Your testing data

This page describes how the current Cohorvix application handles testing records. Public pages can be reviewed in read-only mode. For authorized private workflows and submissions, use dedicated test accounts and synthetic information; do not test with sensitive customer data.

What the application stores

• Account name, email identifier, password hash, recovery-code hash and revocable session records. Email addresses are not verified by this beta.
• Website targets, task descriptions, profile settings, run outcomes, issue reviews and human observations you submit.
• Browser screenshots and, when available, session video. These can contain whatever is visible on the tested page.
• Encrypted operator provider credentials, encrypted dedicated test-session cookies, execution allowances and reservations, worker-token hashes, activity records and support requests.

Where test information is processed

The application uses Cloudflare infrastructure for database records and stored evidence. Browserless operates the remote browser. The selected OpenAI model receives the task, profile instructions, observed page text and controls, captured viewport screenshots, and recent action context. Dedicated test-session cookie values are applied to the authorized browser origin and are not included in model prompts or report exports. Model requests use the API’s store:false option; this is not a claim that all provider retention is disabled. Provider retention and processing rules also apply. The beta service is operated with server-held provider accounts; customers are not asked for API keys.

Private evidence and public examples

Workspace API requests check the current account’s ownership of records. Stored provider secrets are not returned to the interface. Only runs against the owned fictional hotel sandbox can be explicitly published as public examples. Customer website runs remain private. A public example can be unpublished by its owner.

Dedicated test-session access

Use only a synthetic test account. Cookie values are encrypted separately from the study configuration. They authorize execution only on the configured origin and expire for execution after 24 hours. Revoke stored access from the report’s data controls. Revoking access does not terminate a browser attempt that has already started. Expiry does not itself erase the encrypted record.

Participant links and recordings

A study owner may create a seven-day participant link. Anyone with that link can see the task and target URLs and submit up to the study’s response limit. This does not share existing AI evidence or credentials. Participants choose whether to submit a screen recording and separately choose whether to permit internal research use of the observation. Camera and microphone access are not requested. Recordings are private to the study owner and can be deleted with the observation. Participant submissions are self-reported; the form does not prove identity or task success.

Human observations

Record participant codes instead of names or contact details. Study consent and permission for internal research/model evaluation are separate choices. Observations are not used to train a model automatically. The dataset export includes only records with the separate permission.

Retention, export and deletion

Records are retained until removed; automatic expiry of study data is not implemented. Guest access expires after seven days, and clearing cookies can lose access to a guest workspace. Create an account to retain access across devices. A session expiry does not itself delete the underlying records.

Use a report’s JSON export before deleting anything you need. From its data controls you can delete a terminal run and its stored screenshots, findings and observations. Human observations can also be deleted individually. Attempt reservations remain after report deletion to prevent allowance reuse; these records contain account reference, attempt count, day and request identifier, not screenshots or test-session cookies. Removal does not recall files already downloaded or data retained independently by external providers.

Account and privacy requests

Submit a privacy request through Support. Requests, contact names, email addresses and replies are stored privately in the app. A notification can be emailed to the operator when email delivery is configured. Cohorvix is operated by Muhammad Adil. No compliance certification or enterprise data-processing agreement is asserted.