Cookie Policy
Last updated: September 26, 2026
This page lists everything TestersWiz stores on your device or reads from it. If it is not named here, we are not doing it. For everything else about your data, see the Privacy Policy.
1. Your choices
Strictly necessary items are used without asking, because the site cannot work without them. Everything else — analytics, Google Ads measurement, push notifications and the device fingerprint — is off until you turn it on, and you can turn it off again as easily. Analytics and Google Ads measurement are asked about separately.
Change your analytics and ad measurement choices at any time: . If your browser sends a Global Privacy Control signal, we treat it as a refusal of both. You can also delete cookies and site data in your browser settings; you will then be signed out and asked again.
2. Strictly necessary cookies
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token (may be split into .0, .1) | TestersWiz (our authentication provider, Supabase) | Keeps you signed in. Cannot be read by page scripts. | Up to 400 days, or until you sign out |
| sb-…-auth-token-code-verifier | TestersWiz | Completes Sign in with Google securely | Until sign-in completes |
| Stripe cookies | Stripe, on its own checkout page | Payment security and fraud prevention, only if you start a checkout | Set by Stripe; see Stripe's cookie policy |
3. Items kept in your browser
These stay in your browser. Keeping them there sends nothing to us, and clearing your browser data removes them.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| testerswiz:analytics-consent | Local storage | Remembers whether you accepted or rejected analytics. Strictly necessary: it is how a refusal is honoured. | Until you change it or clear site data |
| testerswiz:ads-consent | Local storage | Remembers whether you accepted or rejected Google Ads measurement. Strictly necessary, for the same reason. | Until you change it or clear site data |
| testerswiz:listing-paste:v1 | Local storage | If you paste a post on the “list your app” page before signing up, holds it so the listing form can be filled in afterwards | 24 hours, or until used |
| trade-explainer:… | Local storage | Remembers that you dismissed an explanatory panel | Until you clear site data |
| testerswiz-pending-scan | Browser database | Only if you pay for a full report from the scan form: keeps the APK you chose and your answers while you are on the payment page, so the scan can start when you return. Your APK reaches us only through that upload. | Deleted when the upload starts, or after 2 hours |
| auto-unlock:… | Session storage | After you pay to unlock a free check, stops a page refresh from starting it twice | Until you close the tab |
4. Push notifications (only if you allow them)
If you choose to receive browser notifications, your browser registers our service worker (/sw.js), which only displays notifications we send, and gives us a push subscription. Notifications are delivered through your browser's push service (for example Google for Chrome, Mozilla for Firefox or Apple for Safari). Turn them off in your browser's site settings or your TestersWiz notification settings.
5. Analytics (only if you accept them)
These set no cookies, but they read information from your browser, so we load them only after you accept analytics.
| Service | Where | What it collects | Provider |
|---|---|---|---|
| Vercel Web Analytics | All pages | Page address, referrer, and browser, device type and country derived from your request; no cross-site identifier | Vercel (US) |
| Vercel Speed Insights | All pages | Page performance measurements | Vercel (US) |
| Ahrefs Web Analytics | Public marketing pages only | Page views and referrers; your IP address reaches Ahrefs as part of the request | Ahrefs |
Apart from the Google Ads measurement in section 6, we do not use advertising cookies or cross-site tracking. We do not use session replay, and we do not sell or share personal data for advertising.
6. Google Ads measurement (only if you accept it)
We advertise on Google. If you accept Google Ads measurement, our public pages load Google's tag (gtag.js) so that we can see, in totals, which visits came from our ads and whether the ads are worth paying for. It never loads on signed-in pages. We have turned ad personalisation off: what it collects is not used to build remarketing audiences or to show you personalised ads.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google's tag, on our domain | Links your visits, so that a visit from an ad can be counted as one | 90 days |
| _gcl_aw, _gcl_gs (and other _gcl_ cookies) | Google's tag, on our domain, only if you arrived by clicking one of our ads | Keeps the ad click identifier from the address you arrived at | 90 days |
| Google's own cookies (for example on doubleclick.net and google.com) | Google, on its own domains | Google's ad measurement and fraud prevention | Set by Google; see Google's policy |
What reaches Google: your IP address, browser information, the address of the page (including the ad click identifier, if you came from an ad) and the page before it. Google uses it as an independent controller, under its own privacy policy; see how Google uses information from sites that use its services.
Withdraw at any time with Cookie settings: we then delete the _gcl_ cookies on our domain and reload the page, and the tag no longer loads. Cookies Google set on its own domains can be cleared in your browser settings.
7. Device fingerprint (only if you tick the box)
On your tester profile there is an optional box. Only if you tick it, your browser computes a one-way hash of: your user agent, language, processor count, device memory, screen size and colour depth, time zone and time zone offset, touch support, and the output of drawing a small test image. We store only the hash, never the values.
We use it for one purpose: spotting the same device running several tester accounts. It is never used for advertising, never shared and never combined with data from other sites. Testing works the same whether or not you tick it. To withdraw, untick the box and save; the stored hash is deleted.
8. Embedded video (only if you press play)
Our homepage shows a video hosted on YouTube. Until you press play it is just an image served by us, and nothing is sent to YouTube. When you press play, the video loads from YouTube's privacy-enhanced service (youtube-nocookie.com), operated by Google: your IP address and browser information reach Google, and YouTube may store items in your browser to play the video and remember your viewing preferences. Google's own privacy policy applies to that. If you would rather not, don't press play; the video is also available on YouTube directly.
9. Contact
Questions about this policy: [email protected].