Privacy Policy
Last updated: 12 July 2026. If we make a material change to this policy, we'll post the update here and, where required, notify signed-in users.
TestNest is operated by Alec Archer, an independent software engineer based in the UK. For the purposes of UK GDPR, Alec Archer is the data controller for personal data collected through TestNest.
For any privacy question, data request, or complaint, contact @alecarcher on WhatsApp. We aim to respond within 30 days, as required by UK GDPR.
Account information
Email address, username, display name, and optional avatar URL, collected when you sign up. Used to authenticate you and identify you within the community.Legal basis: performance of a contract (running your account).
App submissions & reviews
Title, description, URL, platform, category, and any reviews, scores, bug reports, and Loop Points tied to your account. Shown publicly in the community feed so other builders can find and review your work.Legal basis: performance of a contract (the peer-review community is the product), and legitimate interests in running a useful public feed.
AI Review
The URL you submit, the publicly accessible page content fetched from it, and the resulting report. Signed-in users' reports are saved to their account; a signed-out visitor's single free report is not linked to an account and is tracked only via a short-lived browser cookie.Legal basis: performance of a contract for signed-in users; legitimate interests (offering a free preview) for signed-out use.
Hackathon sign-ups
Name, email, and optional app details, collected if you register interest in a TestNest hackathon. Used only to email you about that event — not shown publicly.Legal basis: consent (you opt in by submitting the form).
Security & abuse prevention
IP address and request metadata, used transiently to rate-limit abusive traffic (e.g. scripted sign-ups or AI Review spam) and protect the service from bots.Legal basis: legitimate interests in keeping the service available and secure.
Analytics
Pages visited, approximate location, and device/browser type, collected via Google Analytics — only if you accept the analytics cookie prompt.Legal basis: consent (see Cookies below).
Under UK PECR, we ask for your consent before setting any cookie that isn't strictly necessary — the banner shown on your first visit gives you that choice, and analytics cookies are never set until you accept it. You can change your mind any time via “Cookie preferences” in the footer.
| Cookie | Purpose | Type | Lifespan |
|---|---|---|---|
| Supabase session cookies | Keep you signed in | Strictly necessary | Up to 1 week, refreshed on use |
| Theme preference | Remember light/dark mode | Strictly necessary | Persistent (local storage) |
| Free AI Review tracker | Limit signed-out visitors to one free AI Review | Strictly necessary | 30 days |
| Cookie consent choice | Remember your cookie preference | Strictly necessary | Persistent (local storage) |
| Google Analytics (_ga, _ga_*) | Understand aggregate site usage — only set if you accept | Optional (consent required) | Up to 2 years |
Authentication
Accounts are managed by Supabase Auth. Passwords are never stored in plain text — they're hashed using industry-standard algorithms, and Supabase enforces a minimum password length before an account can be created.
Data encryption
All traffic to TestNest is encrypted in transit over HTTPS. Data at rest is encrypted by our database provider (Supabase).
Access control
Database access is governed by row-level security: your account can only read or write your own private data (like saved AI Review reports), and every write is checked server-side.
AI Review privacy
The AI Review tool only fetches publicly reachable web pages — never private networks, admin panels, or anything behind a login — and only your own account can see reports you've saved.
TestNest is UK-operated. Our database and authentication provider, Supabase, and our analytics and transactional email providers (Google Analytics, Resend) may process data outside the UK, including in the US. Where that happens, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses (as incorporated by those providers) as the transfer safeguard.
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data — most of this you can edit yourself from your profile.
- Erase your data — delete your account any time from your profile, or ask us to do it for you.
- Restrict or object to certain processing.
- Port your data to another service in a machine-readable format.
- Withdraw consent at any time where processing relies on it (e.g. analytics cookies, hackathon emails).
To exercise any of these, email WhatsApp (@alecarcher). If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
- Account data: kept while your account is active; permanently deleted within 30 days of account deletion.
- App submissions & reviews: kept while your account is active; deleted along with your account (they may be retained in anonymised, aggregate form for community statistics).
- AI Review results: kept while your account is active; deleted along with your account. Signed-out (anonymous) reports are never stored server-side at all.
- Hackathon sign-ups: kept until the relevant event has concluded and follow-up communication is complete, then deleted.
- Analytics data: retained by Google Analytics per its own default retention window (currently up to 14 months), and only collected at all if you've accepted the cookie prompt.
- Security/rate-limit logs: short-lived, typically cleared within 48 hours.
TestNest is not directed at, and is not intended for, children under 16. We don't knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us at WhatsApp (@alecarcher) and we'll remove it.
Questions about this policy, or a request relating to your data? Email WhatsApp (@alecarcher). For general product questions, see our Help & FAQ page.