How we test

Test setup

• Dedicated accounts created for testing only, never personal accounts.
• Synthetic, non-sensitive prompts from a fixed script.
• Recorded devices, operating systems, app versions and test period.
• An evidence log entry per observation, with timestamp.

Hard limits

• We never upload real intimate images, private conversations, biometric data, contact lists or any minor's data.
• We never disclose a real crisis situation to a product under test.
• We do not test illegal, exploitative, coercive or age-ambiguous scenarios.
• We do not reproduce explicit outputs, and we describe adult features only at a high level with an 18+ label.

What a test cannot show

Server-side retention, internal access controls and training pipelines are not observable from the client. Those remain policy statements or unresolved, never observed results.