Privacy policy

This policy explains what personal data EmailTestr collects when you use emailtestr.com, why, and what you can do about it. We've tried to keep it plain.

Who we are

EmailTestr is run by Daniel Brown, trading as Email Testr, a sole trader in the United Kingdom ("we", "us"). We're the data controller for the personal data described here. Contact us at [email protected] about anything in this policy.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a scrypt hash. We can never see your actual password.
• When you signed up, and whether you've confirmed your email.

Your tests

• The HTML you upload, paste or email to your test address, the subject line, and for emailed tests the sender's address.
• The screenshots we make from it and the results of our checks.
• Test emails often contain personal data about your recipients, such as names in a greeting. You decide what you send us; we only use it to produce your previews.

Billing

• Your plan, billing currency and the dates of your billing period.
• Payments are handled by Stripe. We never see or store your card details. Stripe tells us your customer and subscription IDs so we can link payments to your account.

Security and technical data

• Your IP address and browser details when you sign in, kept with your session so you can see and end sessions, and to slow down repeated sign-in attempts.
• Server logs, kept briefly to fix problems and spot abuse.

Cookies

• Sign-in (better-auth.session_token and related): keeps you signed in. Strictly necessary, so it doesn't need consent. Lasts up to 30 days.
• Currency (currency): remembers whether you chose pounds, dollars or euros on the pricing page. Lasts a year.
• Your cookie choice (et_consent): remembers whether you accepted or rejected analytics. Lasts a year.
• Google Analytics (_ga, _ga_*): only if you press Accept on the cookie pop-up. They tell us, without identifying you, which pages are visited and how people find the site. They last up to 2 years. Google Analytics is provided by Google, through Google Tag Manager, and may process data in the United States. Analytics never runs inside the app, where your tests are.

Visit counting without cookies. We also count visits to the public website ourselves, without cookies and without storing your IP address: each page view records the page, the site that linked to it, and a code made from your IP address and browser with a random value that changes every day and is never stored. That lets us count daily visitors without being able to recognise you on another day. Kept for 400 days. Nothing is counted inside the app.

You can change your choice any time with Cookie settings at the bottom of every page. We don't use advertising cookies.

Why we use it, and our lawful basis

What we do	Lawful basis
Create and run your account, produce your previews and checks, keep your test history	Contract: it's the service you signed up for
Take payments and keep billing records	Contract, and legal obligation (tax records)
Send account emails (confirmation, password reset, usage warnings)	Contract
Protect the service: rate limits, abuse and fraud checks, security logs	Legitimate interests in keeping the service safe
Check new passwords against known data breaches	Legitimate interests in keeping your account safe

We don't sell your data, and we don't use your test emails for anything except producing your results.

Who processes it for us

We use a small number of providers, each under a contract that limits what they can do with your data:

• 123 Reg, United Kingdom: the server that runs EmailTestr and stores your account and tests.
• Cloudflare: domain, security and delivery of the website.
• Stripe: payments and invoices.
• Mailgun: sending your test emails to our test inboxes, and receiving emails sent to your test address. EU region.
• Microsoft (Outlook.com) and Yahoo: when you choose a real inbox preview, your test email is sent to an Outlook.com or Yahoo Mail account that we own, so we can screenshot it there. We delete it from that inbox straight after the screenshot.
• Google Workspace: sending account emails (confirmation, password reset, usage warnings), and our own email if you write to us.
• Google (Analytics and Tag Manager): visit statistics for the website, only if you accept analytics cookies.
• Have I Been Pwned: when you choose a password, we send the first 5 characters of a one-way hash of it, never the password itself, to check whether it has appeared in a data breach.

Some of these providers are based in, or may process data in, the United States. Where data leaves the UK, it's protected by the UK's adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses.

How long we keep it

• Tests (HTML, screenshots, results): deleted automatically 30 days after you run them, or 90 days on the Pro plan. You can delete any test sooner.
• Your account: until you delete it. Deleting your account (Settings → Delete account) removes your tests and screenshots straight away, and cancels any subscription.
• Billing records: kept for 6 years after the end of the tax year they relate to, as UK tax law requires. Stripe holds these.
• Backups: our database backups are kept for 14 days, so deleted data disappears from backups within 14 days.
• Server logs: up to 30 days.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data
• correct anything that's wrong
• delete your data (you can also do this yourself in Settings)
• give you your data in a portable format
• stop or limit how we use it, or object to our use of it

Email [email protected] and we'll reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.

Children

EmailTestr is a business tool and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll email account holders before the change takes effect. The date at the top shows when it was last updated.