Back to home

Privacy Policy

Last updated: August 10, 2026

1. Introduction

TestForge ("Company", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use TestForge AI ("Service"). Please read this policy carefully.

2. Information We Collect

2.1 Account Information

When you register, we collect your email address, name, and a hashed version of your password. We never store plaintext passwords.

2.2 Usage Data

We automatically collect information about how you interact with the Service, including: pages visited, features used, test runs executed, timestamps, and browser type. This data is used to improve the Service and is not sold to third parties.

2.3 Test Execution Data

When you run tests, the Service processes target URLs, test steps, screenshots, and network logs. This data is processed transiently during test execution and is stored in your browser's local storage — not on our servers.

2.4 API Keys

If you provide third-party API keys (Anthropic, OpenAI, Google, OpenRouter), these are stored exclusively in your browser's local storage. We do not transmit, store, or log your API keys on our infrastructure. API calls to third-party providers are proxied through our servers only to add necessary headers — your keys are never persisted server-side.

3. How We Use Your Information

  • To provide, maintain, and improve the Service
  • To process your subscription and billing
  • To communicate with you about your account, updates, and support
  • To monitor usage patterns and enforce rate limits
  • To detect, prevent, and address technical issues and abuse
  • To comply with legal obligations

4. Data Storage and Security

Account data is stored in encrypted databases. All data in transit is protected via TLS 1.3. Passwords are hashed using bcrypt with a cost factor of 12. Session tokens use HMAC-SHA256 signing.

We implement industry-standard security measures including:

  • HTTPS enforcement with HSTS preloading
  • Content Security Policy (CSP) headers
  • Rate limiting on all API endpoints
  • SSRF protection against private network access
  • HttpOnly, Secure, SameSite cookie attributes

5. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. We may share data only in the following circumstances:

  • Payment processors: We share necessary billing information with Stripe to process payments. Stripe's privacy policy governs their handling of this data.
  • Legal requirements: We may disclose information if required by law, court order, or government request.
  • Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.

6. Cookies and Local Storage

We use a single HttpOnly session cookie (tf-session) for authentication. We do not use tracking cookies, advertising pixels, or third-party analytics. Application state is stored in your browser's localStorage and is never transmitted to our servers.

7. Your Rights

You have the right to:

  • Access: Request a copy of all data we hold about you
  • Correction: Update or correct inaccurate data
  • Deletion: Request permanent deletion of your account and all associated data
  • Export: Download your data in a machine-readable format
  • Restriction: Request limitation on how we process your data

To exercise any of these rights, contact us at privacy@testforge.ai.

8. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days. Anonymized usage statistics may be retained indefinitely for service improvement.

9. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If we discover that we have collected data from a child under 16, we will delete that information promptly.

10. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence. We ensure appropriate safeguards are in place for any cross-border data transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice within the Service at least 30 days before the changes take effect.

12. Contact

For privacy-related inquiries, contact our Data Protection Officer at privacy@testforge.ai.

Terms of ServicePricingHome