Scope & Definitions
This Privacy Policy describes how Testnir, Inc. (“Testnir”, “we”, “us”, or “our”) processes data in connection with the Testnir web application, its QA and developer tools, team workspaces, and related documentation available at testnir.com (collectively, the “Platform”).
Key definitions
- “Customer Content”
- Anything you create or send through the Platform: API requests and collections, environments, API Inspector rules, run results, site reviews, comments and pins, screenshots, recordings, saved AI generations, and the inputs you paste into tools.
- “Credentials & Secrets”
- Authentication values and secret variables used by API requests, your own AI provider keys, issue tracker tokens, and notification webhook URLs. These are encrypted by our servers with AES-256-GCM before they are stored.
- “Account & Workspace Data”
- Your name, email address, and profile details, plus workspace membership, roles, settings, and workspace audit events.
- “Usage Metadata”
- Operational records such as AI usage (provider, model, token counts, estimated cost), run summaries, rate-limit counters, and service logs. Usage Metadata does not include AI prompt text or API response bodies.
How Testnir Handles Your Data
Testnir is built to keep as much work as possible on your device and to store only what a feature needs. Every feature falls into one of three tiers:
The three data tiers
Runs locally
Formatters, JSON and text diffs, JWT decoding, regex, encoding, color and timestamp tools, local speech-to-text, and screen recording run on your device. Their inputs are not sent to Testnir.
Passes through, not stored
API requests are sent by our request proxy so they work across origins safely. AI prompts are relayed by our AI gateway to the model provider. Response bodies and prompt text are streamed back and are not written to our databases.
Saved to your account
Collections, environments, schedules and run summaries, API Inspector rules, site reviews, saved AI generations, and workspace data are stored so you and your team can use them again.
Open your browser’s Developer Tools and watch the Network tab. Tier 1 tools such as the JSON formatter, JWT decoder, or regex tester make no requests with your input. When you send an API request, you will see a single call to Testnir’s request proxy (/api/proxy/request), which forwards it to your target.
Data Classification & Processing Matrix
For vendor risk reviews, the matrix below lists each category of data, where it is processed, and whether Testnir stores it:
| Data Category | Where It Is Processed | Stored by Testnir? | Retention | Protection |
|---|---|---|---|---|
| API response bodies & headers | Request proxy, then your browser memory | No | Current session only | TLS in transit |
| Collections, requests & environments | Testnir cloud database | Yes | Until you delete them | Encrypted at rest |
| Request credentials & secret variables | Testnir cloud database | Yes (sealed) | Until you delete them | AES-256-GCM, server-only access |
| Run history & scheduled runs | Your browser, or Testnir servers for scheduled runs | Summaries only | Until you delete them | Response bodies excluded |
| Screen recordings | Your browser (IndexedDB) or a local folder | No, unless attached to an issue | Until you delete them | Stays on your device |
| AI prompts & responses | AI gateway, then the model provider | Only if you save a generation | Provider terms apply | TLS in transit |
| Your AI provider keys | Testnir cloud database | Yes (sealed) | Until you remove them | AES-256-GCM, never returned to the browser |
| Site reviews, snapshots, comments & pins | Testnir cloud database & file storage | Yes | Until the review or workspace is deleted | Encrypted at rest |
| Account & workspace membership | Firebase Authentication & Testnir cloud database | Yes | Until account deletion | Passwords handled by Firebase Authentication |
| Workspace audit events | Testnir cloud database | Yes (read-only to members) | 7, 15, 30, or 60 days (workspace setting) | Written only by our servers |
AI Features, Provider Keys & Model Training
Testnir offers optional AI features such as chat, test case generation, bug report drafting, transcription, translation, and AI-assisted site reviews. Supported providers include OpenAI, Anthropic, Google Gemini, GitHub Models, OpenRouter, Groq, Mistral, Cerebras, and Z.ai.
How AI requests are routed
AI requests go from your browser to Testnir’s AI gateway, which forwards them to the selected provider over TLS. The gateway uses either Testnir-managed provider keys or a key you add yourself. Keys you add are encrypted with AES-256-GCM and stored on our servers; your browser only ever sees the last four characters.
What we keep and model training
The gateway does not store prompt or response text. We record Usage Metadata (provider, model, token counts, estimated cost) so you can see your AI usage. Generations you choose to save, such as test cases or bug reports, are stored in your account until you delete them. Testnir does not sell your content or use it to train AI models. How a provider handles prompts is governed by its terms: your own agreement when you use your key, or Testnir’s agreement when you use a Testnir-managed key.
Local transcription
When you choose the local speech-to-text model, the model is downloaded to your browser and audio is transcribed on your device. Cloud transcription options are relayed through the AI gateway like other AI requests.
Screen Recording, Screenshots & Redaction
Recordings and screenshots often capture names, emails, or tokens that happen to be on screen. Here is how Testnir handles them:
Recordings stay on your device
The screen recorder uses your browser’s built-in MediaRecorder. Recordings are saved in your browser’s IndexedDB or to a local folder you choose, and export as MP4 (H.264) where supported or WebM otherwise. They are not uploaded to Testnir unless you attach one to an issue, in which case the file is staged in Testnir storage to deliver it to your issue tracker.
The screenshot editor lets you blur or cover sensitive areas before you export or share an image. Redaction is applied to the exported pixels, not just hidden in the editor.
When you export code snippets or HAR files from API Studio, sensitive headers such as Authorization and Cookie are replaced with placeholders.
Screen recordings themselves are not automatically redacted. Review a recording before sharing it, and close or hide sensitive windows while recording.
Sub-Processors & Data Transfers
Testnir relies on the following providers to operate the Platform:
Google Cloud & Firebase
Application hosting (Cloud Run), database (Firestore), file storage, authentication, App Check and reCAPTCHA, and scheduling for scheduled runs.
Resend
Transactional email: email verification, password resets, and workspace invitations.
AI model providers
The provider you select receives your prompts when you use AI features. See Section 4.
Services you connect
Jira, Linear, GitHub, Slack, Discord, and Google Chat receive the issues and notifications you send them. They act under their own terms, not as our sub-processors.
When personal data is transferred from the EEA, the UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. If we add a payment processor or other sub-processor, we will update this list before it processes your data.
Security Practices & Regulatory Alignment
The controls below are in place today. For questionnaires or the status of third-party attestations, contact security@testnir.com.
Security controls
Workspace roles (Owner, Admin, Editor, Viewer) and custom roles, server-side permission checks and database security rules, AES-256-GCM encryption for secrets, request proxy protections against internal-network (SSRF) access, rate limiting, App Check, and a workspace audit log.
GDPR & UK GDPR
We act as a controller for account data and as a processor for Customer Content in team workspaces, processing it only to provide the Platform. A Data Processing Agreement is available on request.
Health data (HIPAA)
API requests, AI prompts, site reviews, and saved content can pass through or be stored on Testnir infrastructure. Do not submit protected health information (PHI) unless you have a signed Business Associate Agreement with Testnir. Use synthetic or de-identified test data.
CCPA / CPRA
Testnir does not sell or share personal information for cross-context behavioral advertising. California residents may request access to, correction of, or deletion of their personal information without discrimination.
Data Retention & Deletion
We keep data only as long as a feature needs it:
Held in browser memory for the current session.
Owners can restore a workspace during a 30-day recovery period. After that it is permanently purged.
You can delete your account from account settings. Sole owners must transfer or delete their workspaces first.
Retention is set per workspace and events are deleted automatically afterward.
Recordings, drafts, and preferences on your device.
Your Rights & How to Contact Us
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Many of these actions are available directly in the Platform; for anything else, contact us below.
Testnir Privacy & Security
We respond to verified requests within the timeframes required by applicable law.
Access, correction, export, and deletion requests, and DPA requests.
Responsible disclosure and security questionnaires.