Privacy policy

Last updated: July 2026. Questions or requests: contact the operator at the support address on your receipt or dashboard.

The short version

Integral records behavior, not content. Test sessions capture clicks, mouse movement, scrolling, and timing. Anything a tester types is masked by default — masked values keep their length but not their characters. There are no third-party trackers, ads, or analytics scripts anywhere in the test-taking flow, and taking a test never requires an account, an email address, or a browser permission prompt.

If you take a test (tester)

What we collect: your interactions with the prototype (clicks, movement, scrolling, keystroke timing with masked content), task outcome, an optional difficulty rating and comment, an optional screener answer, and a one-way hash of your IP address and browser user-agent used solely to prevent duplicate responses.
What we don't collect: your name, email, precise location, or anything you type (unless the test creator explicitly un-masked a specific known-safe field, which is visible in the recording).
Consent: recording starts only after you accept the notice on the first screen.
Retention: session recordings are deleted automatically per the test owner's plan (14 days on the free tier, up to 1 year on paid), or earlier if the owner deletes the test.

If you create tests (account holder)

What we store: your GitHub profile basics (username, name, email, avatar), the artifacts you upload, your test configurations, and the sessions your tests collect.
Billing: handled entirely by Stripe. We never see or store card numbers; we store only your Stripe customer/subscription identifiers and plan status.
Deletion: deleting your account (dashboard → account → delete) immediately and permanently removes your profile, tests, uploaded artifacts, and every recorded session. For a data export, email support.

Sub-processors

Data is stored on a single server and backed up encrypted. The services that touch data:

Hosting: Hetzner Online GmbH (server, EU)
Backups: S3-compatible object storage (encrypted database replicas and artifact archives)
Payments: Stripe, Inc.
Transactional email: Resend, Inc. (login and notification emails only)

Legal bases (GDPR)

Testers: consent (the recording notice). Account holders: contract (providing the service) and legitimate interest (abuse prevention, rate limiting). You may request access, correction, or erasure at any time; for tester sessions, contact the person who sent you the test link or the operator directly.