Mimicus
Privacy Policy
Last updated: October 16, 2026
This policy explains what data Mimicus collects when you use the Mimicus Chrome extension, the
mimic command-line tool, the dashboard at app.mimicus.dev, the cloud test runners and this website,
why we collect it, and what control you have over it.
Mimicus is operated by Tony's Software, which is the controller of your personal data. "We" and "us" in this policy refer to Tony's Software.
- We collect only what is needed to record, store and run your tests.
- The extension works on localhost by default and on other sites only after you allow them.
- Values typed into password fields are never recorded.
- No analytics, no advertising, no tracking, and we never sell your data.
Data we collect
Account information
When you sign in, our authentication provider WorkOS gives us your email address, your name if you provided one, and the organization you belong to. We use this to sign you in, keep your organization's tests separate from everyone else's, and let you invite teammates.
When you invite a teammate, we process the email address you enter and WorkOS sends that person an invitation email. Pending invitations can be revoked at any time.
Test scenarios
When you record or save a scenario, we store what is needed to replay it: the URLs you navigate to, the steps you take (clicks and the values you type), how each element is located (for example its label, text, test id or CSS selector), the checks you add, and the names and groups you give your scenarios.
Values typed into password fields are replaced with placeholder characters before they leave the page, so the actual password is never recorded or stored. Other values you type are stored as you entered them, so avoid recording real personal data and use test accounts and test data instead.
Browser state of the sites you test
So that a scenario can continue from where another one ended (for example, already signed in), the extension reads and restores the cookies, localStorage and sessionStorage of the sites a scenario visits. This state stays in your browser's session storage and is cleared when the browser closes. During cloud runs, the state our test browsers produce is passed through our job queue while the run is in progress and is not kept afterwards.
Test runs
For runs on our cloud runners we store each result: which scenario ran, the browser, whether it passed, how long
it took and the error message if it failed. When you run scenarios locally with the mimic CLI, it
signs you in through WorkOS and only fetches your scenarios from our servers; it does not send results to us.
This website and server logs
mimicus.dev sets no cookies and runs no analytics or third-party scripts. Like every web server, our website, dashboard and API process your IP address to deliver each request, and our servers log requests (IP address, time, requested URL and browser user agent) to keep the service secure and fix errors. These logs are deleted after [N] days.
Chrome extension permissions
The extension asks only for the permissions it needs to record and replay tests:
| Permission | What we use it for |
|---|---|
| Access to localhost | Record and replay tests on the app you are developing. |
| Access to other sites (optional) | Only for sites you explicitly allow, for example a staging environment. You can revoke this at any time. |
scripting, tabs, webNavigation | Run the recorder and player in the tab you are testing and follow navigations during a test. |
cookies | Save and restore the signed-in state of the sites you test so scenarios can continue from one another. |
storage | Keep your sign-in session and in-progress recordings in the extension. |
identity | Open the sign-in window. |
sidePanel | Show the recorder next to your app. |
While you record a scenario, the extension captures the pages you visit, the elements you click and the values you type in the tab you are recording, as described under Test scenarios. Outside of a recording or a test run you start, it does not read or collect your browsing history or page content, and it does nothing on sites you have not allowed.
How we use data
We use your data only to provide and improve Mimicus: to sign you in, store and run your tests, show you the results and support you when you contact us. We do not use it for advertising, we do not sell it, and we do not use it to determine creditworthiness or for lending.
Under the GDPR, we process your account data, scenarios and run results because it is necessary to provide the service you signed up for (Art. 6(1)(b)), and server logs on the basis of our legitimate interest in keeping Mimicus secure and working (Art. 6(1)(f)).
The use of information received from Google APIs and the Chrome extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Who we share data with
We share data only with the service providers that run Mimicus for us:
- WorkOS handles sign-in and stores your account and organization membership.
- DigitalOcean hosts our servers and database in Frankfurt, Germany.
WorkOS is based in the United States, so your account data is transferred outside the EU. These transfers are protected by [the EU–US Data Privacy Framework / the European Commission's Standard Contractual Clauses].
We may also disclose data where the law requires it. We do not share data with anyone else.
Storage, security and retention
- All traffic between your browser, the CLI and our servers is encrypted with HTTPS.
- Your sign-in session is stored in the extension's local storage and, for the CLI, in a file only your user can read. Signing out deletes it.
- Scenarios and run results are kept as long as your organization uses Mimicus. You can delete scenarios at any time in the extension.
- When your account or organization is deleted, its data is deleted from our systems within 30 days.
Your rights
You can access, correct, export or delete your data at any time. Most of this you can do yourself in the extension and dashboard; for anything else, email us. If you are in the EU, the UK or another region with data protection laws, you also have the right to object to or restrict processing and to complain to your local data protection authority.
Children
Mimicus is a developer tool and is not directed at children under 16.
Changes to this policy
When we change this policy we update the date at the top of this page. For significant changes we will also let you know by email or in the product.
Contact
Questions or requests about your data: [email protected].