# Privacy Policy for Testers Area **Last Updated:** September 12, 2026 **Version:** 1.0 (Initial Release) **App Name:** Testers Area **Developer:** OpusVale Developer **Contact Email:** testersareaofficial@gmail.com **Official Community Group:** testersarea@googlegroups.com --- Welcome to **Testers Area** ("we", "our", "us"). We are committed to protecting your privacy and ensuring transparent handling of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App") and associated services. Please read this Privacy Policy carefully. By downloading, accessing, or using the App, you consent to the data collection and processing practices described herein. If you do not agree with this policy, please do not use the App. --- ## 1. Information We Collect ### 1.1 Account Information When you sign in using Google Sign-In (OAuth 2.0), we collect: - **Email Address:** Used to identify your account, send testing updates, and authenticate your identity. - **Display Name:** Your public developer name shown to matched testing partners and on your profile. - **Profile Photo URL:** Your Google profile avatar, displayed within the App UI. - **User ID:** An internal unique UUID generated by Supabase Auth to link your account data securely. ### 1.2 Device & Hardware Information - **Android ID (SSAID):** We collect your device's unique 64-bit Android ID to enforce our strictly required one-account-per-device rule and prevent fraudulent multi-account abuse. Your Android ID is stored securely on private servers and is **never** shared with third parties or other users. - **Device Model, Manufacturer & OS Version:** Collected to display device diagnostics on your profile and ensure technical compatibility with partner apps. ### 1.3 App Usage Data (`PACKAGE_USAGE_STATS`) - **Usage Statistics:** To verify that you have actively tested your partner's app for the required daily duration (minimum 2 minutes), our native Android service queries Android's `UsageStatsManager` / `UsageEvents` API. - **Strict Scope Limitation:** We read usage data **only** for the specific package ID of the partner app you are currently assigned to test. We do **not** scan, collect, or log your general app usage history, personal browsing habits, or activity in other installed applications. - **Prominent Disclosure:** This permission is requested with a prominent in-app disclosure dialog explaining its purpose before directing you to Android system settings. ### 1.4 Installed Apps Verification - **Targeted Package Verification:** We query whether the assigned partner app is currently installed on your device to prevent uninstallation fraud during the active 14-day test cycle. - **No Broad Scanning:** We do **not** collect, catalog, or transmit your full list of installed applications. The high-risk `QUERY_ALL_PACKAGES` permission is intentionally not requested. ### 1.5 Media & Screenshot Proofs - **Screenshot Proofs (`READ_MEDIA_IMAGES` / `READ_EXTERNAL_STORAGE`):** You select and upload screenshots as daily proof of testing. - Screenshots are compressed locally to WebP format on your device to minimize data consumption. - Uploaded proofs are stored in private cloud storage buckets protected by Supabase Row Level Security (RLS). - Screenshots are shared **only** with the specific developer whose app you are testing. - Proofs are **never** indexed, made public, or sold. - Proofs are **automatically deleted** from our servers after the testing cycle ends (maximum retention: 20 days). - **EXIF Metadata (Capture Timestamps):** We extract capture timestamps from selected screenshot metadata to verify that screenshots were genuinely taken during the active daily testing window. We do **not** read or store GPS location data. ### 1.6 Push Notifications & Reminders - **Firebase Cloud Messaging (FCM) Token:** Collected to deliver notifications regarding testing swap requests, proof approvals, rejections, and streak reminders. Deleted upon account deletion. - **Local Reminders:** Scheduled on-device reminders use standard Android notification channels (`POST_NOTIFICATIONS`) to remind you of pending daily tests. High-risk exact alarm permissions (`SCHEDULE_EXACT_ALARM`, `USE_EXACT_ALARM`) are **not** requested. ### 1.7 In-App Partner Chat & Feedback Data - **Partner Chat:** Messages exchanged between matched testing partners are encrypted in transit, stored securely in our database, and visible only to the two participating developers. Chat logs are deleted when the swap finishes or when either developer deletes their account. - **Bug Reports & User Feedback:** Text feedback and diagnostic screenshots submitted via `Send Feedback` or daily proof reviews are collected solely to assist testing partners and improve platform stability. ### 1.8 App Access Credentials (Demo Logins & Promo Codes) - When a developer submits an app requiring authentication or a paid app, they may submit demo login credentials, test OTP instructions, or Google Play promo codes in the Access Notes. - **Data Protection:** Access credentials are encrypted in transit, stored in private database rows, and displayed solely to the matched testing partner assigned to that specific app. - **Developer Notice:** Developers are strictly cautioned **never** to provide personal credentials, real bank accounts, or production root passwords; only sandbox or dummy test accounts should be used. ### 1.9 Financial & Subscription Data (PRO Memberships) - When you purchase a PRO Subscription, the transaction is processed directly through **Google Play In-App Billing** via RevenueCat (`purchases_flutter`). - We receive your subscription status, product ID, transaction ID, and expiration date. - We **never** collect, process, or store your credit card, debit card, or bank account details. ### 1.10 Advertising Data (Google AdMob) For users on the free tier, we display advertisements provided by **Google Mobile Ads (AdMob)**: - Google AdMob may automatically collect: - Google Advertising ID (AAID/GAID). - IP address (for approximate location to serve localized ads). - Device technical specifications and general diagnostic metrics. - Ad performance data (views, clicks, impressions). - You can reset or opt out of personalized ad tracking anytime via **Android Settings > Google > Ads**. - Subscribing to PRO removes all third-party advertising SDK calls. ### 1.11 Developer Pro Tools (Local Execution) - Utilities such as the **APK & App Bundle Analyzer** and **Screenshot Mockup Studio** operate **locally on your device**. - APK files and promotional graphics analyzed with Pro Tools are processed strictly in local device RAM and are **never** transmitted to our external servers. ### 1.12 On-Device Local Data (SharedPreferences) The following preferences remain strictly on your device and are never sent to our servers: - App UI theme (Light/Dark mode). - Selected language preference (8 languages supported: English, Hindi, Spanish, Portuguese, Indonesian, Russian, Chinese, Korean). - Local notification alert preferences and cached session states. --- ## 2. How We Use Your Information | Purpose | Data Categories Used | |---|---| | **Account Creation & Authentication** | Email address, Display name, Profile photo URL | | **Peer Testing Matching** | User ID, App details, Active testing capacity | | **Daily Testing Fairness Verification** | App usage seconds (for partner app only), Screenshot proofs, EXIF timestamps | | **Anti-Fraud & One-Device Rule** | Android ID (SSAID), Partner app install status, NTP network time | | **App Access Management** | Demo credentials, Promo codes (shared only with matched tester) | | **PRO Subscription Management** | Product ID, Entitlement status, Google Play purchase token | | **Advertising Delivery (Free Tier)** | Google Advertising ID (AAID), Ad interaction data via AdMob | | **Push Notifications & Reminders** | FCM device token, Notification permission | | **Developer Partner Communication** | In-app chat messages | | **Gamification & Rewards Hub** | Tester Coins balance, Streak history, Spin records | | **Account Deletion & Data Purge** | All associated user records | --- ## 3. Information Sharing & Third-Party Disclosure We respect developer privacy and **do not sell, rent, lease, or monetize** your personal data. ### 3.1 Shared with Matched Testing Partners During an active 14-day testing swap, your assigned testing partner can view: - Your public developer display name and profile avatar. - Your uploaded daily screenshot proofs for their specific app. - Your daily active usage seconds recorded for their specific app. - Messages sent via the in-app partner chat. - Any demo access credentials or promo codes provided for their app. ### 3.2 Third-Party Service Providers We partner with established third-party infrastructure providers to deliver our services. Each provider processes data pursuant to their respective privacy policies: | Service Provider | Role / Function | Data Handled | Privacy Policy | |---|---|---|---| | **Supabase** | Cloud Database, Auth & Secure Proof Storage | Email, User ID, Android ID, Proofs, Chat, Access Notes | [supabase.com/privacy](https://supabase.com/privacy) | | **Google Firebase (FCM)** | Cloud Messaging & Push Notifications | FCM Device Token | [firebase.google.com/support/privacy](https://firebase.google.com/support/privacy) | | **Google Sign-In** | OAuth 2.0 Authentication | Email, Name, Avatar | [policies.google.com/privacy](https://policies.google.com/privacy) | | **Google Mobile Ads (AdMob)** | In-App Advertising (Free Tier) | Advertising ID (AAID), IP Address, Ad Analytics | [policies.google.com/technologies/ads](https://policies.google.com/technologies/ads) | | **RevenueCat** | Subscription & In-App Purchase Management | App User ID, Purchase Tokens, Entitlement Status | [revenuecat.com/privacy](https://www.revenuecat.com/privacy) | | **Google Fonts** | Dynamic Typography | Standard HTTP request metadata | [developers.google.com/fonts/faq/privacy](https://developers.google.com/fonts/faq/privacy) | ### 3.3 Legal Obligations We may disclose personal information if required by law, subpoena, regulatory inquiry, or to protect the safety, rights, or integrity of Testers Area, its users, or the public. --- ## 4. Data Security & Storage We implement rigorous technical safeguards to protect your personal data: - **Row Level Security (RLS):** Every database table in Supabase is governed by RLS policies ensuring users can only read and write their own authorized records. - **End-to-End Encryption in Transit:** All client-server communication is encrypted using HTTPS / TLS 1.3 encryption. - **Encrypted at Rest:** Database records and cloud storage buckets are encrypted on enterprise cloud infrastructure. - **Zero Plaintext Credentials:** We use Google OAuth 2.0; we never handle or store user passwords. --- ## 5. Data Retention & Permanent Deletion ### 5.1 Automated Data Cleanup - **Testing Proofs (Screenshots):** Permanently deleted from our servers within 20 days after a testing swap completes. - **Chat Logs:** Automatically removed following swap completion or partner account deletion. ### 5.2 User Account Deletion You maintain complete ownership of your data and can permanently delete your account at any time via: **Settings > Delete Account** Upon confirmation: - Your user profile and authentication credentials are deleted immediately. - All your submitted apps, testing requests, proofs, coin balances, notifications, and chat records are **permanently and irreversibly erased** from production storage. --- ## 6. Android Permissions & Justification | Permission | Category | Purpose & Justification | |---|---|---| | `android.permission.PACKAGE_USAGE_STATS` | Protected | Reads daily usage duration for the assigned partner app only (prominently disclosed prior to settings redirect). | | `android.permission.POST_NOTIFICATIONS` | Runtime (Android 13+) | Delivers push notifications for swap requests, proof reviews, and daily reminders. | | `android.permission.READ_MEDIA_IMAGES` | Storage (Android 13+) | Allows selecting screenshot proofs from gallery. | | `android.permission.READ_MEDIA_VISUAL_USER_SELECTED` | Storage (Android 14+) | Supports Android 14 partial photo picker permission. | | `android.permission.READ_EXTERNAL_STORAGE` | Storage (Legacy, maxSdk 32) | Backwards compatibility for screenshot picker on Android 12 and below. | | `android.permission.SYSTEM_ALERT_WINDOW` | Special Access | Enables the optional floating tester HUD and live testing timer over partner apps. | | `android.permission.VIBRATE` | Normal | Haptic feedback on notifications. | | `android.permission.INTERNET` | Normal | Communicating with backend APIs and servers. | *Note: High-risk permissions such as `QUERY_ALL_PACKAGES`, `SCHEDULE_EXACT_ALARM`, and `USE_EXACT_ALARM` are **NOT** used.* --- ## 7. Children's Privacy Testers Area is exclusively designed for developer professionals and students aged **13 and older**. We do not knowingly collect personal information from individuals under the age of 13. If we become aware that an account belongs to a child under 13, we will immediately delete the account and purge all associated data. Parents or guardians may reach us at `testersareaofficial@gmail.com`. --- ## 8. International Data Transfers Your data is processed and stored on cloud servers provided by Supabase and Google Cloud, which may be located in regions outside your country of residence. By utilizing the App, you consent to the transfer and storage of your information in these jurisdictions under industry-standard data protection protocols. --- ## 9. Your Privacy Rights Depending on your jurisdiction (such as under GDPR, CCPA, or applicable Indian data protection laws), you have the right to: - Access and inspect the personal data we maintain about you. - Correct inaccurate or outdated profile information. - Delete your account and all associated data directly in-app. - Opt out of personalized advertising via Android system settings. For questions or data requests, contact us at `testersareaofficial@gmail.com`. --- ## 10. Changes to This Privacy Policy We may periodically revise this Privacy Policy to reflect app updates, legal obligations, or new features. When material modifications occur, we will update the "Last Updated" date and display an in-app Policy Update Gate dialog upon opening the App. Continued use of the App constitutes acceptance of the revised policy. --- ## 11. Contact Us If you have questions, inquiries, or feedback regarding this Privacy Policy, please contact us: **Developer:** OpusVale Developer **Email:** testersareaofficial@gmail.com **Official Community Group:** testersarea@googlegroups.com