Outqube

Privacy policy

Last updated 2 November 2026

Outqube is an AI agent that tests web apps in a real browser and records proof of every step. This policy covers the Outqube app (app.outqube.com), its API, its MCP server (mcp.outqube.com), its CLI, Chrome extension and GitHub app, and this site. Your organisation decides what it tests with Outqube; we process that data on its behalf.

What we collect

  • Account data: your name and email address, your organisation's name, and the role you have in it. If you sign in with a password, we store only its hash.
  • Test definitions: the tests, suites, apps, environments, schedules and instructions your organisation writes, including the URLs of the apps under test.
  • Run results: each run's status, verdict, timings, cost, the bugs it found and the bug reports made from them.
  • Step text and the test agent's reasoning: what the agent did at each step, and the reasoning and model calls behind each action and verdict.
  • Screenshots of the app under test: screenshots and video taken during a run, which show whatever the app under test displays.
  • Console and network logs: the browser console messages and network requests the app under test makes during a run.
  • Test logins: the usernames and passwords Outqube uses to sign in to the app under test, encrypted at rest. They are never sent to an AI model and never appear in logs, step records, error reports or screenshots.
  • Usage and technical data: sign-in events, an audit log of changes in your organisation, IP addresses in server logs, and error reports.

The MCP server

When you connect an AI client (such as Claude, ChatGPT or Cursor) to the Outqube MCP server, its tools return what Outqube stores about your tests and runs: test definitions, run results, step text, screenshots of the app under test, and console and network entries. The get_profile tool returns your name and email address to the AI client, so it can label the connected account (for an API key, it returns the key's name instead).

The MCP server reads nothing from your conversation beyond the inputs of each tool call. What the AI client does with the results is governed by its provider's own privacy policy.

How we use it

  • To run your tests, show their results and send the notifications you set up.
  • To sign you in, keep your organisation's data separate and secure the service.
  • To find and fix errors, and to support you when you contact us.
  • To work out run costs and usage for your organisation.

We do not sell your data, use it for advertising, or use your organisation's data to train AI models.

How we store it

Data is stored in the European Union (Frankfurt, Germany), encrypted in transit and at rest. Each organisation's data is isolated in the database, and only its members and the Outqube team, when supporting you, can see it.

Who processes it

  • Vercel: hosts the web app and this site (Frankfurt).
  • Supabase: database, sign-in and file storage for screenshots and videos (Frankfurt).
  • Hetzner: servers that run the test browsers (Germany and Finland).
  • Cloudflare: DNS and network protection.
  • Resend: sends sign-in, invitation and notification emails.
  • Sentry: error reports (EU region).
  • AI model providers: the provider your organisation connects (Anthropic, OpenAI, OpenRouter, GitHub Copilot or Browser Use) receives the test instructions, page content and screenshots of the app under test needed for each step. Its own terms and privacy policy apply to that data.
  • GitHub: when your organisation connects it, to start runs and post results on pull requests.

How long we keep it

  • Run evidence (screenshots, video, attachments, console and network logs, and model calls) is deleted after your organisation's retention period: 7, 14, 30, 60 or 90 days after the run finishes, 30 by default.
  • Run results, step text and bug reports stay until your organisation deletes them or the organisation is deleted.
  • Test definitions stay until your organisation deletes them.
  • Account data stays while you have an account. When you ask us to delete it, we delete it within 30 days.
  • MCP sign-in tokens are deleted a day after they expire, or when you revoke the connection.
  • Server logs and error reports are kept for up to 90 days. Database backups roll off within 30 days.

Your rights

You can see and correct your account data in the app. You can ask us for a copy of your data, or to correct, delete or stop processing it, by emailing support@outqube.com. If you are in the EU or UK, you can also complain to your data protection authority. For data in your organisation's tests and runs, your organisation's admins decide; we will pass your request to them.

Changes

We will update the date above when this policy changes, and tell organisation admins by email about significant changes. See also the terms.

Contact

Questions about privacy: support@outqube.com.