Privacy Policy — TestMate (Chrome Extension)

Effective date: 5 October 2026 · Last updated: 23 October 2026

Product: TestMate — Test Execution & Evidence (Chrome extension)

Published by: Mozark

Contact for privacy questions: privacy@mozark.ai

This page is the privacy policy for the Chrome extension named above, and only for that extension. It describes what the extension collects, why, where it goes, how long it is kept, and how you delete it.

1. Summary

TestMate is a browser side panel used by software testers. It runs beside the web application you are testing so you can execute a test case, capture evidence of what happened (screenshots, recordings, network and console activity), and file a bug — without leaving the tab.

Three things are true of every data flow described below:

Nothing is collected in the background. Every capture is the direct result of a button you pressed or a toggle you switched on. Telemetry capture is off by default.
Your data goes to your workspace only. Data that leaves your browser goes to one destination: the Mozark test-management (TCM) workspace that your organisation uses or self-hosts, including its sign-in service. The extension makes no other network requests of its own. (Optional Android testing talks to a helper program on your own computer — see §3a — which is a local connection, not a network request.)
Nothing is sold, and nothing is shared with third parties. There is no advertising, no analytics service, no data broker, and no tracking of you across sites.

2. Who Is Responsible for Your Data

TestMate is distributed by Mozark. When you use the extension inside your employer's or client's workspace, that organisation is the controller of the test data you create; Mozark acts as a processor on their behalf under the agreement between Mozark and that organisation. Requests to access, export or erase workspace data are handled through that organisation's workspace administrator. Questions about the extension itself can be sent to privacy@mozark.ai.

3. What the Extension Collects, and Why

Data	When it is collected	Why	Where it goes
Sign-in session (your workspace sign-in token, your organisation, and your profile name and email)	When you sign in. On your workspace's own web app (for Mozark-hosted workspaces, `testcontext.mozark.ai`, `app.mozark.ai`, `tcr.mozark.ai`), the extension reads these from the page's local storage so you do not have to sign in twice. When you sign out of the web app, the extension signs out too	To authenticate you to your workspace and show who is signed in	Stored in `chrome.storage.local` on your machine; sent only to your workspace
Screenshots and screen recordings	Only when you press Screenshot, Record, or run a tool that captures an image (responsive sweep, device lab, accessibility scan)	Visual evidence attached to the test you are running	Held locally; uploaded to your workspace only as evidence on a saved test run
URLs and titles of the page under test	While you run a test, a tool, or telemetry capture on that tab	To record which page a test step or failure happened on	Local storage; uploaded only with an execution you save
Network requests and responses of the page under test — URL, method, status, timings, sizes, headers, and request and response bodies up to 16 KB each	Only while telemetry capture is switched on (off by default) with Network selected, and only for the tab being tested	To show what the application under test sent and received when a test failed	Local storage; uploaded only if you choose to save the logs to your workspace
Console messages and script errors of the page under test	Same toggle as above, with Console selected	To correlate a test failure with a script error	Same as above
Page performance timings	Same toggle as above, or when you run a performance audit	Performance findings on the test run	Same as above
Recorded workflows — the clicks, selected options and text you type into fields (up to 200 characters per field) on the page under test	Only between pressing Record and Stop, and only on the one site you are recording. Password fields are never recorded — the step is saved as masked	To replay the same steps later as a test	Stored locally; synced to your workspace so your team can replay it
Cookies of the page under test	When you open the Cookies tool; when you save a cookie profile	To inspect, edit, clear and re-apply cookies while testing	Shown to you live. A saved cookie profile keeps the cookie names and values on your machine so it can be re-applied. When it is synced to your workspace, values of session-, token- and auth-like cookies are replaced with `[REDACTED]` first
Browser storage of the page under test (localStorage, sessionStorage, IndexedDB, caches, service workers)	Environment snapshots and the Reset Environment tool	To record and reset the state a test ran against	Key names, counts and sizes only — never the stored values
Test preconditions you set — network throttling, viewport/device, location override, site permissions, API mock rules	Only when you set them	To reproduce the conditions a test ran under	Stored locally; saved with the execution and synced to your workspace as reusable profiles. The extension never reads your real location
Text you write — test results, comments, bug titles and descriptions	When you enter them	Your test management work	Sent to your workspace
Distributed trace identifiers	When the application under test emits one	To link a browser-side failure to the matching backend trace	Recorded on the execution
Extension diagnostics (extension version, sync queue depth, feature settings)	Computed on your machine	Troubleshooting in the panel	Not transmitted anywhere — shown in the panel only
Android device testing (optional — see §3a): the attached phone’s model, manufacturer, Android version and screen size; the titles and URLs of Chrome tabs open on the phone; screenshots and screen recordings from the phone	Only after you switch mobile testing on, install the TestMate Mobile Helper, connect a phone and choose it. Tab titles and URLs are listed so you can pick one; captures happen only when you press Screenshot or Record	To run a test case on a real Android phone and attach evidence from it	Device details and captures are attached to the test run, like desktop evidence, and uploaded to your workspace. The tab list is shown to you and not stored

3a. Optional Android testing

Android testing is off until you switch it on. Switching it on grants the extension Chrome's nativeMessaging permission, which lets it talk to the TestMate Mobile Helper — a separate program you install on your own computer that connects to a phone over USB using Android's debugging tool (adb). The helper has no network port, sends nothing over the network, and Chrome starts it only for this extension.

Nothing on a phone is read until you choose a device in the panel. You then pick what is captured:

Web app in Chrome — screenshots show only the one Chrome tab you selected.
Native app — screenshots and recordings show the phone's whole screen, including notifications and anything else on it. Close anything private before you capture.

You can switch it off at any time in chrome://extensions → TestMate → Details → Permissions, or by uninstalling the helper.

Personally identifiable information

The extension handles one set of directly identifying items: your workspace account identity (your sign-in token, and the name and email address of your profile), used solely to authenticate you and attribute test activity to you.

Any other personal information the extension holds is incidental — it is whatever appears inside the application you chose to test while you had capture switched on (for example, a name shown in a test account's profile page, or a value in an API response). The extension does not seek out, index or enrich such data; it stores it as part of the evidence for the test you ran, and it is deleted when that test run is deleted.

4. Secrets Are Redacted Before Anything Is Stored

When telemetry capture is on, the extension redacts credentials at the moment of capture — before data is written to disk, shown in the panel, or uploaded anywhere. The original values are never held by the extension.

Redacted automatically:

Authorization headers and bearer tokens
Cookie and Set-Cookie headers
API keys and key-shaped header values
Request and response body fields whose names look like a password, token, secret or key

Redacted values are replaced with [REDACTED].

5. What the Extension Never Collects

Payment card or financial account details
Government identification numbers
Health information
Biometric or genetic data
Your real physical location (only a test override value you type in yourself)
Your browsing history, browsing activity or open tabs outside the tab you are actively testing
Keystrokes, form input or screen content outside a recording or capture you start yourself — and password fields, even then
Any data used for advertising, profiling, or determining creditworthiness

6. Which Pages the Extension Runs On, and Why It Asks for Broad Access

Chrome shows the extension as able to read data on all sites. That access exists because the tester decides which site is under test — it can be any internal or customer URL, and it cannot be known in advance. In practice:

The extension reads a page only in the tab you are actively testing, and only to run a capture, measurement or accessibility check you asked for.
It does not observe, record or transmit anything from tabs you are not testing.
With telemetry capture off (the default), it captures nothing from any page until you press a capture button. To be ready when you do, a small capture script is present on each page you open; until you start capture it only listens for that instruction, and it does not read or change the page.

Permission-by-permission justification:

Permission	Used for
`sidePanel`	Renders the TestMate panel
`storage`	Stores your session, settings and locally queued evidence
`scripting`	Runs a capture, measurement, accessibility scan or recording against the tab you are testing, and the sign-in bridge on your workspace’s web app
`debugger`	Chrome DevTools Protocol, only while you use a tool that needs it: device and viewport emulation, the device-lab mirror, network throttling, location override, API mocking, and page-load performance audits. Chrome shows its “being debugged” bar while it is attached
`cookies`	The Cookies tool and the cookie part of Reset Environment
`browsingData`	The Reset Environment tool, when you run it — scoped to the site under test, except Chrome’s HTTP cache, which Chrome cannot scope and which the tool tells you it cleared browser-wide
`contentSettings`	Setting permissions (e.g. camera, notifications) for the site under test as a test precondition
`alarms`	Scheduling the background sync of queued evidence
`nativeMessaging` (optional — asked for only when you switch on Android testing)	Talking to the TestMate Mobile Helper on your computer to test on a USB-connected Android phone (§3a)
Host access	Reaching your workspace API, and operating on the site you are testing

7. Where Data Is Stored, and for How Long

On your machine: in Chrome's extension storage and IndexedDB. Local evidence is bounded by a storage budget and is evicted oldest-first automatically.
In your workspace: only data you saved to a test run. Retention follows your organisation's own policy for that workspace. Deleting a test run removes the executions, events and evidence attached to it.
Your authentication token: kept until you sign out or it expires.

Mozark-hosted workspaces store data with reputable cloud infrastructure providers and may process it in regions including India and the United States. Access is restricted to authorised personnel, data is encrypted in transit (TLS), and evidence storage is encrypted at rest.

8. Third Parties and Disclosure

The extension transmits data to no party other than the test-management workspace your organisation uses or self-hosts.

Mozark does not sell personal data, does not transfer it for any purpose unrelated to running and recording tests, and does not use it for advertising or credit decisions. Cloud hosting and storage providers process data strictly as subprocessors on our instructions. Data may be disclosed where required by law.

Chrome Web Store Limited Use

Our use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically, we do not sell user data, do not use or transfer it for serving advertisements, do not use it to determine creditworthiness or for lending purposes, and do not allow humans to read it except with your organisation's explicit consent, where required for security or to comply with applicable law, or where the data has been aggregated and anonymised.

9. Deleting Your Data

To delete	Do this
A single execution’s events, evidence and local images	Delete the execution in the panel
Your authentication token	Sign out
Everything the extension stored locally	Uninstall the extension
Data already uploaded to your workspace	Delete the test run it belongs to, in the workspace
Anything else, or a formal erasure request	Email privacy@mozark.ai, or contact your workspace administrator

We respond to verified access, correction, export and deletion requests within 30 days. Depending on where you live, you may have rights under the GDPR, the UK GDPR, the Indian DPDP Act or the CCPA/CPRA; this policy is written to honour those rights for all users regardless of location.

10. Children

TestMate is a professional software-testing tool intended for workplace use. It is not directed at children, and we do not knowingly collect data from anyone under 16.

11. Security

Data in transit is protected with TLS. Credentials observed in captured traffic are redacted before storage (Section 4). Access to Mozark-hosted workspace data is role-based and restricted to authorised personnel. No system is perfectly secure; if you believe you have found a vulnerability, report it to privacy@mozark.ai.

12. Changes to This Policy

If this policy changes materially, the "Last updated" date at the top of this page changes with it, and we will note the change here. Continued use of the extension after an update constitutes acceptance of the revised policy.

13. Contact

Mozark
Privacy enquiries: privacy@mozark.ai

For data held in your organisation's workspace, contact your workspace administrator first — they control that data.