant effects, where the law gives you this right.
• h) Complain: to your local data protection authority.

10.2 To use your rights, email support@testapp.io from the email address on your account. We may need to verify your identity before we act. We will reply within the time the law requires, usually within 30 days, or 45 days under US state laws. We will not treat you differently for using your rights.

10.3 If your request is about data a Team collected about you as a tester (see Section 1.4), we may pass it to that Team, and we will help them respond.

10.4 We may keep some data after a request when the law allows or requires it, for example billing records or data needed to resolve a dispute.

12.1 We are based in the United States and provide the Services worldwide. We use secure cloud infrastructure that may be located in various regions worldwide, and our Processors may process data in their own locations. This means your data may be processed in countries whose data protection laws differ from those where you live.

12.2 When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, or other mechanisms permitted by law. You can ask us for more information at support@testapp.io.

The Services are for professional use and are not directed to children. We do not knowingly collect personal data from children under 13, or under the minimum age set by local law. If you believe a child has given us personal data, contact us at support@testapp.io and we will delete it.

14.1 We send service and security messages, such as sign-in codes, password resets, invitations, release and mention notifications, billing notices and account changes. You cannot opt out of essential service and security messages while you have an account.

14.2 We may also send product news, tips, recommendations, surveys and offers. You can turn these off in your notification settings or with the unsubscribe link in each email.

14.3 The App can send push notifications. You can turn them off in the App, in the Portal, or in your device settings.

14.4 Our marketing emails follow the CAN-SPAM Act. They do not use false or misleading subject lines, they include our postal address, and they include a way to unsubscribe. We honor unsubscribe requests promptly.

15.1 Cookies and similar technologies, such as local storage, are small pieces of data stored in your browser or device. We use them for these purposes:

• a) Essential: keeping you signed in, remembering your choices, and protecting forms against bots and abuse.
• b) Preferences: remembering settings such as theme and layout.
• c) Analytics: understanding how our website and the Portal are used, including through a tag manager on our website that may load analytics tools.
• d) Support and error monitoring: running our support chat and finding errors in the Services.

15.2 Some of these technologies are provided by our Processors (see Section 6.3). You can block or delete cookies in your browser settings. If you block essential cookies or storage, parts of the Services may not work.

We may update this Privacy Policy. We will post the new version on this page and update the "Last updated" date. If a change is material, we will tell you by email or in the Portal before it takes effect, as described in Section 21 of our Terms of Use.

This Privacy Policy is governed by the laws of the State of Wyoming, United States, without regard to conflict of law rules. Disputes are handled as described in Sections 22 and 23 of our Terms of Use. This does not remove any rights you have under the data protection laws where you live.

For questions, requests or complaints about this Privacy Policy or your personal data, email us at support@testapp.io, or write to us at the address in Section 2.