Privacy Policy

Last updated: 27 October 2026

This page explains which data is processed when you visit squally.dev or the documentation at docs.squally.dev and when you use the Squally app at app.squally.dev, who receives it and how long it is kept.

Squally is operated from Germany. Processing is governed by the General Data Protection Regulation (GDPR, in German: DSGVO); article references below refer to it.

1. Controller

No data protection officer has been appointed; the conditions requiring one are not met.

2. Summary

Test data and account data are stored in the EU, with the app and its database in Frankfurt, Germany. AI analysis is opt-in and, when you start it, sends excerpts of a test failure to Anthropic in the United States. Squally has no ads, no tracking and no analytics.

3. The website

3.1 Visiting the website (hosting)

The website and the documentation at docs.squally.dev are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When a page is requested, Vercel processes technically necessary access data, in particular the IP address, the time of the request, the address requested, the amount of data transferred, and browser and device information.

• Purpose: delivering the site, operational security, prevention of abuse.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating the website securely and reliably.
• Retention: the access data is processed by Vercel and deleted there after a short period; we have no permanent access to these logs ourselves.
• Third-country transfer: a data processing agreement is in place with Vercel. The transfer is based on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR).

3.2 Waiting list

Anyone joining the waiting list provides an email address. No other information is collected.

• Purpose: a single notification once access becomes available.
• Legal basis: Art. 6(1)(a) GDPR — consent, given by submitting the form.
• Processor: the form is handled technically by Formspree Inc., 2093 Philadelphia Pike #1958, Claymont, DE 19703, USA. The address is transmitted there and then delivered by email.
• Retention: Formspree's free plan keeps the submission history for 30 days. The delivered email remains in the controller's mailbox beyond that, until the purpose no longer applies or consent is withdrawn.
• Third-country transfer: based on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.
• Withdrawal: consent can be withdrawn at any time, informally, by email to support@squally.dev. The address is then deleted. The lawfulness of processing carried out until then remains unaffected.

3.3 No cookies, no analytics

The website and the documentation set no cookies and embed no analytics, tracking or advertising services. There is no profiling and no automated decision-making.

The documentation keeps one entry in your browser's local storage, starlight-theme: the colour scheme it shows, light or dark. It never leaves your device.

4. The Squally app

The app at app.squally.dev collects and analyses the results of Playwright test runs for organizations that sign up for it. The sections below describe what it processes about the people who use it and about the tests it receives.

4.1 Account data

Sign-in runs on Squally's own infrastructure: account data and sessions are stored in the app's database in Frankfurt, Germany.

When you create an account or are invited to an organization, the app processes:

• your email address and name;
• your password, stored only as a hash — if you set one;
• your sessions: the IP address and the browser (user agent) they were started from, and when you last signed in;
• your Google account ID, if you sign in with Google (see 4.2);
• the organizations you belong to and your role in each.

• Purpose: providing your account, signing you in and giving you access to your organizations.
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract for the service (the Beta Terms).
• Security: to protect accounts, the app also uses a bot check (Cloudflare Turnstile). It is loaded from challenges.cloudflare.com as soon as the sign-up page or the password-reset page opens, and when you ask for a confirmation code to be sent again; signing in, also with a code, does not use it. Turnstile stores a token in your browser's local storage for challenges.cloudflare.com. The app further uses a check whether a new password has appeared in a known data breach (Have I Been Pwned, see section 5), rate limits on sign-in attempts per IP address, and a log of the sign-in emails it sends. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting accounts against abuse.
• Sessions end when you sign out, or when a session has not been used for 7 days.

4.2 Sign in with Google

If you choose to sign in with Google, we receive your email address, your name and your Google account ID from Google and use them only to sign you in. They are not used for advertising, not shared and not sold. We do not store your Google profile picture.

4.3 Test data

When an organization connects its CI pipeline, the squally-reporter sends the results of its Playwright test runs: test names and file paths, statuses and durations, error messages, stacks and code snippets, page snapshots, the test output, CI details and git details (branch, commit, commit message and author name). For attempts that failed or were retried it also uploads screenshots, traces and the browser console. For an attempt that did not pass on its first try, Squally also receives the steps Playwright recorded – the titles of its actions, checks, hooks and fixtures, their durations and code locations. Typed values are removed before sending, and known secret patterns are masked. Steps are kept with the run's data and deleted with it. Secrets in common formats are masked in the text fields before they are stored; screenshots and traces are stored as they are.

The organization decides what its tests send: the content comes from its own test code, its configuration and its repository. The complete list of fields, the masking rules and how to send less are on What the reporter sends.

• Purpose: showing the organization its test results, failures and trends.
• Role: Squally processes test data on behalf of the organization as a processor (Art. 28 GDPR), under the Data Processing Agreement. The organization is the controller.
• Location: the database is in Frankfurt, Germany; screenshots, traces and browser consoles are stored in the EU.

4.4 Emails

The app sends:

• account emails: sign-in, confirmation and password-reset codes, a notice when someone tries to sign up with your address, and invitations to an organization;
• run reports: a weekly summary of a project's test results, set up by an admin of the organization. It contains test names, file paths, the headlines of errors, counts and the branch. Members of the organization receive it once they are added; an address outside the organization receives a confirmation request first. Every report email has a link to unsubscribe in one click.

• Legal basis: account emails Art. 6(1)(b) GDPR; run reports to members Art. 6(1)(b) GDPR, to confirmed addresses outside the organization Art. 6(1)(a) GDPR — consent, withdrawable by unsubscribing.
• Processor: emails are sent through Resend (see section 5).

4.5 AI analysis

AI analysis is opt-in. It needs the Standard or Pro plan and a setting in the project that is off by default, and it runs only when someone clicks to analyse a failed attempt. Nothing is sent before that.

When an analysis is started, the following is sent to Anthropic in the United States, which writes the explanation: the test's name and file path, the browser, the branch, which attempt it is (first try or retry number), whether a later retry of the test passed in the run, a one-line summary of the test's other attempts in the run, the command to run the test locally, the error messages, the top lines of each stack, the code snippet and its location, an excerpt of the page snapshot, the attempt's duration, its timeout and whether it was hit, a derived error category, and the test's flaky rate and failure rate over its recent CI runs.

Not sent: the commit author, the commit message, the test output and browser console, screenshots, traces, the recorded steps, and any account data.

• Role: Squally runs the analysis on behalf of the organization as a processor (Art. 28 GDPR), under the Data Processing Agreement. The organization is the controller; it switches the feature on and starts each analysis.

4.6 Error monitoring

The app records its own errors with Sentry, hosted in the EU (Germany). It records errors only: no performance tracing and no session tracking. It is configured not to send personal data by default. Before an error is sent, request bodies (which can contain test data), cookies and authorization headers are removed from it. Sentry does not store IP addresses.

• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in finding and fixing errors in the service.
• Retention: Sentry deletes error events after 30 days.

4.7 Cookies

The app uses only cookies that are strictly necessary to provide it. No consent is required for these, and there are no tracking or advertising cookies.

• Session token (__Secure-squally.session_token): keeps you signed in; kept for 7 days, renewed while you use the app, and removed when you sign out (see 4.1).
• OAuth state (__Secure-squally.state): set only while you sign in with Google; kept for 5 minutes.
• active_project_id: remembers the project you opened last, so the app opens it again; kept for one year.
• display_tz: your display time zone, so dates are shown in it; kept for one year.

The app also keeps a few settings in your browser's local storage, which never leave your device: the colour theme, whether the sidebar is collapsed, the title and notes you type on a run report, and, when you sign out, a message that tells the app's other open tabs that you signed out, so they return to the sign-in page (better-auth.message).

5. Sub-processors

The following service providers process data on our behalf.

Website

Test data

For test data, these are sub-processors under the Data Processing Agreement (Annex 2).

Account, email, security

6. Integrations you enable

An organization can send its data to further services. These are destinations it configures, not our sub-processors:

• GitHub App: posts checks and pull-request comments with test titles, file paths, counts and a link to the run — no error text.
• Slack webhook: posts a message with the project, the branch, the commit message, counts and a link to the run.
• Playwright trace viewer at trace.playwright.dev (Microsoft): opened only when you click to view a trace; it receives a temporary link to that trace, valid for ten minutes.
• Read API and MCP server: anyone holding a read key of the organization (created by its owner or an admin, on the Standard and Pro plans) can retrieve its test data: runs with branch, commit, commit message, author name, pull request number and title and CI link, and test results with their error messages, stack traces and code snippets; for a failed attempt also a prompt that contains an excerpt of the page snapshot. Console output, screenshots and traces are not returned. The data goes to the tools the key holder chooses.

7. Retention

Runs and their results are deleted after a period that depends on the organization's plan, at most 90 days. Screenshots, traces and browser consoles are deleted after 7 days for attempts that passed on their first try and after 21 days for failures and retried tests. An AI explanation is stored with the attempt it was written for and deleted together with its run, after the plan's retention period. The log of sign-in emails is deleted after 30 days. Details are on Retention.

You can delete your account yourself: open Account settings in the user menu and choose Delete account under Danger zone. An organization's owner can delete the organization under Settings → Organization → Danger zone. It is locked at once and deleted for good 30 days later, unless the owner restores it before then. You can also ask us to delete an organization by email to support@squally.dev.

8. Your rights as a data subject

Under the GDPR you have the following rights:

• access to the data processed about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)
• withdrawal of consent with effect for the future (Art. 7(3))

An informal email to support@squally.dev is enough for any of these.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority here is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Changes

This policy will be updated whenever the processing changes — in particular when we add or change a service provider. The version published here, with the date given above, is the one that applies.