Privacy Policy

Account data: your email address, an optional display name, and a salted scrypt hash of your password. We never store passwords in plain text.

Project configuration: the application name, URL, schedule and optional test-account email.

Test credentials: if you provide a password for a test account, it is encrypted at rest with AES-256-GCM before it is stored.

Exploration data: discovered pages, flows, action timelines, console and network observations, screenshots and replay videos produced while testing your app.

Your data is used only to run explorations, verify findings, generate reports and show you the results in your dashboard.

Project data is isolated per account. One account cannot read another account's projects, findings or evidence.

We do not sell, rent or share your data with third parties, and we do not use your application data to train models.

Locodera needs credentials only when the parts of your app you want explored sit behind a login. Use a dedicated test account with the minimum permissions required.

Credentials are decrypted in memory for the duration of a browser session and are never included in reports, screenshots or API responses.

Screenshots and videos are stored on the server that runs the worker and are served only to the account that owns the project.

Deleting a project deletes its explorations and findings. Evidence files can be removed by deleting the project's data directory on the host.

We use a single httpOnly session cookie to keep you signed in. There are no advertising cookies and no third-party analytics scripts.

You can delete a project, clear project memory, or ask us to delete your account and all associated data at any time via the Contact page.