QA Copilot Privacy Policy

1. Data the extension handles

When capture is active, QA Copilot processes API URLs, methods, status codes, timings, headers, permitted request and response bodies, and console output from the tested tab. These may contain personal information, credentials or other private website content.

User-requested tools can read page structure, form metadata and page-check results; fill forms with test data; capture screenshots or video; and prepare reports, API requests, saved tests and bug drafts. Screenshots and recordings can include anything visible in the selected capture area. Recording has no audio.

Tab URLs, titles and session information help keep results with the correct tested tab. The extension is not a general browsing-history or keystroke-tracking service.

2. Local storage and retention

• Bounded captures use browser-local IndexedDB, with session metadata in Chrome session storage. Limits and session cleanup remove older data. You can also clear captures or reset the workspace.
• Settings, saved APIs and saved performance-test definitions use Chrome local storage. They remain until you remove them or reset the workspace. Imported CSV rows, generated counter positions and live response-variable values are not saved with performance tests.
• Jira notes and edited drafts use Chrome session storage. They survive panel reopening, but clear on browser restart, Clear draft or workspace reset.
• AI chat and Design QA images/results stay in open-panel memory and clear when the panel closes. Downloaded screenshots, videos, reports and backups remain wherever you save them.
• AI keys use trusted Chrome session storage only. There is no Remember key option and new keys are not saved to local or sync storage. Closing the panel keeps the session key; restarting Chrome or reloading, updating or disabling the extension clears it. Older remembered keys move into the current session before their persistent copies are removed. If migration cannot write to session storage, the old record is retained for retry and is not used as a local-key fallback. Disconnect removes the selected provider's key; workspace reset removes all provider keys. Provider and model preferences contain no key and may remain in local storage.

3. When data leaves the browser

Captures are not automatically uploaded to the developer. API replay and performance tests send your configured requests directly to the target servers when you run them. Those servers receive the request data and normal connection details. Test only systems you own or have permission to test.

AI is optional and uses your own key with Gemini (Google), OpenRouter or Groq. Connecting or refreshing models contacts the selected provider to validate access or retrieve model information. An AI action sends the question or task input needed for that action:

• General chat: your question and bounded recent conversation, without automatic page evidence.
• QA chat and result help: your question and a bounded, redacted or reduced evidence summary relevant to the action.
• Jira drafting: your bug notes, not automatic Jira submission.
• Design comparison: the two reviewed images and focus notes.
• Connected form fill: field types and validation rules, not existing field values or passwords. Password values are generated locally.

The provider receives your API key for authentication. OpenRouter can route requests to the selected model's upstream provider. Provider retention, training, pricing and usage rules apply; QA Copilot cannot override them. Stopping a request does not undo data already received by a provider.

Review the policies of Google Gemini, OpenRouter and Groq before sending confidential data.

Exports and clipboard copies remain under your control. Sharing or uploading them sends their contents to the destination you choose. The current Jira workflow prepares a draft for copying; it does not create or submit a Jira issue automatically.

4. Sensitive data and your controls

Text redaction is enabled by default and masks common sensitive patterns. It is rule-based, can be disabled, and may miss private information. It does not automatically hide pixels in screenshots or videos. Review text and images before exporting or sending them to AI. Do not include secrets in questions or bug notes.

You can stop capture, cancel pending actions, disconnect AI, clear drafts and captures, remove saved items, or reset the workspace. Removing the extension clears its Chrome-managed local data. Resetting or uninstalling does not delete files you downloaded, data already shared, or records held by target websites or AI providers.

5. Purpose and limited use

QA Copilot uses data to provide its user-facing website-testing features. It does not sell user data, use it for advertising, or use it to determine creditworthiness. Its use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. This policy website

This page has no analytics scripts, forms, cookies or external fonts added by QA Copilot. When hosted on GitHub Pages, GitHub processes visitor connection information, including IP addresses, for hosting and security. See the GitHub Privacy Statement.

7. Contact and updates

Developer: Ahmed Gamal Gaber
Privacy questions: ahmedgamal621997@gmail.com

If you contact us, your email service and our email service process the message. Do not send API keys or private captures. This page will be updated when the extension's data handling changes.