Privacy Policy
Last updated: 30 September 2026
1. Who we are
Repros ("Repros," "we," "us") is a Chrome extension and web dashboard for structured QA testing, operated by Otis Saint. This policy explains what information we collect when you use Repros, why we collect it, how long we keep it, and who can see it. It covers the Repros dashboard and the Repros Chrome extension when used by a member of an organization with a Repros account. It does not yet fully cover the separate "send a session link to an external customer" flow — that flow is still being finalized and will be governed by its own terms once complete.
2. Information we collect
Account and organization data. Your email, any name you provide, your organization's name, who invited you, and your permissions within your organization. Required to operate your account.
Test session data (from the Chrome extension). The extension only records while a signed-in member of your organization has a test session running, and only on pages whose address matches that project's domain — other tabs and sites are never recorded, and nothing is recorded outside a session. During a session it captures: console output (logs, warnings, errors, uncaught exceptions and unhandled rejections, including where in the page's code they came from); page navigation within the site under test; network requests — the page's API calls (fetch/XHR) and any request that fails — with their method, URL, status, timing, request headers and request body, after the extension redacts sensitive values in your browser before upload (authorization, cookie and API-key headers; fields named like passwords, tokens, secrets or card/bank/ID numbers; and card- or SSN-shaped values wherever they appear). Response bodies are never captured. It also captures screenshots of the visible tab (taken manually, with a note, or automatically when an error occurs); the notes, checklist results, severity ratings and pass/reject decision the tester enters; clicks, recorded as the clicked element's type, visible label and a CSS selector — never the value typed into a field; and the browser environment (browser and extension version, operating system, window size, language and timezone). This is tied to a deliberate, signed-in test session — not continuous background monitoring, and not data from your end customers' production use of your product. The extension keeps your sign-in session and any not-yet-uploaded events in the browser's local extension storage.
Billing data. Stripe is our payment processor and handles your card details directly — we never store raw payment credentials. We store your plan, status, and the Stripe identifiers needed to reconcile your account.
Sign-in and abuse protection. The sign-in and signup pages use hCaptcha to tell people apart from automated bots. hCaptcha's widget loads from hCaptcha's own servers and processes information such as your IP address and browser characteristics under hCaptcha's privacy policy; we only receive a pass or fail result. To limit repeated signup and password-reset attempts we record your IP address against a short-lived counter, deleted automatically after about an hour. When you sign up, we notify our team of the new account with your name, email and organization name, so we can spot fake signups.
We do not run analytics or third-party advertising trackers, and we do not sell any data we collect.
3. Where data is stored and who processes it
Supabase, our database and file-storage provider. Screenshots live in a private storage bucket, separate from the database records referencing them.
We also rely on these service providers, each only for the purpose listed: Amazon Web Services (AWS), which hosts the Repros website and dashboard and processes your IP address and request details to deliver them; Resend, which sends our emails (account confirmations, invitations, password resets and notifications); Stripe, for payments; and hCaptcha, for bot protection on sign-in and signup.
4. Who can access your data
Your own organization's members, per the permissions your organization grants them. We can access organization data only for support, billing, or platform-operations purposes, through separately access-controlled internal tooling — not the same login your team uses. Shareable report links: a member of your organization can generate a read-only link viewable by anyone who has it, without a Repros account — treat these as you would any document you choose to share outside your organization; we don't control further forwarding. We do not sell, rent, or share your data with third parties for their own marketing.
5. Data retention
Retained for as long as your organization has an active subscription or trial. If cancelled or lapsed, retained for 30 days in case you reactivate; after that, your organization's account and session data (including screenshots) is deleted unless reactivated or otherwise arranged. Some plans show a limited window of session history (for example, the last 90 days on Starter); older sessions are hidden rather than deleted and become visible again if you upgrade. A tester can discard a session they started by mistake, which deletes it and everything captured in it.
6. Cookies
Repros itself sets authentication session cookies only — no advertising, analytics or tracking cookies. On the sign-in and signup pages, hCaptcha's widget may use its own cookies or similar storage, as described in its privacy policy.
7. Your choices and rights
Request a copy of, correction to, or deletion of your personal data at privacy@repros.dev. If removed as a member, we retain a record of your prior membership per Section 5's retention window, but you lose login access.
8. Customer testing sessions (separate, still being finalized)
Repros is developing a feature letting a member of your organization send a one-off testing-session link to your own end customer (not a Repros account holder), with additional data deliberately scrubbed or minimized for that flow. Because the legal basis for that customer's consent, retention period, and visibility are still being finalized, this policy doesn't yet make firm commitments about that flow — it will be governed by its own separately published terms before general availability, and this policy will be updated accordingly.
9. Changes to this policy
Updated as the product changes; the "Last updated" date above reflects this. Material changes are communicated to organization administrators directly.