privacy policy

e2e is an open source testing framework built by TesterArmy Inc., a Delaware corporation (“we”, “us”). this policy covers e2e.com, with its docs, blog and forms, and the usage data the e2e command line tool sends. it explains what we collect, why we collect it, who processes it for us and how to reach us about it.

the hosted TesterArmy app at tester.army has its own privacy policy, which still covers accounts there.

the framework

e2e runs on your computer and in your CI. your tests, your app and your secrets stay on your machines, apart from what you send on purpose: the agent’s model calls, with the screenshots it asks for, go straight to the model provider you configure, and a cloud browser or device service you add gets what it needs to run. none of it passes through us.

telemetry

the e2e CLI sends usage data with no name, email or account attached: which commands, engines, features and model providers run, counts, timings and estimated model cost, versions, the machine class, the coding agent or MCP client that started it, and error codes. it never sends test titles, file paths, URLs, page content, screenshots, error messages, environment variable values (apart from a fleet name), credentials or file contents.

each event carries a random id stored on your machine (CI runs send the CI vendor’s name instead, and a fleet sends the name it sets) and, in a full git clone, a hash of your repository’s first commit, which is the same in every full clone (none outside git or in a shallow clone). these ids link one machine’s or one project’s events over time, so the data is pseudonymous, but they don’t say who you are. events go to a PostHog project in the EU that keeps no person profile, stores no request address and derives no location.

telemetry is on by default. turn it off with npx e2e telemetry disable, or set E2E_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1, the only switches in CI. the telemetry docs list every property sent.

e2e feedback is not telemetry: it sends the words you give it, with the same machine facts and, when telemetry is on, the same id, to the same PostHog project. the CLI also checks registry.npmjs.org for a newer release at most once a day, so npm sees your IP address under its own privacy policy, as it does for any install.

the website

analytics and ads

e2e.com measures visits and records sessions with PostHog, and measures ad campaigns with the Google Ads, Reddit, LinkedIn, X and OpenAI tags. RB2B identifies the companies behind business visits, and Dub attributes visits from shared links. these tools use cookies and similar storage, and they receive your IP address, browser details and the pages you view.

the site reads your country from your IP address. in the EU, the UK, Iceland, Liechtenstein and Norway, it asks first: until you press accept, PostHog counts page views without cookies or recordings and the other tools don’t load, and after you press reject only those cookieless PostHog counts continue. elsewhere, and when your country can’t be read, they all load when the page opens.

to change your choice, clear e2e.com’s cookies and site data so the banner shows again, or email us. ad blockers and tracking protection stop the ad tags, RB2B and Dub, but PostHog and Sentry go through e2e.com’s own address and may not be blocked.

embedded videos and posts

some blog posts and session pages show YouTube videos and posts from X. those load from YouTube’s and X’s servers, which receive your IP address and browser details.

forms

• contact: your name, email, company website, country, topic and message, so the right person can answer you.
• careers: your name, email, the LinkedIn, X and GitHub links you add, your proof of exceptional ability and your resume, so the founders can review your application.
• live sessions: the email you registered with. it is a contact in our Loops audience, which sent the confirmation, the reminder and the stream link and can send you our product emails. you can unsubscribe from those at any time.
• docs feedback: whether the page helped, the reasons you tick and your comment, if any. we don't ask who you are.

security and errors

to stop abuse, the forms count requests per IP address and forget each count within an hour. Sentry receives a report when something breaks and a performance trace from about one in ten visits. both can include your IP address, browser details and the page address, with passwords, tokens and similar values removed.

who processes your data

we don’t sell your personal information. these companies process it for us, each under its own privacy policy:

• Vercel: hosts the site and the forms, and keeps short-lived request logs.
• Cloudflare: runs the domain's DNS.
• PostHog: product analytics and session recordings for the site, and the CLI's telemetry, in its EU region.
• Google Tag Manager: loads the Google Ads and Reddit tags that measure ad campaigns.
• LinkedIn, X and OpenAI: ad pixels that measure ad campaigns on those platforms.
• RB2B: identifies the companies, and sometimes the people, behind business visits.
• Dub: attributes visits from shared and partner links, with a cookie that lasts 90 days.
• Algolia: powers the docs search and receives what you type into it.
• Sentry: error reports and performance traces, which can include your IP address.
• YouTube and X: serve the videos and embedded posts on some pages.
• a hosted Redis database: holds the forms' rate-limit counts for up to an hour.
• Attio: our CRM, which keeps contact requests and job applications.
• Slack: where the team reads contact requests, applications and docs feedback.
• Loops and Trigger.dev: send our emails and keep the list of people who get them.

we also share data when the law requires it, to protect our users or the public, and in a merger or sale of the company, with notice to you.

why we use it

under the GDPR, the analytics, recordings and ad tags in the regions above run on your consent, which you can withdraw as described above. the cookieless PostHog counts there, the analytics elsewhere and the CLI’s telemetry rest on our legitimate interest in learning how people find and use e2e, and rate limits and error tracking on our interest in keeping the site working and secure. answering a contact request, reviewing an application and sending the live session emails are steps you asked us to take.

how long we keep it

we keep contact requests while we talk with you and your company, applications while we hire for the role and for later roles you might fit, and email contacts until you unsubscribe or ask us to delete them. analytics, recordings and error reports stay for the period each tool above keeps them. rate-limit counts last at most an hour, and telemetry has no person attached and is read in aggregate. ask us at any time and we delete what we hold about you, unless the law makes us keep it.

international transfers

TesterArmy Inc. is based in the United States, and several of the companies above process data there. where the law requires it, we rely on the European Commission’s standard contractual clauses or a similar safeguard.

your rights

if you are in the EEA, the UK or Switzerland, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. you can also complain to your local data protection authority.

if you live in California, you can ask what personal information we collect, use and disclose, and ask us to delete or correct it. the ad tags above may count as “sharing” for advertising under California law: to opt out, reject the cookie banner where it shows, block the ad tags with tracking protection or an ad blocker, or email us. we won’t treat you differently for using any of these rights.

email privacy@e2e.com and we answer within 30 days.

children

e2e is not meant for anyone under 16, and we don’t knowingly collect their data. if you think a child has sent us personal information, email privacy@e2e.com and we delete it.

changes

when this policy changes, we update this page and the date at the top. for a large change to what the CLI sends, it shows its telemetry notice again.

contact

questions and requests about your data: privacy@e2e.com. by post: TesterArmy Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA. to report a security issue, see the security docs.