Privacy Policy

This policy applies to https://clickproof.app, the clickproof dashboard, and the test runs the service performs on your behalf. It does not cover the apps you test: what your own app collects from its users is governed by your privacy policy, not this one.

If your organization signed a separate data processing agreement with us, that agreement takes precedence wherever the two disagree.

Everything below is either something you give us or something a test run produces.

• Account - your name, email address, and a hashed password. If you sign in with Google we receive your name, email address, and profile picture instead, and never see your Google password.
• Organization - the organization name, its members, their roles, and pending invitations.
• What you upload - your Android or iOS build, project names, and the plain-English test descriptions you write.
• Test credentials - the username and password you save so a test can sign in to your app. See test credentials, which explains how these are treated differently from everything else here.
• Run artifacts - a screenshot of every step, a screen recording of the session, the sequence of actions the agent took, and its verdict. These show whatever your app displayed while the test ran, which may include data belonging to the account the test signed in as.
• Billing - your plan, run and storage counters, and an identifier for your customer record at our payment provider. Card numbers are entered on the provider’s checkout and never reach us.
• Integrations - if you connect GitHub, the installation and repository identifiers, and metadata about the pull requests we report on.
• Operational records - an audit log of actions taken in your organization, server logs, and any feedback or waitlist form you submit.

We do not run advertising trackers, third-party analytics, or session recording on the site, and we do not buy or enrich data about you from anyone else.

• To run the tests you ask for, and to show you the result.
• To keep your account, organization, and access controls working.
• To bill you, count usage against your plan, and prevent one organization from consuming another’s capacity.
• To investigate faults, abuse, and security incidents.
• To reply when you contact us, and to send service notices such as a failed payment or a change to these terms.
• To meet a legal obligation, where one applies.

We do not sell your data, and we do not share it for advertising. We do not send marketing email to people who have not asked for it.

Credentials you save for a project are encrypted with AES-256-GCM before they are stored, and the key is held outside the database. They are decrypted only inside the test runner, at the moment a run needs to type them, and are never sent back to your browser or shown in the dashboard.

A test run records what the agent typed, so a password would otherwise appear in plain text in the step trace, in every report, and in any link you shared. It does not: the trace is scrubbed of the saved username and password before the run is written to the database.

Use a dedicated test account rather than a real one. Encryption protects the stored value; it cannot stop a test from displaying whatever that account can see on screen, and those screenshots are kept with the run.

Driving a test means sending a screenshot of the current screen and your test description to a model provider, which returns the next action to take. This happens once per step, for as long as the run lasts.

We use these providers through their business APIs, under terms that do not permit customer content to be used to train their models. We do not train any model on your app, your test data, or your run artifacts.

Running a test on a real device in the cloud necessarily involves other companies. These are all of them.

Each is bound by its own agreement with us to process data only on our instructions. We will update this list before adding anyone new.

Outside the services listed above, we disclose your data only:

• To other members of your organization, according to their role.
• To anyone you deliberately give a share link to - see below.
• When a valid legal request compels us, after checking that it is valid and, where we are allowed to, telling you first.
• To protect the service or someone’s safety, in an emergency.
• To a successor, if the business is acquired, under the same commitments made here.

A run report can be opened with a signed link that does not require an account, so a reviewer on a pull request can see a failure without signing up. Anyone holding that link can see the report, including its screenshots and recording.

Links expire after a period you control, 30 days by default. A project can be switched so that report links only work for members of your organization, which is the setting to use if your tests run against data you would not want travelling in a link.

We set one cookie, which keeps you signed in. There are no advertising cookies, no analytics cookies, and nothing to opt out of. Clearing it signs you out.

• Traffic is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure providers.
• Test credentials get a second layer of application-level encryption, described above.
• API keys are stored only as a hash; the key itself is shown once and cannot be recovered.
• Every query is scoped to your organization, so one customer cannot read another’s projects, runs, or artifacts.
• Devices are destroyed after each run rather than reused.

No system is perfectly secure. If you believe you have found a vulnerability, please write to support@clickproof.app before disclosing it publicly, and we will work with you on a fix.

• Account and organization records are kept while the account exists.
• Runs, screenshots, and recordings are kept until you delete them or your plan’s storage allowance is reached, at which point the oldest artifacts are removed first.
• Uploaded builds are kept so that a queued run can install them; superseded builds are removed.
• Billing records are kept for as long as tax and accounting law requires, which is longer than the rest.

Deleting an organization deletes its projects, tests, runs, artifacts, and stored credentials. Backups are overwritten on their own schedule, so a deleted record can survive briefly in a backup before it is gone for good.

Our infrastructure and the services above operate across several countries, so your data may be processed outside the one you are in. Where that involves personal data leaving the European Economic Area or the United Kingdom, the transfer relies on Standard Contractual Clauses or an equivalent approved mechanism in our agreement with each provider.

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, object to how we use it, receive a portable copy, or withdraw consent. Californian residents additionally have the right not to be discriminated against for exercising these rights.

Much of this you can do yourself in the dashboard. For anything else, write to support@clickproof.app and we will respond within 30 days. We will not charge you for it or ask why.

When we handle data on a customer's behalf we act as a processor, and requests from that customer's users should go to the customer, who we will help.

clickproof is a tool for software teams and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.

We will update the date at the top when this changes. If a change materially affects how we handle your data, we will email account holders before it takes effect rather than relying on you to notice.

Questions about this policy, or about data we hold, go to support@clickproof.app.

clickproof. See also our Terms of Service.