Privacy Policy

TestersWiz operates this service and is the controller of the personal data described below — meaning we decide what is collected and why. The processors in section 5 act on our instructions.

Contact for any privacy matter, including the rights in sections 8 and 9: [email protected].

Outstanding: TestersWiz is not yet incorporated, so this policy does not name a registered entity, a postal address, or an EU/UK representative under GDPR Article 27. If you are in the EU or UK and need a postal contact before that is resolved, email the address above and we will provide one. We would rather say this plainly than publish a placeholder that reads like a company.

Account data — email address, display name, and avatar URL, provided when you sign up with email or Google OAuth. Legal basis: performance of our contract with you.

Profile data — when your profile is public: your handle, bio, any links you add, your publicly listed apps and how many tests you have completed. Accounts created from 8 August 2026 start public, and nothing is published until you choose a handle — until then there is no page to see. Accounts created before that date remain private unless their owner switches them on; we did not publish anyone retroactively. You can take the page down at any time by unticking "Make my profile public" in Settings. Your email, trade record and private listings are never shown on it. Legal basis: consent, withdrawable at any time in Settings.

Listing data — the app name, package name, description, tags, testing type and any store images you upload when you list an app. Listings created from 14 August 2026 have a public, search-indexable page by default; the listing form says so before you submit, and you can unlist it at any time from the campaign page. Listings created before that date remain unlisted unless their owner publishes them — we did not publish anyone retroactively. Your Play opt-in link and tester Google Group are never public whatever this is set to: they are released only to testers you have accepted. Legal basis: our legitimate interest in operating a marketplace where apps can be found, balanced against a default you are told about and can reverse in one click.

Tester data — the Google account email you register for each campaign, and the screenshot check-ins you upload. Screenshots are re-encoded on upload, which removes EXIF metadata including GPS location. Legal basis: performance of contract.

Fraud-prevention signals — a hashed device fingerprint, and the IP address and browser user-agent recorded when you perform sensitive actions (signing up, enrolling, starting a checkout). Legal basis: our legitimate interest in preventing fraud on a reciprocal platform, where fake testing directly harms other users. We have weighed this against your interests and limited it to the narrow set of signals above rather than general behavioural tracking.

Billing data — see section 3. Collected only if you buy a membership.

Communications — messages you send through in-app chat, reports you file, and support emails. Legal basis: performance of contract, and legitimate interest in moderating abuse.

Most of TestersWiz is free, and the testing side of it always is. Tester seats are earned by trading a test for a test — they are not sold, and no payment affects testing in any way. A premium membership is an optional one-time purchase that unlocks tooling around the product. If you never buy one, this entire section does not apply to you and no billing data about you exists.

We never receive your card details. Card number, expiry, CVC and any billing address are entered on a page hosted by Stripe and transmitted to Stripe directly. They do not pass through, and are not stored on, our servers or our database. We are not asking you to take that on trust as a policy promise — it is a consequence of how the integration is built.

What we do store, and only if you subscribe:

• A Stripe customer reference (an opaque id like cus_…) linking your account to your billing record at Stripe.
• Your subscription status (active, cancelled, payment failed, and so on), the plan you chose, the price identifier, and the date your current period ends.
• A log of billing events Stripe sends us, so that questions like “why did my access change on the 3rd” can be answered.

Legal basis: performance of our contract with you for the paid service, and — for the records Stripe keeps — compliance with legal obligations including tax and anti-money-laundering law.

Stripe also processes payment data as an independent controller for its own fraud prevention and legal compliance. Its handling of that is governed by Stripe's privacy policy, which we cannot vary on your behalf.

Invoices and tax records live with Stripe, not with us. That is deliberate: the legal duty to retain financial records for several years sits with those records, and keeping a second copy here would create a retention obligation over your data that we would rather not hold. See section 7 for what this means when you delete your account.

• Operating the marketplace: matching campaigns and testers, running trades, verifying opt-ins, running the 14-day window.
• Fraud prevention: detecting duplicate accounts, fake check-ins, and coordinated abuse.
• Transactional email: campaign status and check-in reminders. We do not send marketing email unless you separately subscribe to the newsletter, which is a double opt-in and unsubscribable independently of service email.
• Taking payment and managing subscriptions, if you have one.
• Support, moderation and dispute resolution.
• Keeping the service secure, and complying with law.

What we do not do. We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not use your content, messages, screenshots or feedback to train machine learning models, and we do not sell or license it to anyone who does. We do not run third-party advertising or tracking pixels.

These are the only third parties that receive personal data, each under a data processing agreement and each acting on our instructions (except Stripe, which is also an independent controller as noted above):

If we add or replace a processor in a way that materially affects you, we will update this table and tell you as described in section 15.

Within the product, a campaign's developer sees each applicant tester's display name, rating, completed-campaign count, the Google email that tester submitted for that campaign, and that tester's check-in screenshots. Testers see the campaign's app details and the developer's display name.

If you switch your profile to public, your handle, display name, bio, links, badges and public reputation counters become visible to anyone, including search engines. Switching it back off removes it from the site; search engines may take longer to drop their copies, which is outside our control.

Nobody sees your billing data but you. Subscription status is not shown on your public profile, is not visible to other users, and is not exposed to the marketplace in any way.

We disclose data to authorities only when legally required, and to professional advisers under confidentiality. If TestersWiz is ever acquired or merged, personal data would transfer as part of that transaction and you would be told before it took effect.

• Screenshots: retained for the campaign's dispute window and deleted with your account.
• Fraud signals (IP, fingerprint hashes): retained while your account exists.
• Account and profile data: deleted when you delete your account.
• Billing links held by us (the Stripe customer reference, your subscription status, and our billing event log): deleted when you delete your account.
• Invoices and payment records held by Stripe: retained by Stripe under its own legal obligations, typically for several years, and not deleted when you delete your TestersWiz account.

That last point is the one worth reading twice, because it is a real limit on erasure rather than a formality. Tax, accounting and anti-money-laundering law require records of completed transactions to be kept, and that duty overrides a deletion request for those specific records. It applies to the invoice — the fact that a payment of a given amount was made on a given date by a given payer — and not to your TestersWiz profile, screenshots, messages or campaigns, all of which are deleted. To ask Stripe about the data it holds directly, contact Stripe.

If the GDPR or UK GDPR applies to you, you have the right to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent. Withdrawing consent does not affect processing already carried out.

You can exercise the two biggest ones yourself, immediately, from Settings: download a complete JSON export of your data, or delete your account. Deletion removes your profile, screenshots, campaigns, enrollments, trades and the billing links described in section 7, subject to the Stripe retention limit set out there.

For anything else, email [email protected]. We respond within 30 days and will not charge you for a reasonable request. If we need to refuse or extend, we will tell you why. You also have the right to complain to your local data-protection authority, and you can do that without asking us first.

If you live in California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you have the right to know what we collect, to access and delete it, to correct it, and to appeal a refusal. Use the same contact address above; we will not discriminate against you for exercising any of these.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. There is therefore no “Do Not Sell or Share” mechanism to offer, because there is nothing for it to switch off. We do not process sensitive personal information for the purpose of inferring characteristics.

• Row-level security scopes every database read and write to the signed-in user.
• Screenshots live in a private bucket, served only through short-lived signed URLs to authorized viewers.
• Card details never reach our systems; membership records are written only by Stripe's signed webhook, never by a browser.
• Secrets are held in the hosting platform's encrypted environment, not in code.
• Data is encrypted in transit (TLS) and at rest by our infrastructure providers.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay where the risk to you is high.

Our providers may process data in the United States and other countries. Where the GDPR or UK GDPR applies, transfers outside the EEA or UK rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or an adequacy decision, as set out in each provider's data processing agreement. You can request a copy of the relevant safeguards from the contact address above.

We use strictly necessary cookies only: a session cookie that keeps you signed in, and short-lived cookies set during checkout and by our bot-protection challenge. These are required for the service to function, so they do not require consent.

We do not use advertising cookies, third-party tracking pixels, or cross-site profiling. Analytics is aggregate and does not build a profile of you.

Two systems act automatically on your data: fraud detection, which can queue an account for human review, and moderation, which can flag content. Neither bans an account on its own — a person makes that decision, which is why the fraud queue is a queue.

If an automated process affects you, you can ask for human review and contest the outcome by emailing the address above.

The Service requires you to be 18 or older. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

We will announce material changes to this policy by email or in-product notice before they take effect, not afterwards.

Recent material change. August 10, 2026 — added paid memberships. New sections cover billing data, Stripe as a processor, and the retention rules that come with financial records.

Privacy contact: [email protected]. We accept and respond to privacy requests by email. A postal address and, if required, an EU/UK representative will be published here on incorporation — see the note in section 1.