Privacy Policy

Account & organization data. Your name, email address, password (stored only as a hash, see Security), and optional profile picture; and your organization’s name, optional logo, members, and invitations.

Test & run data you send. When your CI reports to Nijam we receive test results and run metadata, test names and file paths, pass/fail status, durations, retries, error messages, and CI context such as commit SHA, branch, run identifiers, and the commit author’s name and email.

Source & artifacts. By default, the reporter also uploads your test source files and any artifacts your test configuration produces, on Playwright, traces, screenshots, and videos (pytest and Vitest have no traces), so they can be shown in the dashboard. You can turn off source uploads by setting uploadSource: false in the reporter, and you control which artifacts exist through your test configuration.

Usage & billing data. Counts of test results ingested (to apply plan limits and meter usage) and, for paid plans, billing identifiers and subscription status from our payment processor. We never receive or store your full card number.

Technical data. A session cookie to keep you signed in, and basic server logs (e.g. request metadata) used for security and reliability. Your theme preference is stored locally in your browser, not on our servers.

Integrations you connect. If you sign in with Google or GitHub, we receive basic profile information (email, name, and avatar) from that provider. If you connect the Nijam GitHub App, we store the installation identifier, the connected account, and the repositories you grant, and we receive pull-request and commit metadata for the runs we post checks and comments on. If you connect Slack, we store the workspace and channel you select plus an encrypted bot token. If you point an AI agent at Nijam over MCP, the test data it requests is returned to that agent and its model provider.

Single sign-on (SSO). If your organization enables SSO, we store the connection settings, your provider’s issuer URL, client ID, an encrypted client secret, and the email domains you verify. When a member signs in through SSO, your identity provider sends us a subject identifier, email address, and name, which we use to sign them in and link the login to their Nijam account.

• to provide the Service, store your runs and produce history, flakiness detection, and analytics;
• to authenticate you, secure accounts, enforce plan limits, and prevent abuse;
• to process payments and manage subscriptions for paid plans;
• to send transactional email (verification, password reset, organization invitations);
• to power the integrations you enable, posting run checks and comments to GitHub, notifications to Slack, and answering MCP queries made with read keys;
• to operate, debug, and improve the Service and keep it reliable.

We do not sell your personal data, and we don’t use it for third-party advertising.

We share data with a small set of providers that help us run Nijam, only as needed to deliver the Service:

• Polar, payment processing and billing, as our Merchant of Record;
• Resend, sending transactional email;
• Neon, managed PostgreSQL database hosting;
• Cloudflare R2, storage for artifacts (traces, screenshots, videos) and uploaded images;
• Vercel and Railway, hosting for the web app and API;
• Slack, delivering run notifications to your workspace, if you connect it;
• GitHub, posting checks and pull-request comments via the Nijam GitHub App, if you connect it;
• Better Stack, error monitoring and diagnostics, with personal data scrubbed before it is sent.

When you sign in with Google or GitHub, connect Slack or the GitHub App, or sign in through your organization’s SSO identity provider, you also share data with those providers under their own terms. And if you connect an AI agent over MCP, the test data it queries is sent to that agent and its model provider, both chosen and controlled by you, not by Nijam.

We may also disclose information if required by law or to protect the rights, safety, and security of Nijam, our users, or the public.

Run history and artifacts are retained for the window included in your plan, 7 days on Free and 90 days on Pro, and are then deleted automatically, including the underlying stored files. Account and organization data is kept while your account is active. If you delete your account, we delete or anonymize your data, except where we must retain limited records (for example, billing records) to meet legal obligations.

Bring your own cloud (Pro). If your organization enables bring your own cloud, your projects, runs, and artifacts are stored in your own Postgres database and object storage, not on our managed infrastructure. That test data lives in your cloud, under your control and retention policies; we keep only your account, organization, and billing. We store the connection string and cloud credentials you provide, encrypted, solely to route your data to your cloud. Turning it off leaves the data already in your cloud untouched.

• Passwords are hashed with argon2id; verification, reset, session, and ingest tokens are stored only as SHA-256 hashes, never in plaintext.
• Data is encrypted in transit over HTTPS.
• Artifact storage is private; files are served only through short-lived, signed URLs.
• Secret keys come in two kinds, write-only ingestion keys and read-only read keys; each is shown once at creation and stored only as a SHA-256 hash.

No system is perfectly secure, but we work to protect your data and to limit access to it. Please keep your own credentials and ingest keys safe.

We use a single essential cookie to keep you signed in. We don’t use third-party advertising or cross-site tracking cookies. Your theme preference (light/dark/system) is stored in your browser’s local storage under the key nijam-theme and never leaves your device.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can update your profile and manage your organizations in the app, control source/artifact uploads in the reporter, and request deletion by contacting us. We’ll respond consistent with applicable law.

Nijam and its providers may process and store data in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

Nijam isn’t directed to children and isn’t intended for anyone under 16. We don’t knowingly collect personal data from children; if you believe a child has provided us data, contact us and we’ll delete it.

We may update this Privacy Policy from time to time. We’ll revise the “Last updated” date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after an update means you accept the revised policy.

Questions about your privacy or this policy? Email us at support@nijam.dev. See also our Terms of Service.