Privacy Policy

Version: August 2026

1. Privacy at a glance

testr is a tool for manual test plans. Two different kinds of data are involved, and the roles differ between them:

• Your account data — the data that arises because you use testr. For this we are the controller within the meaning of the GDPR.
• Your testers' data — names, e-mail addresses and test results of the people you invite to your projects. For this you are the controller; we process it solely on your behalf (see section 6).

We use no advertising networks, no analytics or tracking services, no social media plugins and no newsletter systems. There is no profiling and no automated decision-making. Data is not sold to third parties.

2. Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the user contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations for payments) and, where consent has been given, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site and all interfaces of the service are delivered exclusively over an encrypted connection (recognisable by https:// in the address bar). Data transmitted cannot therefore be read by third parties.

3. Hosting

testr runs on a server in a data centre within the European Union. All application data — accounts, projects, catalogues, test results and image evidence — is held on that server. No content delivery network is used; fonts, icons and scripts are also delivered from our own server and not loaded from external hosts.

4. Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse.

To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time. On a project's public application page we additionally count how many applications arrive per IP address, hour and project in order to prevent bulk entries.

Contacting us

If you write to us by e-mail, we process your details in order to handle the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

5. Account and sign-in

Using testr requires an account. In doing so we process:

• e-mail address and, where given, name
• the password — solely as a non-reversible hash, never in plain text
• a session identifier by which the application recognises you on each request
• the plan booked and the confirmation status of the account
• timestamps of creation and last change
• time-limited identifiers for the confirmation e-mail and for resetting the password

The legal basis is Art. 6(1)(b) GDPR. The account is valid for testr only. Other applications of the provider maintain separate accounts with their own records, even for the same e-mail address; no comparison takes place between them.

6. Test plans, testers and applications

When you create a project, the following content arises on the server:

• project name and description, the question catalogue with sections, groups and check items
• per tester: name, e-mail address, an access token, the status and the sections assigned
• per test sheet: the answers, comments, the device and version details entered by the tester and any image evidence attached
• where the application page is enabled: the open applications with name, e-mail address and note

For this data you as the account holder are the controller; we process it solely on your documented instructions (Art. 28 GDPR). A data processing agreement is available on request. You decide whom you invite, what data arises in the process and when it is deleted; we do not access its content except where necessary for operation, backup and fault resolution.

Each account's data resides in a directory of its own on the server. The files holding testers' names and e-mail addresses cannot be fetched directly over the web; only the server reads them, and permission is checked on every single request.

A tester's access consists of a project identifier and a token, which sit after the hash sign of the address. Browsers do not send that part of an address to the server, so it appears neither in log files nor in the referrer.

An application submitted through the public application page only takes effect once the e-mail address has been confirmed; unconfirmed applications are deleted automatically after seven days.

7. E-mail

The service sends e-mail only in response to an event: confirmation of registration, password reset, invitation of a tester, confirmation and approval of an application. Dispatch is handled by the provider's mail server. There is no advertising or newsletter mailing.

8. Payment providers

When a paid plan is purchased, the payment is processed by one of the following providers — which one is your choice during checkout:

• Stripe — Stripe Payments Europe Ltd., Dublin, Ireland
• PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
• SumUp — SumUp Limited, Dublin, Ireland

Payment details are entered with the respective provider; complete card data never reaches our server. What is transmitted is the amount due, the plan level and a transaction identifier. The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR for retention under commercial and tax law. The privacy notices of the respective provider apply in addition. If the purchase is made through a distribution platform (e.g. the Apple App Store), that platform's notices apply.

9. Storage in the browser

The service stores data in your browser's local storage. These entries stay on your device and are not transmitted to us:

• the administration session (account identifier, session identifier, display name)
• the project last selected and which table rows are expanded
• the chosen language and the light/dark setting
• for testers, the test sheet state not yet transmitted — it goes to the server automatically as soon as a connection is available again

The legal basis is Art. 6(1)(b) GDPR; the storage is necessary for operation. Signing out and clearing browser data removes these entries. We set no cookies for advertising or analytics; the marketing home page sets only the technically necessary session cookie of the web server.

10. Push messages in the app

If you use testr as an iOS app and allow notifications, the operating system generates, via Firebase Cloud Messaging (Google Ireland Limited), a device identifier that we assign to your account so we can send you notices about your projects. The legal basis is your consent under Art. 6(1)(a) GDPR, given by allowing notifications in the operating system. You can withdraw it at any time in your device settings; the stored device identifier is then no longer used and is removed when the account is deleted. There are no push messages in the browser.

11. Retention and deletion

• Account data — until you delete the account.
• Projects, catalogues, testers and results — until you delete them or your account. We do not delete them on our own initiative.
• Unconfirmed applications — automatically after seven days.
• Access logs — after 30 days at the latest.
• Payment records — for the statutory retention periods, as a rule six to ten years.

You delete your account yourself via the danger zone in the account area of the administration. All projects, catalogues, tester data, answers and image evidence are removed from the server and the account is deactivated. The action cannot be reversed — an export as a JSON file should be created beforehand. Accounts with other applications of the provider are unaffected and must be deleted there separately.

12. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent given can be withdrawn at any time with effect for the future.

Please contact [email protected]. If you are a tester in a project, please address your request first to the account holder who invited you — they are the controller for that data; otherwise we will forward requests to them.

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

13. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version published here at the time applies. In the case of substantial changes we additionally inform account holders in the application or by e-mail.