Privacy policy

Tester is a platform that helps Android developers find real testers for Google Play closed testing and run the test. The website, Android app and API are operated by Noyan Kalay (individual developer, Turkey), who is the data controller under Turkey's Personal Data Protection Law No. 6698 (KVKK) and the GDPR.

For any question or request: info@testbunny.co.

We only collect what the service needs to work. The table lists the fields the product actually stores.

The website only uses strictly necessary and preference cookies: the session cookie (tsess), language (NEXT_LOCALE) and theme (theme). There are no advertising or analytics cookies.

• Location, contacts, SMS, call logs, microphone, camera or screen recordings.
• Hardware or advertising identifiers such as IMEI, Android ID or advertising ID.
• The list of all apps on your phone (QUERY_ALL_PACKAGES is not used).
• Accessibility Service data; the service is never used.
• Your Google account password. We never ask for it, and we reject test-account instructions that look like a Google password.
• Your card details. When card payments are enabled, card data is entered directly with the payment provider (Polar) and never reaches us.

The app contains no advertising, tracking or analytics SDKs. We don't sell your data, use it for advertising or use it to train any AI model.

The Android app includes a measurement that only runs if you explicitly consent and grant the Usage Access permission in Android Settings.

• Only the packages of the apps you are assigned to test are read; usage of any other app is neither read nor sent.
• What is sent: daily foreground time, number of launches and the app's version code.
• It is shown to you, the campaign's developer and admins as a "device signal". It does not mean Google verified anything and is never the sole basis for credits.
• You can withdraw consent in your profile and remove the permission in Android Settings at any time. Without consent the server rejects this data, and you simply continue with daily check-ins and tasks, with no downside.

Matching and the reliability score are automated, rule-based and explainable; they are not automated decisions with legal effect. Restrictions and fraud decisions are made by a human admin and you can appeal them in the app.

• Campaign owner (developer): for campaigns you join, your name, profile photo, device model, Android version, country, reliability score, day-by-day participation, submissions, bug reports, feedback and the evidence images you attach. Your email address is not shown on the platform.
• Testers: the app details and instructions of campaigns they join; test-account instructions only unlock for an active assignment.
• Admins: the records needed for security, review and appeals.
• Google Group and Play closed testing: joining the group and opting in happen on Google's services with your own Google account. The group owner can see your email address there; these steps are governed by Google's privacy policy.
• Apps you test: if the app you test collects data itself, that is governed by its developer's privacy policy.

We use these processors to run the service:

Beyond this we don't share your data with third parties, except where the law requires disclosure to competent authorities.

The providers above may process your data on servers outside Turkey and the European Economic Area. These transfers rely on the providers' data processing agreements and standard contractual clauses (KVKK art. 9 and GDPR Chapter V).

We don't automatically delete inactive accounts; you can delete yours at any time. Details: Account deletion.

Under KVKK art. 11 and the GDPR you have the right to know whether your data is processed and to access it, to rectification, erasure, restriction, objection and portability, and to withdraw consent. If you suffer damage, you can claim compensation.

• Download: Profile → "Download my data (JSON)" gives you your account, profile, devices, assignments, submissions, bug reports, feedback, evidence records, credits, ratings, disputes, complaints and notifications in one file.
• Correct: edit your tester profile at any time; your name and photo come from your Google account.
• Delete: in the app, on the web or by email. See Account deletion.
• Withdraw consent: turn off the usage signal in your profile.

Send requests to info@testbunny.co from your Google account's email; we reply within 30 days at the latest. You can complain to Turkey's Personal Data Protection Board (KVKK) or, if you live in the EU/EEA, to your local data protection authority.

• All connections are encrypted with HTTPS.
• Test-account instructions are stored encrypted with AES-GCM and only unlock for active testers.
• Evidence images are never public; only the uploader, the campaign owner and admins can view them. The Android app and website re-encode images before upload, which strips EXIF and location metadata, and you can black out emails, phone numbers and names first.
• Every admin action is written to the audit log with a reason.

Tester is not directed at children. You must be at least 16 to use it; to buy a campaign plan you must be of legal age (18) or authorised to act for a business. If we learn that someone under 16 has an account, we delete it. You can tell us at info@testbunny.co.

We may update this policy. We announce material changes with an in-app notification before they take effect; the date at the top shows the latest update.