Privacy
Last updated 24 October 2026. This describes what the hosted Studio at app.runtapp.com actually does. It is written to be read, not to be survived.
The short version
We keep your email address so you can sign in, the test accounts you choose to give tapp (encrypted), and the evidence of runs you start. We do not sell anything to anyone, we do not run advertising trackers, and you can delete any of it yourself.
What we collect, and why
- Your email address. That is your account. It arrives either from Google or GitHub when you press "Continue with…", or from the address you type to receive a sign-in link. We ask those providers for your email address and nothing else — no profile, no contacts, no files — and we do not keep the access token they issue.
- Test accounts you give tapp. When a run meets a sign-in, tapp asks you for a username and password to use. If you say yes, it is stored encrypted (AES-256-GCM, keyed per site and per actor), used only to sign in to that site, and never shown again — not in the interface, not in reports, not in logs.
- Signed-in sessions. After a successful sign-in, the browser session (cookies) is kept encrypted the same way, so later runs start inside without asking again.
- Evidence of your runs. Screenshots, recordings, the page addresses visited, and the findings. This is the product: without it a run proves nothing.
- Journeys you keep and whether their last check passed or failed.
- Operational logs. Which account started a run and against which host, so we can tell whether the service is working. We deliberately do not log IP addresses, full URLs with query strings, or any credential.
What we do not do
- We do not sell or rent your data, and we do not share it with advertisers.
- We do not use your test accounts for anything except signing in to the site you pointed tapp at.
- We do not read your source code. The hosted Studio never receives it; repositories stay on your own machine.
- We do not send your data to a model provider. Exploration and replay are deterministic and use no AI service unless you supply your own key and switch it on.
Who else is involved
- Google or GitHub, if you sign in with them — they tell us your verified email address.
- Cloudflare, which sits in front of the site and carries the traffic.
- The site you point tapp at. A run visits it from our servers, so it appears in that site's own logs, as any visitor would.
Where it is kept, and for how long
On servers we control. Credentials and sessions are encrypted at rest; the key is held separately from the data and is never part of a backup you could read. Evidence and journeys stay until you delete them or close your account.
Getting rid of it
- A test account: press Forget next to it. It is deleted immediately and tapp will ask again next time.
- A journey: press Forget next to it.
- Your whole account, including every credential, session, journey and run: write to hello@runtapp.com from the address you signed in with and it will be deleted.
Children
tapp is a tool for people running software businesses. It is not directed at children and we do not knowingly collect their data.
Changes
If this changes in a way that affects what we collect or who sees it, the date above changes and we will say so on the site.
Contact
Questions, deletions, or anything that looks wrong: hello@runtapp.com.