Privacy Policy

The operator named at the top of this page runs TestersWiz and is the controller of the personal data described here: we decide what is collected and why. For personal data contained in apps or configuration that a business customer submits to our security tools, we act on that customer's behalf as described in our Data Processing Addendum.

Contact for any privacy matter, including the rights in sections 9 and 10: [email protected].

Account data. When you sign in with Google: your email address, name and profile picture URL, and Google's identifier for your account. We never receive your Google password. We also record that you confirmed you are 18 or older and which version of the Terms and this policy you accepted, and when.

Profile data. Your display name, handle, bio, links, chosen avatar hat, badges, and counters such as tests completed and trades completed or failed.

Listing data. For each app you list: name, package name, description, tags, testing type, store icon and screenshots, your Play opt-in link and tester Google Group, whether you are open to trades, whether you allowed a video review, and launch readiness and pre-flight answers.

Testing data. The Google account email you register for each test; your install proof and check-in screenshots, which are re-encoded on upload so that EXIF metadata, including GPS location, is removed; a perceptual hash of each screenshot, used to spot the same image being reused; feedback you write about apps; ratings; and the status of your tests, trades and strikes.

Community data. Chat messages, posts, likes, follows, launch votes, reports you make about other members or posts, and blocks. If our automated filter rejects a message or post, we keep the rejected text with your IP address for 90 days.

Wizbits. A ledger of Wizbits you earned, bought and spent, and records of earning you were refused because a cap was reached.

Notifications and email. Notifications we show you in the product, your notification preferences (including the daily digest), and, if you allow browser push notifications, the push subscription your browser gives us (an endpoint address and encryption keys). If you subscribe to the newsletter, which you can do without an account, your email address and the confirmation of your subscription.

Bug reports and support. The subject, description and page of any bug report you file, and anything you send us by email.

Fraud-prevention signals. Your IP address and browser user-agent, recorded when you take an action that changes something on the platform (for example applying to a test, listing an app, answering a trade, posting, reporting someone, buying something or deleting your account). Ordinary browsing is not recorded. Patterns of Wizbit earning, and links between accounts, may be flagged for a person to review. A device fingerprint is taken only if you tick the optional box on your tester profile (section 13).

Security Briefing answers. Answers you give about your app and the label you give each briefing. They describe your app, not you.

Security track data. If you use it: which stages you reached, the outcome and counts you enter, and the known-vulnerability findings for the dependency list you paste. We never store your source code or raw scanner output.

App Security Check data. We stopped offering the App Security Check on 5 October 2026 and deleted the apps, scan results, reports and app registrations it held. We keep only payment records for checks bought before then (see Billing data).

Database Security Audit data. If you use it: the results only. What you paste is analysed in memory and never stored, logged or sent to an AI provider. The results name your schemas, tables, columns, policies, functions, views, indexes and storage buckets and quote short evidence, with anything that looks like a secret masked. You must not paste passwords, keys or customer data.

Billing data. Only if you buy something - a Wizbit pack, or before 5 October 2026 an App Security Check or a Database Security Audit: what you bought, the amount and currency, Stripe's payment references, refunds and chargebacks, the acknowledgement you ticked about delivery and withdrawal, and a log of the billing events Stripe sends us. Card details are entered on Stripe's page and never reach our servers.

Video reviews. If you allow a video review of an app you list, the video we publish shows the app, its name and icon.

Product analytics. We record no product events about you. Page analytics and Google Ads measurement run only with your consent (section 13).

• From you, when you sign up, list, test, write, upload, paste or buy.
• From Google, when you sign in (email, name, picture).
• From other members: feedback and ratings about an app you listed, reports about you, and the record of trades you are part of.
• From Stripe: whether a payment succeeded, failed or was refunded.
• From your browser, automatically: IP address and user-agent (section 2).

If the GDPR or UK GDPR applies to you, these are our purposes and the legal basis for each. "Contract" means we need the data to provide the Service you asked for; "legitimate interests" means we have weighed our interest against your rights and you can object (section 9).

What we do not do. We do not sell personal data, share it for cross-context behavioural advertising, or use your content, messages, screenshots, apps or reports to train machine-learning models. The only advertising technology on the site is Google's tag for measuring our own ads: it runs on public pages only, only if you accept it, and with ad personalisation turned off. We send marketing email only to newsletter subscribers. Messages our team sends you by email are about your account and the Service: service notices every member receives, and announcements you can switch off in your notification settings or with the link in each one.

We send none of your data to an AI provider. The Database Security Audit and the security track make no AI call. Until 5 October 2026, paid App Security Check reports sent a redacted summary of their findings to Anthropic to write explanations; that product has ended and nothing is sent any more.

Service providers (processors). These act on our instructions under data processing terms:

Independent recipients. These decide for themselves how to use what they receive, under their own privacy policies:

We will update these tables before adding or replacing a provider that receives personal data, and tell you as described in section 16.

Developers and testers. A campaign's developer sees each applicant tester's display name, rating, completed-test count, the Google email that tester registered for that campaign, their check-in screenshots and feedback. Signed-in members see a listing's app details, the developer's display name and the developer's trade record (trades completed and failed). Strike counts and whether your trading is paused are not shown to other members.

Public profiles and listings. A public profile shows your handle, display name, bio, links, badges and public counters to anyone, including search engines. A public listing shows the app's details. Your email, trade record, opt-in link and tester group are never public. Make either private at any time; search engines may take time to drop their copies.

Our administrators can read the platform's records — listings, applications and the Google emails in them, check-ins and screenshots, trades, chat messages, reports, bug reports and fraud signals — when a dispute, report, fraud signal or support request calls for it, not to browse. There is no administrator view of your Security Briefings or database audits.

Billing data is visible only to you and to us.

• Account, profile, listing, community and Wizbit data: while your account exists; deleted when you delete it, except as below.
• Check-in screenshots: while the tester's account and the campaign both exist, because they are the evidence a test happened. They are deleted when the tester deletes their account or the developer deletes the account that listed the campaign.
• IP address and user-agent records, and rejected messages: deleted after 90 days.
• Device fingerprint: until you withdraw consent (untick the box and save) or delete your account.
• Chat messages you sent: kept in the other person's copy of the conversation after you delete your account, shown as from “Deleted user”, because a chat can be the only record of what was agreed in a trade or a dispute.
• Newsletter subscription: until you unsubscribe or delete your account.
• Acceptance records: while your account exists.
• Database Security Audit results: 365 days after creation.
• Database configuration you paste: never stored. Report PDFs: generated on request and not stored.
• Billing links: the Stripe customer reference and purchase records are deleted with your account. Entries in our billing event log are unlinked from your account and kept, so the same payment can never be applied twice.
• Invoices and payment records held by Stripe: kept by Stripe under its own legal obligations, typically for several years, and not deleted when you delete your TestersWiz account. Tax and accounting law requires them.
• Published video reviews: until you ask us to take them down.

If the GDPR or UK GDPR applies to you, you have the right to access, rectify, erase, restrict and port your personal data; to object to processing based on legitimate interests, including profiling for fraud prevention; and to withdraw consent at any time without affecting processing already done.

Do it yourself, now. From Settings you can download a JSON export of your data, with links to download your screenshots, and delete your account. Make a profile or listing private, turn off notifications and the digest, withdraw fingerprint consent from your tester profile, and change your analytics and ad measurement choices with the Cookie settings link. Account deletion waits until any campaign you run or seat you hold has finished, so that leaving never breaks another member's test; if you need it sooner, email us.

What the export leaves out. Other people's personal data (for example, the other side of a conversation, or who reported you) and fraud-review flags where telling you would prejudice the prevention of fraud. You can still ask us about them, and we will tell you what we can.

Anything else: email [email protected]. We respond within one month, which the law lets us extend by two further months for complex requests; we will tell you if we do and why. We will not charge you for a reasonable request, and we may need to confirm your identity first. You can complain to your data protection authority at any time, without asking us first.

If you live in a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Florida and New Jersey — you have the right to know what we collect, to access it, to correct it, to delete it, to obtain a portable copy, and to appeal if we refuse. Use the contact address above. We will not discriminate against you for exercising them.

Notice at collection (California). In the last 12 months we collected these categories, for the purposes in section 4, from the sources in section 3, and disclosed them for business purposes to the service providers in section 6. We keep each for the periods in section 8.

We do not collect sensitive personal information as the CCPA defines it for the purpose of inferring characteristics. We do not sell or share personal information, so there is no “Do Not Sell or Share” link. Google Ads measurement runs with ad personalisation off and Google's restricted data processing on, which limits Google to measuring our ads. We treat a Global Privacy Control signal as a refusal of analytics and of ad measurement.

How long we take. We acknowledge a request within 10 days and answer within 45 days, extending once by 45 days if it is genuinely complex and telling you why. If we refuse, you may appeal by replying; we answer an appeal within 45 days and, if we still refuse, tell you how to complain to your state Attorney General. You may use an authorised agent; we will ask for proof of their authority and may ask you to confirm it.

• Row-level security and column permissions in the database decide what each account can read and write.
• Screenshots are in a private bucket, served only through short-lived signed links to people allowed to see them.
• Session cookies cannot be read by page scripts.
• Card details never reach our systems; purchases are recorded only from Stripe's signed webhook.
• Data is encrypted in transit and at rest by our infrastructure providers; uploaded apps are encrypted with a dedicated key.
• Uploaded apps are checked by their contents, analysed in an isolated environment with no internet access, and never run.
• Anything that looks like a secret is masked before it is stored, shown or sent to our AI provider.
• Abuse-prone actions are rate-limited per account and per IP address.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority within 72 hours where the law requires it, and notify you without undue delay where the risk to you is high. To report a vulnerability, see our Security Policy.

We are based in the United States and our providers process data in the United States, Canada, the EU and other countries. Our main database is in Canada, which the European Commission and the UK recognise as providing adequate protection. Apps you upload are stored and analysed in Ireland. Where the GDPR or UK GDPR applies, transfers outside the EEA or UK rely on an adequacy decision (including the EU-US Data Privacy Framework for providers certified under it) or on the European Commission's Standard Contractual Clauses with the UK Addendum, as set out in each provider's data processing agreement. You can ask for a copy of the relevant safeguards.

Our Cookie Policy lists everything we store on or read from your device. In short: sign-in cookies that are strictly necessary; a few items in your browser that remember choices you made; analytics and Google Ads measurement that load only if you accept them; push notifications only if your browser grants permission; and a device fingerprint only if you tick the optional box on your tester profile.

Security reports are produced automatically by our own rules. They assess a configuration, not you.

Two systems act automatically on your data: fraud detection, which can queue an account for human review, and moderation, which can reject a message or post that contains links or abusive words, and flag content for review. Neither bans or restricts an account on its own — a person makes that decision. You can ask for human review of any automated outcome by emailing [email protected].

TestersWiz is only for people aged 18 or older, and everyone confirms their age at sign-up. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, email us and we will close it and delete its data.

We will tell you about material changes to this policy by email or in the product before they take effect.

Privacy contact: [email protected]. We accept and respond to privacy requests by email.