Privacy notice
Updated 17 October 2026
This notice describes how the Testsy customer app at app.testsy.dev handles information when you create an account, sign in and use its QA testing features.
Account and workspace information
Testsy stores your email address, your name if supplied, account dates and email verification status. If you use a password, it stores a password hash. It also stores your workspace memberships and roles, project details, API key records, usage and workspace activity records. This information supports account access, collaboration, running tests and managing service limits.
Sign in with Google
When you choose Google sign-in, Google provides basic identity information: your Google account identifier, email address, email verification status and name if available. Testsy uses this to authenticate you and create or link your Testsy account. It stores your Google account identifier and, for a new account, the supplied email address and name.
Testsy requests only the OpenID Connect, email and basic profile permissions. Google sign-in does not request access to your Gmail messages, Google Drive files or other Google API content.
The server exchanges a temporary authorization code using PKCE and validates Google's identity token before signing you in. Google access tokens and refresh tokens are not retained. The Google identity is used for sign-in; signing in does not submit your Google account information to the QA models.
Google sign-in marks a matching email verified. For Gmail and Google Workspace addresses where Google confirms mailbox ownership, Testsy can automatically link an existing account with the same email, preserving its workspace. If that registration had not proved email ownership, its old password, sessions and user-created API keys are invalidated. Other Google-account email addresses may require you to sign in or reset your password first and link Google in account settings.
Cookies and sessions
Email-and-password signups must confirm their email before using workspace features. A pending session only lets you complete or resend verification and sign out. Failed email delivery does not mark an account verified.
Testsy uses a secure, HttpOnly session cookie to keep you signed in and a temporary cookie to complete Google sign-in safely. The session database stores a hash of the session identifier, session dates, your IP address and browser user-agent. Account settings use this information to show where you are signed in and let you sign out other sessions.
Tests and service providers
Testsy processes the URLs, test instructions, assistant messages, uploaded files or app builds, and test credentials you submit. Test runs can collect page content, screenshots, recordings, logs and reports from the application being tested. These can contain information visible in that application.
The app and its data services run on Cloudflare, including database and file storage. Test planning and QA execution send relevant instructions and observed application content to the configured AI provider, currently OpenAI. Browser or device runners process test inputs to carry out your test. Use test accounts and data appropriate for this processing.
Workspace members can access information according to their roles. If you create a report share link, people with that link can view the shared result and evidence until it expires or is revoked. Integrations you enable can send selected results to the connected service. Transactional emails are delivered through Cloudflare Email Service; paid billing features, when enabled, use Stripe.
Your controls and account deletion
In account settings, you can update your name, change your email, manage your password and sign out other devices. You can unlink Google once a password is set so that you retain another way to sign in. Unlinking removes the Google account identifier from your Testsy account; it does not delete your Testsy account.
You can request account deletion in account settings. If you own a workspace with other members, you must transfer ownership first. Deletion removes your sessions and memberships, clears your name, password hash and Google identifier, replaces your email with a deleted-account placeholder and marks the account deleted. Workspaces you own alone are marked deleted and their tests are archived.
Account deletion does not perform an immediate purge of all test artifacts or historical service records. Contact us about data removal questions, including retained reports, files or activity records.
Contact
For questions about this notice or your information, email nhatlongsinh@gmail.com.