How we protect your data

Last updated 10 November 2026.

Testers trust us with their name, email and details about their phone. Developers trust us with unreleased apps. Here is what we do to protect both.

Stored data

• Names, emails, phone details and everything testers write in reports are encrypted with AES-256-GCM before they reach our database. Each encrypted value is tied to its own record, so it can't be copied onto someone else's.
• The encryption keys are held separately from the database and can be rotated.
• Sign-in tokens and test-session tokens are stored only as one-way hashes. A copy of our database wouldn't let anyone sign in.
• We never hold card numbers, bank details or tax forms. Those stay with our payment and payout providers.
• On your phone, the Qanary app keeps its sign-in token encrypted with a key that never leaves the device, and excludes its data from backups.

Data in transit

• Every connection uses HTTPS. Plain HTTP is refused, and browsers are told to use HTTPS only (HSTS).
• The Qanary app trusts only your phone's built-in certificate authorities, and refuses unencrypted connections.
• The SDK inside apps under test only connects over HTTPS.

The SDK in apps under test

• It records only when the app was opened from Qanary during a test. The developer's regular users are never recorded.
• For input fields it counts focus, edits and clears, and never reads the text. Our server refuses any upload that contains typed text.
• Crash reports carry the error type and code location, never the error message.
• Behavior data is deleted after 180 days.

Inside the app

• Screens that show your personal details or earnings block screenshots and screen recording.
• Developers see testers by an anonymous test id, never by name or email.
• You can see everything we hold about you under You → See what we know, and delete your account at any time.

Report a problem

If you find a security issue, email security@meex.work. Please don't access data that isn't yours or disrupt the service while testing. Our machine-readable contact is at /.well-known/security.txt.