Security and privacy in plain words
This page says what we actually do with your files today. The legal text is the Privacy Notice; if the two ever disagree, tell us at support@truetest.uk and we will fix it.
Your files
- Code, settings and reports are read as text or data. They are never run as given: we rebuild the rules and run our own copy in the TrueTest test environment.
- Compiled files (.ex5/.ex4) are never decompiled; we ask for the Strategy Tester report instead.
- We never sell or publish your files. A share link shows results only, and only if you make one.
The rule card and the outside AI
To test code we need its rules as a short list (the rule card). An outside AI service can draft it in minutes, but only if you tick the box:
| Question | Answer |
|---|---|
| Who | Our AI service, run by an outside AI provider, on servers outside the UK |
| What is sent | the text of your code and settings files, your strategy name and our first-read notes |
| Removed first | email addresses, web links, author or copyright lines and values that look like passwords, keys or tokens (best effort: do not send secrets in your code) |
| When | only if you tick the box on the upload form (or an AI agent sets ai_draft for you after asking you) |
| If you say no | a person writes the rule card, normally within 2 working days |
| Checks on its answer | the AI's draft is checked by our code against the rule grammar, and you read and confirm the plain-English rule card before anything is tested; AI drafts can be wrong, so check every number. The lab record keeps the provider, model, prompt version and a fingerprint of exactly what was sent |
Labs made before 5 November 2026 (when this choice was added) show "not recorded" for this step on the receipt check.
How long we keep things
| What | How long |
|---|---|
| Your upload before you give an email (first read) | up to 60 minutes, in memory only, then gone unless you start a lab |
| Code and settings files | up to 90 days |
| Your Strategy Lab | 12 months after your last visit, run or confirm, then deleted with its results and forward watch (one reminder email 30 days before); ask us and we delete it sooner |
| How many versions you have tested | a coded count of how many versions you tested (for the luck bar; it holds no email address): 24 months after your last activity |
| Backups | 14 days, encrypted, on the server and on our own computer in the UK |
| Trade records you upload | 30 days |
| Web server logs (they hold IP addresses) | 14 days |
| Paid report downloads | 30 days |
The server
- HTTPS on every page; the site cannot be framed by other sites.
- One server in the United Kingdom. Login only with a key, never a password; a firewall allows web traffic and that login only.
- The website, the lab and the AI-agent service run as a limited user, not as the administrator; the translator and the partner service each run as their own separate user with their own key.
- Payments are handled by Stripe; we never see your card number.
What we cannot promise
No system is unbreakable. If a breach affects your data, we will tell you and the Information Commissioner's Office as the law requires.
Report a problem
Found a security problem? Email support@truetest.uk with "security" in the subject. Please do not test against other customers' data. Machine-readable: security.txt.
We know of no security breach. Operational incidents are listed on How we test, under Known incidents.