Privacy Policy

Regress is run by Stoffberg, LLC, a Delaware limited liability company at 131 Continental Dr, Suite 305, Newark, DE 19713, USA (“Regress”, “we”, “us”). This policy covers regress.app, api.regress.app and the Regress service (the “Service”).

For your account and website data, we decide how the data is used. That makes us the controller under the GDPR and the business under California law. For data collected from the sites you point Regress at, we process it for you, as your processor or service provider. You decide which sites get scanned.

• Account. Your email address and, if you give them, your name and profile image. You sign in with an emailed link, so there is no password. We keep the one-time sign-in tokens we send and a record of each session: its token, start and expiry times, your IP address and your browser's user agent.
• Billing. Your plan, subscription status and your Stripe customer and subscription IDs. Stripe handles payments. Your card number goes to Stripe and never reaches us.
• Project settings. The URLs you add, project names, scan settings and schedules, the email address for alerts, and whatever you connect: a GitHub repository (owner, name and installation ID), a Slack webhook URL, a Jira connection and your deploy webhook secret. API keys are stored as hashes.
• Scan data from your sites. When a scan runs, a browser loads your pages like a visitor. We keep page addresses, titles, headings, forms and their fields, buttons, tables, links and navigation, short text excerpts, full HTML snapshots and screenshots. We also keep the hosts, routes and responses of the API calls a page makes (with fields that look personal or secret filtered out), load timings, the flows and test plans we generate, and the result of every test step, including failures.
• Site logins you set up. For signed-in scans: usernames, passwords, 2FA secrets, tokens, recorded login steps, cookies and browser storage, as you provide or record them. “How we protect it” below explains how they're stored.
• Usage. Monthly counters such as pages scanned and flows tested, used to apply plan limits.
• Operational data. Technical logs and metrics, such as request paths, timings, error messages and project and scan IDs, used to keep the Service running.
• Messages. Whatever you send us by email.

A scan can capture anything visible on a page, including personal data that your own users or test accounts display on screen. It can end up in a screenshot, a snapshot or a text excerpt. Where you can, scan with a test account that holds fake data.

We don't run advertising or third-party analytics on regress.app, and we don't sell your personal information or share it for advertising. What we do set:

• A session cookie once you sign in. It keeps you signed in and the Service needs it to work.
• Two items in your browser's local storage, regress-theme and regress-sidebar, which remember light or dark mode and whether the sidebar is collapsed. They stay in your browser.

Cloudflare, which hosts the site, may set its own security cookies, such as ones that detect bots. We don't use tracking cookies, so we don't show a cookie banner.

• To run the Service: sign you in, run scans, generate and run tests, send alerts and bill you. Basis: performing our contract with you.
• To keep it secure and working: rate limiting, preventing abuse, debugging and capacity planning. Basis: our legitimate interest in running a safe and reliable service.
• To improve Regress: understanding how features perform from our logs and usage counters. Basis: our legitimate interests.
• To talk to you: sign-in links, scan alerts, billing and service notices, and replies to your messages. Basis: contract and legitimate interests. Today the emails we send are service emails.
• To meet legal duties and enforce our terms: tax and accounting, answering lawful requests and stopping misuse. Basis: legal obligation and legitimate interests.
• Anything else we ask you about first. Basis: your consent, which you can withdraw at any time.

We don't sell your personal information, and we don't train AI models of our own on the data we collect from your sites.

These providers help us run Regress. They handle data for us under their own terms:

• Cloudflare, Inc. Hosting, database, file storage, queues, the browsers that scan your pages, the gateway for AI requests, metrics, email sending and the network in front of the site. It handles everything we store and process.
• Stripe, Inc. Payments and subscriptions. It receives your email address, your plan, an internal account ID and the payment details you enter on Stripe's pages.
• OpenRouter and the AI model providers behind it. See the next section.
• GitHub, Slack and Atlassian (Jira). Only if you connect them. They receive what the integration needs, such as check results, pull request comments, alerts and tickets.

We may also disclose data to professional advisers, when the law or a valid legal request requires it, to protect people, the Service or our rights, or as part of a merger, acquisition or sale of assets. We'll update this list if our providers change.

Regress uses large language models to understand your pages, write test steps, repair broken steps, check what a screenshot shows and explore your app. To do that, we send content from your scans to OpenRouter, which passes it to the company that runs the model. The request goes through Cloudflare's AI Gateway, which can keep a log of it.

That content includes page URLs, titles, headings, text excerpts, form field names and types, button and link labels, table headings, test steps and failure details and, for visual checks, a screenshot of the page. At the time of writing the default model is provided by OpenAI. We may change models and providers.

Your stored logins are used by the scanning browser and aren't included in the prompts we write. The model does see what a page shows, though. Don't scan pages that display sensitive personal data, health data, payment card numbers or secrets you wouldn't want a service provider to see. Each provider handles prompts under its own terms and retention rules, which we don't control.

• Scan runs and their results, step results and timings are deleted automatically after up to 90 days.
• Projects, their pages, baselines, flows, test plans and stored logins stay until you delete the project in Project settings or ask us to delete them.
• Screenshots and page snapshots are files in separate storage. Deleting a project or letting a run expire removes the records that point to them, but the files themselves aren't removed automatically today. Some of these files are shared between identical pages and aren't labelled with an account, so once those records are gone we may not be able to find or delete every file that came from your scans. Email us before you delete a project if you want its files removed and we'll do what we can.
• Session cookies from your last successful login stay until you change or remove that login or delete the project.
• Working data for a scan in progress or a login you're recording is held briefly and cleared automatically afterwards.
• Your account stays until you ask us to delete it.
• Billing records stay with us and Stripe for as long as tax and accounting law requires.

We may keep data longer where needed to comply with the law, resolve a dispute or enforce our agreements.

• The site and API are served over HTTPS.
• Saved site logins (usernames, passwords, 2FA secrets, tokens, recorded steps, cookies and browser storage) are encrypted with AES-GCM before they're stored. Jira tokens are encrypted the same way.
• Deploy webhooks must carry a valid HMAC SHA-256 signature, and we verify GitHub and Stripe webhooks too. API keys are stored as hashes.

Some data is stored without that extra layer. After a successful login we keep the session cookies in our database so the next scan can reuse them, and we don't separately encrypt that copy. The same goes for Slack webhook URLs and each project's deploy webhook secret. If you suspect any of these were exposed, change the login or replace the secret in Project settings. Setting up a login again replaces the cached cookies.

No system is perfectly secure and we can't guarantee that yours won't be breached. If a breach affects your personal data, we'll tell you and the authorities as the law requires. To report a vulnerability, see our security page.

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or stop how we use it, or move it to another service. You can withdraw consent where we rely on it. California residents can also ask what we collect and disclose and can ask us to delete or correct it. We don't sell or share personal information for advertising, so there is nothing to opt out of, and we won't treat you worse for using your rights.

Email dirk@stoffberg.dev to make a request, including to delete your account. We may need to confirm it's you first, and an authorised agent can act for you with proof of permission. We'll respond within the time the law allows. You can delete projects yourself in Project settings at any time. If you're in the EU or UK, you can also complain to your local data protection authority.

If your site holds personal data about your own users, you decide what we process and you're responsible for having the right to scan it. If you need a data processing agreement, email us.

Regress is for businesses and developers. It isn't directed to anyone under 16 and we don't knowingly collect their personal data. If you think a child has given us information, email us and we'll delete it.

We're in the United States, and our providers process data in the United States and in other countries where they operate. If you use Regress from outside the US, your data will be transferred there. Where the law requires a transfer mechanism, such as for transfers from the EU, UK or Switzerland, we rely on standard contractual clauses or another mechanism the law recognises.

We may update this policy. We'll post the new version here with a new effective date, and where a change is significant we'll tell you by email or in the app. If you keep using Regress after a change takes effect, you accept the updated policy.

Stoffberg, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA

dirk@stoffberg.dev