Privacy Policy

• Account details — the name and email address you sign up with. Your password is never stored as you typed it; we keep only a cryptographic hash.
• X (Twitter) verification data — if you connect an X account: the handle you claim, the public account id, and the public verification post used to prove the account is yours. We never ask for your X password and use no X OAuth access to your account.
• Participation records — the Test Drives you join, the drafts you register, and links to the reviews you publish on X.
• Consent records — when you create an account, we store the consent statement you agreed to, its version, and the time you agreed.
• Technical data — a session cookie that keeps you signed in, and the IP address and browser identifier attached to each session for security and abuse prevention.
• Product analytics — usage events, page views, and error reports (the error message, a technical stack trace, and the address of the page where the error happened), collected through PostHog and stored on its EU servers. When you are signed in, these events carry your account id, email address, and name. Your browser's Do-Not-Track setting is respected, and we never record your screen or session.

• Running your account: signing you in, verifying your email address, and resetting your password when you ask.
• Running Test Drives: checking eligibility, connecting your X identity to your reviews, and showing public review activity.
• Keeping the service safe: rate limiting, abuse prevention, and investigating security incidents.
• Contacting you about the service — verification and password emails, and messages about Test Drives you take part in.
• Understanding how Test Drive is used — which pages are visited and which steps fail — so we can improve it.

We do not sell your personal data, and we do not share it with third parties for their advertising.

Test Drive is a public-review product. Your X handle, your Builder Rankings position, and the reviews you choose to publish on X are public — on X and on Test Drive pages that list them. Everything you post on X is governed by X's own terms and privacy policy, not by this one.

We keep your data while your account exists. You can have it erased at any time — Article 17 of the GDPR (the right to erasure) applies. The delete my data page describes both deletion routes: the in-account delete button and a written request, which we complete within 30 days.

For any privacy question or request, reach us through the contact page. If you believe we have mishandled your data, you also have the right to complain to your data protection authority.

If this policy changes in a way that matters, we will update the date at the top and, where the change affects what you agreed to at sign-up, ask for your agreement again.