Privacy Policy

This policy explains which personal data AddTester processes, why, for how long, and who else receives it. AddTester consists of this website (addtester.com), the AddTester cloud service behind it (api.addtester.com) and the AddTester app for Mac.

In short: we process what is needed to test your apps on your iPhone and to show you the results. We do not sell data, show ads or use tracking or analytics. The passwords of your test accounts and your code signing files never leave your Mac.

1. Who is responsible

Vladislav Baranov
c/o IP-Management #5557
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany
Email: kontakt@vlad.mobi

We have not appointed a data protection officer, as the law does not require one for us.

2. Visiting the website

Server logs. Each time you open a page, our server processes your IP address, the date and time, the page requested, the referrer, and your browser and operating system. We need this to deliver the site and to keep it secure, for example to detect attacks and to rate-limit requests. Log entries are kept only briefly, normally no longer than 14 days, and are then deleted. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure, working website.

Cookies. The website sets only two cookies, both strictly necessary:

They are not used for tracking or advertising, and no cookies of third parties are set. Because they are strictly necessary for a service you asked for, no consent is required (§ 25(2) no. 2 TDDDG). Legal basis for the processing: Art. 6(1)(b) and (f) GDPR.

No tracking, no external content. We use no analytics, advertising pixels or social media plugins. Fonts are served from our own server; your browser does not contact any third party when you visit the site.

3. Your account

Email address and sign-in. You sign in with your email address. We send you a sign-in link, which works once and for 15 minutes. We store your email address, when you first and last signed in, your active sessions, and a hash of the browser identifier (see at_browser above) of up to ten browsers you signed in with. Sessions and sign-in links are stored only as hashes. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).

Sign-in emails are sent through Resend (see section 7).

Contacting us. If you email us, we process your message and address to answer it. Legal basis: Art. 6(1)(b) or (f) GDPR.

4. The AddTester app for Mac

What stays on your Mac. The following never leave your Mac: the user names and passwords of your apps' test accounts (kept in the macOS keychain; a check refers to them only by placeholder), your code signing certificates and provisioning profiles, the list of all apps on your iPhone, apps from the App Store, and anything in apps you have not switched on for testing.

Signing in a Mac. Before a Mac signs in, the app asks you which name addtester.com should show it by: the kind of Mac (for example "MacBook Pro"), its name in System Settings, or a name you type. Only the name you confirm is sent. It is kept with your account so that you can tell your Macs apart; you can rename the Mac on the website at any time. Internally the Mac is identified by a random ID that contains nothing about you or the Mac. We also store a hash of the Mac's access token (never the token itself), when it was last online, and whether it is taking runs.

The connected iPhone. While a Mac is signed in, it reports about once a minute which iPhone is connected and which apps on it you have switched on for testing:

• the iPhone's name: just "iPhone" (or "iPad"), unless you choose in the app to show its own name or a name you type;
• its iOS version;
• for each app you switched on: its name, bundle ID, version and build number, and its icon.

When you sign a Mac out, the iPhone it last had is deleted from our records.

Checks and runs. When AddTester checks an app, the Mac sends us, step by step, what is on the iPhone's screen so that the next step can be worked out and the result shown to you:

• the goal of the check as you wrote it;
• a description of the screen: the texts, labels and values of the elements shown;
• a screenshot of the screen (JPEG);
• the action taken, the result and the verdict of the run.

If you record a journey by hand, the screens you keep are sent in the same way when you save it. If you let AddTester look round an app, the screens it finds are stored as a map of the app.

What may be on a screenshot. A screenshot shows whatever the tested app displays. Use test accounts with test data. Screens with a password field, or showing the test account, are not photographed (a grey picture is kept instead), and AddTester stops before paying, deleting or sending, but we cannot rule out that a screen shows personal data of other people that the app displays. Turn on Do Not Disturb on the iPhone while it tests, so notifications from other apps do not end up on a screenshot.

Legal basis for all of section 4: Art. 6(1)(b) GDPR (providing the service). Where screens contain personal data of third parties, our legal basis is Art. 6(1)(f) GDPR; our legitimate interest, and yours, is testing your app as you asked. If you use AddTester for your organisation and screens contain personal data for which your organisation is responsible, we process that data on your behalf; we will conclude a data processing agreement under Art. 28 GDPR with you on request.

5. The AI that plans the steps

To work out the next tap, the cloud sends the goal, the description of the screen and, where it is needed, the screenshot to the AI model provider named in section 7. Learned journeys are then repeated without the AI. Test account passwords are never sent; only placeholders such as {{secret:password}} are. We use only providers whose terms exclude using data sent through their API to train their models, and who delete it after a limited period.

The AI decides which button to tap in your app. It makes no decisions about you; there is no automated decision-making within the meaning of Art. 22 GDPR.

6. How long we keep data

To delete your account and everything stored with it, email us from the address you sign in with. We delete it within 30 days. Legal retention duties may require us to keep some records, such as invoices, for longer.

7. Who receives data

We use the following service providers. Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR).

We may change or add the AI model provider, for example to Anthropic (Claude API). We update this table before data goes to a new provider.

Transfers outside the EU. The AI model provider and Resend process data in the USA. Transfers rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified under it, the EU–U.S. Data Privacy Framework (Art. 45 GDPR). You can ask us for a copy of the safeguards.

We do not pass data to anyone else unless the law requires us to.

8. Security

All connections to the website, the cloud and between the Mac and the cloud are encrypted (TLS). Screenshots are kept in a private store that only the cloud service can reach; every request is checked against the account the data belongs to. Access tokens and sign-in links are stored only as hashes.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on Art. 6(1)(f) (Art. 21). Email us to exercise them.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

10. Changes

We update this policy when AddTester changes, for example when we add a service provider. The current version is always on this page. If a change matters for data we already hold, we tell you by email before it takes effect.

Last updated: 23 October 2026