Privacy notice

The short version: TestMyBuild is a product of Heegstra LLC, and Heegstra LLC is responsible for your data here. To run your account we keep your email address, your handle, your picture if you add one, the listings and posts you make, and your credits. Some of that is public by design: your public page, your live listings and your approved posts, each with your handle and picture, and the screenshot in each approved post. A person reviews every new account and checks every listing and every post. We do not sell your data, we show no ads, and we send no marketing email. Analytics runs only if you choose Accept all. Credits are sold to you by our payment provider as merchant of record, and we never see your card. You can delete your account yourself. Section 6 says what is erased after 30 days and what stays.

1. Who we are

TestMyBuild is a product of Heegstra LLC, a Wyoming (USA) limited liability company at 30 N Gould St Ste N, Sheridan, WY 82801 ("we", "us"). We are the controller of the personal data described here.

Contact for anything in this notice, including requests about your data: info@testmybuild.app.

2. What we collect

You give us:

• Your email address, when you ask for a sign-in code, or when you sign in with Google and Google passes it to us. It is how you sign in and where our emails go. Builders and other testers never get it from us.
• Your handle, and your picture if you add one. You type the handle yourself, and it does not have to be your name. It cannot be changed once it is set. Your picture is cropped in your browser to a square of 512 pixels and stored in our database. Your handle is public from the moment you create your account, and your picture once your account is approved (section 5).
• Your agreement: that you confirmed you are 18 or older and agreed to the rules and the Terms, when, and which version of the Terms you were shown.
• Listings: the link or domain you paste; what our server finds on the public web page or store page behind it, which is the app's name, a one-line description, a description and its logo; your edits; the platforms, the links, and whether the app is free or has a free trial; and a contact email for the team. The contact email is seen by the team only and is never shown on the listing. A draft you start before signing in stays in your browser until you sign in, and is then saved to your account.
• Posts: your screenshot and your feedback. A screenshot of a signup screen can show your name or email address inside the app you tested. You choose what it shows, and once your post is approved it is public. Crop or cover anything you do not want shown before you upload it.
• What you write to us, at info@testmybuild.app: a question, a report about something on the site, a request about your data.

Our systems create:

• Sign-in records. A six-digit code, which we store only as a hash. It is valid for 15 minutes, works once, and is refused after 5 wrong guesses. We count requests for codes so that an address can ask for at most 5 an hour. When you are signed in, a session record keeps you signed in for up to 90 days.
• Sign in with Google, where the site offers it and you use it: the identifier Google gives us for you, which is made for TestMyBuild and is not the name of your Google account, and the email address Google confirms is yours. We ask Google for nothing else: no name, no photo, no contacts. We keep the identifier with your account so that your next sign-in finds it. If the address Google confirms already belongs to a TestMyBuild account, you are signed in to that account, not given a second one.
• Your status and history: whether your account is new, approved for testing or declined, with the reason if declined; the date your account was made, shown on your public page as the date you joined; your badges; the status of each listing and post, with the reason when one is rejected; and when you moved a listing to the top of Newest.
• Your credits: every change to your balance, with its date and reason, including credits on hold.
• Payments. You buy credits on our payment provider's checkout page, and the payment provider sells them to you as merchant of record. You give it your card or wallet and what it needs to work out the tax where you live, such as your country or billing address, and we pass it your email address to fill in. We receive and keep a reference to that checkout, the amount, whether it was paid, and when. We never see or store your card number.
• Notifications and an email log. The notifications under the bell, and whether you have read them. For each email we send you: your account, the address, the kind of email, its subject, the email provider's reference for it, and whether it was delivered. Not the text of the email.
• Security records. To limit abuse of the sign-in form, we keep a salted one-way hash of the IP address a code request came from, never the IP address itself, and one IP address can ask for at most 30 codes an hour. When you ask for a code, a bot check run by our hosting provider looks at signals from your browser and device and at your IP address, to tell a person from a script. We receive only a pass or a fail.
• Server logs. Our hosting provider logs the requests the site answers, to find faults and abuse.
• Site analytics, only if you choose Accept all: a pseudonymous browser identifier, the pages you view, an approximate location worked out from your IP address, and information about your browser and device (section 4).

When you paste a link, our server, not your browser, requests the page or store entry it points to. That site sees a request from our server, not from you.

We do not collect your phone number, your precise location, your contacts or your payment card. We do not ask for your date of birth. We do not buy data about you.

3. Why we use it, and our legal basis

Where the GDPR or the UK GDPR applies, this is the basis for each purpose:

A person makes every decision. Every approval and rejection of an account, a listing or a post is made by a person on the team. We make no automated decisions about you, we do not profile you, and we show no advertising.

The emails we send. Only what your account and the features you use require: your sign-in codes; that your account was created, approved for testing, or not approved; that a post of yours was approved or not; that a tester left feedback on your app; that we received your app, listed it, or did not list it; that you moved a listing to the top of Newest; that you bought credits; that your credits changed; and the notices our Terms promise. The same events, apart from the sign-in code, also appear under the bell on the site. They come from noreply@testmybuild.app, and a reply reaches us at info@testmybuild.app. They are part of the service, so they carry no unsubscribe link, and they stop when your account is erased. We send no newsletter and no marketing email, and we put no promotion into these messages.

4. Cookies, browser storage and analytics

Strictly necessary. Up to three first-party cookies. __Host-tmb_session keeps you signed in for up to 90 days. __Host-tmb_nonce is set when you ask for a sign-in code: the code works only in the browser that has it. It lasts 15 minutes and is deleted when you sign in. __Host-tmb_oauth is set only when you press Sign in with Google: it proves that the browser Google sends back to us is the one that started the sign-in, and it lasts 10 minutes at most. Your browser also keeps two entries in its local storage: tmb-consent, your cookie choice and its date, and tmb-draft, a listing you started before signing in, removed once it is saved to your account. None of these needs your consent, and none is used for advertising. The full list is on our Cookies page.

Bot check. Our hosting provider's bot check protects the form where you ask for a sign-in code. We do not use its pre-clearance option, so it sets no cookie on testmybuild.app.

Optional: site analytics (Google). If, and only if, you choose Accept all, we load Google Tag Manager, which loads Google Analytics for us. Analytics measures visits, the pages viewed, an approximate location and information about your browser or device, so that we can see what is used and improve the site. It uses first-party cookies, _ga and _ga_<container>, set to last 390 days. Google signals and ads personalization are off, and we use Analytics for nothing else. We never send it your email address, your posts or anything else that names you. Analytics data is kept for no more than 14 months. If you choose Only necessary, nothing from Google loads.

Your choice. The banner on your first visit offers Only necessary and Accept all, equally easy. Nothing optional runs before you choose. You can change your choice at any time with Cookie settings in the footer of every page. If your browser cannot store your choice, nothing optional runs, and we ask again next time.

Marketing: none. We use no advertising or retargeting technology. If that ever changes, we update this notice and ask you first.

5. Who else sees your data

Anyone on the internet, without an account, and search engines:

• your public page at testmybuild.app/your-handle: your handle, your picture once your account is approved, your badges (Builder, Tester or new account), the date you joined, your live listings, and the apps you tested with your approved posts;
• your live listings, marked "Listed by" with your handle;
• your approved posts on each listing: your handle, your picture, your screenshot, your feedback and the date.

Our sitemap lists public pages so that search engines can find them. When someone shares a link to one of these pages, the service it is shared in, a chat app or a social network, fetches the page to build a preview and may keep its own copy.

The builder of an app you post on also gets your approved post by email and as a notification, with your handle, and may quote its words in their own marketing under the rules in our Terms. Builders do not get your email address from us.

Only you and the team see your email address, your credits, your pending and rejected posts and their reasons, your draft and in-review listings, the contact email on a listing, and the reason if your account was declined. The team sees what it needs to review accounts, listings and posts, on an admin page that only the team can open.

Our service providers. We use a small number, each under data processing terms that let it use your data only to do its job for us, except as the note under the table says.

The payment provider is not only working to our instructions. As the seller of the credits, it decides for itself what it must keep to meet tax, fraud and money-laundering law, and it decides refunds and disputes under its own terms. Its own privacy policy governs that part. The sign-in provider handles your press of its button under its own policy too. The site behind a link you paste sees a request from our server, as section 2 says.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose data to authorities only where the law requires it. If Heegstra LLC ever sells or transfers TestMyBuild, your data may go with it; we would tell you first, and the new owner would be bound by this notice until it gave you a new one.

6. How long we keep it

• Your account: your email address, handle, picture, agreement, status, notifications and credits are kept for as long as your account exists.
• Deleting your account: choose Delete account, then Yes, delete, on your account page. Your account is scheduled for deletion, and signing in within 30 days restores it. After 30 days it is erased: your email address, handle, picture, sessions, sign-in codes, your Google identifier if you used Sign in with Google, notifications and the email log for your account are removed. What remains of the account is an empty record without your email address, handle or picture, so that what stays on the site can show "[deleted account]".
• What stays on the site after that: your approved posts stay on their listings, shown as "[deleted account]", with the screenshot removed. Ask us and we remove the words too. A live listing of yours stays live, as listings are permanent, shown as listed by "[deleted account]" and without its contact email. Your draft and in-review listings are deleted.
• Payment records and your credit ledger: for as long as tax and accounting law requires us to keep them. If your account is erased before then, they stay linked only to the empty record, without your email address, handle or picture. Your card details are held by the payment provider under its own policy, never by us.
• Sessions: up to 90 days. Signing out ends the session on that device.
• Sign-in codes: a code works for 15 minutes, and the daily cleanup deletes its record once it is a day old.
• Security records: the hashed IP records are deleted by a daily cleanup once they are a day old.
• Email log: 90 days, then deleted by the same daily cleanup, or sooner when your account is erased.
• Server logs: kept by our hosting provider for 3 days, then deleted.
• Analytics: no more than 14 months.
• Your cookie choice and a draft listing: in your browser, until you change or clear them. A draft is removed once it is saved to your account.
• What you write to us: for as long as we need it to answer you and to keep a record of what we agreed or did.

7. Your rights

You can do these yourself: change or remove your picture, change your cookie choice, and delete your account.

For everything else, email info@testmybuild.app. That includes:

• Access: a copy of the data we hold about you. There is no download button yet, so ask us and we send it to you.
• Correction of anything inaccurate.
• Erasure, of your whole account or of one thing, such as a post or its words.
• Restriction of processing, and objection to processing based on our legitimate interests.
• Portability of the data you gave us.
• Withdrawing consent to analytics, at any time, with Cookie settings in the footer. Withdrawing does not affect what we did before.

What erasure cannot reach. It cannot reach what has already left us: a search engine's cache, a preview a chat app stored, a screenshot someone took, or a quote of your feedback a builder already used in their own marketing. If a search engine still shows an old copy of a page, tell us and we help you ask it to remove the copy.

We answer within 30 days, usually much sooner, and we do not charge for it. We may ask you to confirm that you control the email address on the account before we act, because that address is the only identifier we hold.

If you are in the EEA or the UK, these are your rights under the GDPR and the UK GDPR, and you may also complain to your data protection authority.

If you are in California, you have the right to know what we collect and why, to delete it, to correct it, and not to be treated differently for using those rights. We do not sell or share personal information. Sections 2 and 3 list what we collect and why, and we honor these requests whether or not the law formally applies to us.

8. Where your data is stored, and transfers

Our providers are US companies. Your data is stored in the United States, and our hosting provider's network may answer a request from a data center near you. If you are in the EEA, the UK or Switzerland, that means your data is transferred to the United States. We rely on the European Commission's Standard Contractual Clauses, which are part of our providers' data processing terms, and on a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where it has one.

9. How we protect it

Everything travels over HTTPS. A sign-in code is stored only as a hash, works once, lasts 15 minutes, is refused after 5 wrong guesses, and works only in the browser that asked for it. Asking for codes is limited, per address and per IP address, and the form is protected by a bot check. We store no raw IP addresses for rate limits and no card numbers. The admin page opens only for the team's account with a second password.

If a breach ever puts your rights at risk, we tell you and the relevant authority, within 72 hours of becoming aware of it where the law requires it.

10. Age

TestMyBuild is for people aged 18 and over. You confirm that you are in the box you tick when you create your account, and we keep that confirmation with your agreement. We do not ask for your date of birth. We do not knowingly collect data from anyone younger. If you believe someone under 18 has an account, tell us at info@testmybuild.app, and we close it and remove what it published.

11. Changes to this notice

When this notice changes, we update the version and the date at the top and note the change in the changelog below. For anything material we tell you by email before it takes effect, and where a change relies on your consent we ask again rather than assume.

TestMyBuild is a product of Heegstra LLC.