Privacy Policy

1. Scope

This Privacy Policy explains how QAP Tools processes information when you use its Bug Report Generator, Test Case Generator, Issue Analyzer, screenshot upload features, and related functionality. It applies to the public QAP Tools service and does not claim to replace rights or obligations that apply under the law of a particular jurisdiction.

2. Anonymous, No-Account Service

QAP Tools V1 does not provide user accounts or authentication. The service uses an anonymous functional session to associate requests, temporary uploads, usage limits, and related operational records with the same browser. The session does not require your name or email address.

3. Information You Provide

Depending on the tool, you may provide a bug description, feature or functionality description, additional context, issue description, response-language choice, and optional screenshots. This content may contain personal information if you choose to include it.

• Bug Report descriptions and selected response language.
• Test Case feature descriptions, additional context, and selected response language.
• Issue Analyzer descriptions and selected response language.
• Information contained in optional screenshots.

4. Screenshots and Uploaded Content

Screenshots are optional and are stored privately for temporary processing. Their application access and metadata are time-limited. QAP Tools attempts cleanup after use or expiry, but physical deletion may occur later because of operational recovery, failed cleanup, backups, or provider processes.

Screenshots supplied for generation are validated and may be sent to the AI provider as visual input. Removing a file before submission prevents it from being included in that request.

5. AI Processing

QAP Tools uses the OpenAI API to generate bug reports, test cases, and issue analyses. Submitted text, selected language, and screenshots you attach may be transmitted to OpenAI for this purpose. When you choose Create Bug Report, an Issue Analyzer to Bug Report transfer may also transmit the original issue description, original screenshots retained for that transfer, and the generated analysis and recommendations.

QAP Tools configures Responses API requests with storage disabled for the requested response. OpenAI may separately process or retain information under its applicable API data controls, security and abuse-monitoring practices, contractual settings, and legal obligations. QAP Tools does not represent that Zero Data Retention applies.

6. Technical and Functional Information

The service processes ordinary request information needed to operate and secure the site, which may include network and device information, timestamps, request identifiers, and an IP address supplied by hosting infrastructure. The application uses a keyed representation of the client IP for short-lived abuse prevention rather than storing the raw IP in its rate-limit records.

Operational records may include anonymous ownership references, upload metadata, fingerprints, generation identifiers, status, timestamps, quotas, rate-limit events, and AI usage or accounting information.

With your optional analytics consent, Google Analytics 4 may collect page and product-usage activity, pseudonymous browser identifiers, and device, browser, language, and referrer information. Google may derive approximate location from network information. QAP Tools does not deliberately send issue text, generated content, screenshots, filenames, QAP session identifiers, or other free-form user content to Google Analytics.

7. Cookies and Analytics Consent

QAP Tools uses necessary functional cookies. Google Analytics cookies are optional and are created only after you accept analytics.

• Anonymous session cookie: associates an anonymous browser session with operational records. It is HttpOnly, Secure in production, SameSite=Lax, and may remain for up to 30 days.
• Language preference cookie: stores only the EN or RU interface preference, uses SameSite=Lax, and may remain for up to one year.
• Analytics consent cookie: stores only granted or denied for up to 180 days and lets the site remember your choice.
• Google Analytics cookies, including _ga and related property cookies, are configured for up to 180 days after consent.

8. How We Use Information

• Provide the requested generation and analysis features.
• Validate and temporarily process screenshots.
• Return consistent results for duplicate requests.
• Enable the Issue Analyzer to Bug Report transfer selected by the user.
• Enforce file, usage, quota, rate, concurrency, and service-availability limits.
• Maintain security, prevent abuse, troubleshoot failures, and account for AI usage.
• With consent, understand page activity and aggregate use of QAP Tools features through Google Analytics 4.
• Comply with applicable law and protect the service, users, and third parties.

9. Legal Bases Where Applicable

Depending on your jurisdiction and the processing involved, QAP Tools may rely on the performance of requested services or steps taken at your request, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where applicable. Optional Google Analytics processing relies on your consent. Any reliance on legitimate interests is subject to the balancing and other requirements of applicable law.

10. Service Providers

QAP Tools uses Vercel for hosting and infrastructure, Vercel Blob for private screenshot storage, Upstash for operational Redis data storage, Supabase-hosted PostgreSQL for account and operational data, AWS for email receiving, storage, and processing, OpenAI for AI processing, and, only with analytics consent, Google Analytics 4 for site and product-usage measurement. These providers process information to perform services for QAP Tools under their applicable terms, settings, and legal obligations. Their infrastructure, backups, logs, and security records may follow provider-specific retention practices.

11. Data Retention and Deletion

QAP Tools retains information only for operational purposes and for periods supported by the current service design. Retention may be extended where reasonably necessary for security, recovery, legal obligations, disputes, or enforcement.

• Anonymous session cookie: up to 30 days; language preference cookie: up to one year.
• Rate-limit state: approximately two minutes.
• Generation idempotency state and cached generated result: approximately one hour.
• Successful-generation quota: a 12-hour rolling window.
• Issue Analyzer to Bug Report transfer: approximately one hour. Original screenshots supporting an eligible transfer may remain available to the application for approximately that transfer window.
• Other screenshot application availability: approximately 30 minutes; screenshot metadata: up to approximately 25 hours unless removed earlier. QAP Tools attempts cleanup after use or expiry, but physical deletion may occur later for operational or provider reasons.
• AI budget and accounting records may be retained without an application-level expiry. They are operational records and are not designed to contain full prompts or screenshot contents.
• The analytics consent choice and Google Analytics cookies are configured for up to 180 days. The intended Google Analytics event-data retention setting is two months.

12. Security

QAP Tools uses reasonable technical and organizational measures appropriate to the service, including private screenshot storage, input validation, anonymous ownership controls, restricted server-side credentials, and usage protections. No system or transmission method is completely secure, and QAP Tools cannot guarantee absolute security.

13. International Processing and Transfers

QAP Tools and its service providers, including Google when analytics consent is granted, may process information in countries other than the country where you are located. Where required, transfers are handled subject to applicable legal mechanisms and provider arrangements. Specific processing locations may depend on provider configuration and service availability.

14. Privacy Rights

Depending on your jurisdiction, you may have rights to request information, access, correction, deletion, restriction, objection, portability, withdrawal of consent, or review of certain automated processing. You can withdraw analytics consent at any time through Analytics settings without affecting the tools. These rights are not absolute and may be limited by applicable law.

Requests may be submitted by email. For anonymous V1 use, we may need information such as your retained session context or request details to reasonably verify and locate records. We may be unable to identify records if you no longer have relevant identifiers. QAP Tools does not currently provide a self-service privacy dashboard, automatic export, or one-click deletion.

15. EEA, United Kingdom, and Switzerland

If the GDPR, UK GDPR, Swiss data-protection law, or related rules apply, optional Google Analytics is activated only with consent, which may be withdrawn at any time. You may have jurisdiction-specific rights and may be entitled to complain to an appropriate supervisory authority. Processing and transfers will be addressed according to applicable requirements. Nothing in this Policy limits rights that cannot lawfully be limited.

16. United States and California

Residents of California or other US states may have rights concerning access, correction, deletion, portability, or information about collection and disclosure, depending on the law and whether it applies to QAP Tools. QAP Tools does not sell personal information, use personal information for behavioral advertising, or share personal information for cross-context behavioral advertising as those concepts are understood in applicable US privacy laws.

17. Other Jurisdictions

Privacy laws in Canada, Australia, Brazil, and other jurisdictions may provide additional rights subject to their scope and exceptions. QAP Tools will consider properly submitted requests as required by applicable law.

18. Children's Privacy

The service is not specifically directed to children. Do not submit children's personal information unless it is necessary, lawful, and supported by any authorization or consent required under applicable law. If you believe a child supplied personal information improperly, contact us.

19. Sensitive and Confidential Information

Do not submit sensitive or confidential information unless strictly necessary and you are authorized to do so.

• Passwords, API keys, authentication tokens, financial credentials, or production secrets.
• Government identifiers, health information, biometric data, or precise location.
• Children's personal information, trade secrets, or confidential customer information.
• Any other highly sensitive personal or business information.

20. AI-Generated Content

AI-generated content can be inaccurate, incomplete, inappropriate, or unsuitable for a particular purpose. It requires human review. QAP Tools does not use its output to make legal or similarly significant decisions about users, and users remain responsible for deciding whether and how to use generated content.

21. Analytics, Sale, Sharing, and Advertising

Google Analytics 4 is optional and remains disabled unless you consent. You may decline or withdraw consent at any time through Analytics settings, and QAP Tools remains functional without Google Analytics. QAP Tools does not enable Google Signals, advertising features, remarketing, or personalized advertising, and does not sell personal information, provide behavioral advertising, use advertising pixels, or operate an advertising network.

22. Changes to This Policy

This Policy may be updated to reflect changes to the service, providers, or applicable requirements. The revised version will state a new effective date. Material changes may be communicated through the service where appropriate.

Additional service: Temp Mail

Temp Mail creates temporary email addresses and processes incoming messages, including sender and recipient details, message content, and attachments. An anonymous browser session lets you access your current inbox. Inbox access normally expires after two hours and may end sooner if you replace the address. Removal from storage may take longer for operational or provider reasons. Do not use a temporary inbox for information you need to keep.

Email delivery and temporary storage involve service providers, including hosting, email-delivery, and storage infrastructure. Messages sent to a Temp Mail address may contain personal information supplied by senders.

Additional service: Image Converter

Selected images are processed in your browser for conversion or compression. QAP Tools does not require you to upload those images to its server for these tools. Your browser holds the selected images and generated results while you use the page; downloaded copies are saved wherever you choose on your device.

Additional service: Test Data Generator

You select fields and a record count, and the generated dataset is created in your browser. QAP Tools does not require you to send that dataset to its server or store it in an account. You may copy or download the result; any copy you save is under your control.

Additional service: V3 accounts and sign-in

QAP Tools offers optional sign-in through Google, GitHub, or Yandex. Tools that do not require sign-in remain available without an account; Email API operations require sign-in. When you sign in, we may receive and store your provider identity reference, email address, display name, avatar URL, and account information supplied by the provider. We use a stable internal QAP account identifier and records connecting that account to its sign-in identity. Different provider identities are not automatically linked merely because their email addresses match.

Authenticated sessions and necessary authentication cookies maintain your signed-in state. Session and authentication records may include tokens, expiry times, IP address, and browser information. Provider-issued authentication tokens may also be stored. QAP Tools does not receive or store your Google, GitHub, or Yandex password through OAuth sign-in. These account and session records use Supabase-hosted database infrastructure alongside the hosting and operational providers described above.

For signed-in usage limits, we retain technical account-linked records such as request references, reservation and completion status, timestamps, and recovery information. These records enforce limits, avoid counting the same operation twice, and prevent replay. Signing out ends the session; it does not delete the account, identity connections, or usage records. A usage window or session expiry is not a guarantee of physical deletion at that time; records may remain for operational recovery, security, backups, or provider processes. Privacy requests may be sent to the contact below.

Additional service: Email API

The Email API landing page and documentation are public. Using the API requires a signed-in QAP Tools account; automation uses scoped API tokens. We associate inboxes, token metadata, and usage and quota records with a stable account identifier to provide temporary email for QA, testing, automation, and CI.

We process generated temporary email addresses, sender and recipient details, subjects, headers, text and HTML bodies, raw MIME, attachments, extracted OTP candidates and HTTP/HTTPS links, timestamps, and delivery metadata. Processing supports email delivery and access, authentication and authorization, quota enforcement, abuse prevention, troubleshooting, security, and service operations.

Inboxes expire within a maximum of four hours. Raw MIME and attachments use temporary AWS S3 storage with a lifecycle of approximately two days. Expiry or deletion ends inbox access, but data may remain until normal asynchronous cleanup or storage lifecycle processing completes. Email API is not permanent email hosting; save any content you need before access ends.

Limited account, inbox, and token metadata, quota and accounting history, and delivery facts may remain longer than inboxes and email payloads where needed for quota enforcement, abuse prevention, idempotency, and operational integrity. Durable delivery facts do not retain bodies, HTML, raw MIME, attachments, OTPs, or extracted links. Rejected or ignored delivery records may remain temporarily for processing, idempotency, and operations. Deleting or expiring an inbox does not restore consumed quota.

API token secrets are stored in the database only as hashes; the plaintext secret is shown once at creation. Protect your tokens and the automation that uses them. Signed download URLs are short-lived access capabilities: an already issued URL may remain usable until it expires after token revocation or inbox deletion. These measures do not guarantee absolute security or confidentiality.

Additional analytics: Vercel Web Analytics

QAP Tools also uses Vercel Web Analytics separately from Google Analytics to measure page visits and aggregate site usage. It processes request-derived information such as page URL, referrer, browser and device information, and approximate location. Vercel uses a request-derived visitor identifier without third-party analytics cookies. Avoid putting sensitive information in page URLs.

The existing Analytics settings choice controls Google Analytics only; it does not enable or disable Vercel Web Analytics. Vercel processes this analytics information under its own service and privacy terms. The Google Analytics consent controls described above remain available.

Contact

For privacy questions or requests, contact: