QA Copilot — Privacy Policy
Last updated: July 8, 2026
We never see your API key or your test data — it stays in your browser and goes straight to whichever AI provider you chose.
What the extension does with data
- No backend. QA Copilot has no server. Nothing you capture, type, or generate is ever sent to us.
- Bring Your Own Key (BYOK). You supply your own API key for OpenAI, Anthropic, or Google Gemini. Keys are encrypted at rest with a non-extractable AES-GCM key and stored only in your browser's local extension storage. Keys are only ever transmitted directly to the provider you chose, over HTTPS, as part of API calls you trigger.
- Page captures stay local. Capture bundles (selected element HTML, console errors, failed network requests, a screenshot, page URL/title, visible form-field structure) are held in session storage in your browser and discarded when the session ends, unless you explicitly copy or export them.
- AI calls are user-triggered and direct. Captured context is sent to an AI provider only when you click a generate action, and only to the provider/model you configured — directly from your browser to that provider's API. Your use of that provider is governed by the provider's own privacy policy.
- No field values. Action tracking records the structure of what you interacted with (element tags, labels, types) — never the text you typed into fields.
- No analytics, no telemetry, no tracking. No analytics SDKs, no crash reporting, and no network requests other than the AI provider calls you explicitly trigger.
Permissions, in plain language
| Permission | Why it's needed |
|---|
storage | Store your encrypted API keys and per-feature model choices locally. |
activeTab / tabs | Read the current tab's URL/title and take the capture screenshot when you ask for one. |
sidePanel | Host the extension's UI. |
contextMenus | The "Capture this element for QA Copilot" right-click entry. |
debugger | Reliable console/network capture. Only attached when you explicitly toggle "Live capture" for a tab — Chrome shows its own banner while active — and detached when you toggle it off. |
Host access to api.openai.com, api.anthropic.com, generativelanguage.googleapis.com | The only outbound calls the extension makes: your own AI requests, with your own key. |
Data sharing and sale
We do not collect, sell, share, or transfer any user data to anyone. Data flows exist only between your browser and the AI provider you configured.
Changes
If this policy changes, the updated version will be published at the same URL with a revised date.
Contact
Questions: qesekhar@gmail.com