Privacy Policy

When you use BattleTester, we collect and store the following:

• Account information: your name, email address, and authentication tokens, managed through our auth provider (Clerk).
• Scan targets: the URLs and endpoints you submit for testing.
• Credentials you provide: login credentials for the roles you configure (e.g. user, admin accounts on your app). These are stored as long as the scan record exists and are never used for any purpose other than running the scan.
• Scan results and reports: discovered endpoints, vulnerability findings, severity ratings, and scan logs generated during testing.
• Payment information: if your full pentest finds High or Critical vulnerabilities and you unlock the report, our payment processor (Polar) handles the transaction and collects your payment details directly. We do not receive or store your card number.

Analytics and advertising: we use Google Analytics to understand site usage and the Reddit Pixel to measure ad performance, covering things like pages visited and actions such as starting a scan, verifying a site, or completing a purchase. Google Analytics runs by default in a cookieless, anonymized mode that does not identify you or persist across visits; the Reddit Pixel only loads once you accept cookies. If you accept cookies via the banner shown on your first visit, Google Analytics upgrades to standard cookie-based tracking and the Reddit Pixel begins running, for more accurate measurement and ad targeting. Neither tool ever has access to your scan targets, credentials, scan results, or findings. You can withdraw consent at any time; see "Cookies & Ad Tracking" below.

• To authenticate you and manage your account
• To run security scans against targets you submit
• To generate and display your scan reports
• To improve the service (for example, reducing false positives and improving detection accuracy)

We do not:

• Sell your data to third parties
• Share your scan results with anyone other than you
• Use your credentials for any purpose other than running your scan
• Use your scan targets, credentials, results, or findings for advertising

The operator of BattleTester may review scan reports and findings for the sole purpose of improving the service (for example, to reduce false positives, improve detection accuracy, and understand how the tool performs across different application types).

This access is limited to the operator and is never used to disclose, share, or act on your findings in any other way.

The only third-party service we use is:

• Clerk: handles authentication and account management. See Clerk's Privacy Policy.
• Google LLC (Google Analytics): always active in a cookieless, anonymized mode to understand site usage; upgrades to cookie-based analytics if you accept cookies. See Google's Privacy Policy.
• Reddit, Inc. (Reddit Pixel): only loads and measures ad performance if you accept cookies. See Reddit's Privacy Policy.
• Polar: processes payment when you unlock a full pentest report. See Polar's Privacy Policy.

No other third parties receive your data.

Google Analytics runs from your first visit in a cookieless, anonymized mode: it can see page views and key on-site actions (like starting a scan, verifying a site, or completing a purchase), but sets no cookies and does not identify you or track you across visits. The Reddit Pixel does not run at all until you accept cookies. On your first visit, we ask whether you're okay with cookies. If you accept, Google Analytics upgrades to set standard cookies (such as _ga) and the Reddit Pixel begins running and sets its own cookie (_rdt_uuid), for more accurate measurement and to help us optimize ad campaigns. If you decline, Google Analytics stays in anonymized, cookieless mode and the Reddit Pixel stays off.

These cookies are separate from your account session and never carry your scan targets, credentials, results, or findings. They only carry anonymous on-site browsing behavior tied to your browser.

You can change your choice at any time: Manage cookie preferences.

Scan reports, findings, and associated credentials are stored indefinitely until you delete the scan. Once a scan is deleted, all data associated with it is removed.

Account data is retained for as long as your account is active. If you want your full account and all associated data deleted, contact us at info@battletester.app.

• You can delete individual scans and their data directly from the app at any time
• You can delete your account through your account settings (managed by Clerk)
• To request deletion of all scan data associated with your account, email info@battletester.app
• You can ask what data we hold about you at any time via the same email

We may access and disclose your data if required by law or to investigate suspected misuse of the platform.

We may update this policy from time to time. Material changes will be communicated via the platform. Continued use of the service after changes constitutes acceptance.