How it works

Data and privacy

What is sent

Only the redacted evidence packet you approve in a preview, built from your failing tests; passing tests are only counted. It contains selected report fields, trace events or the Cypress and WebdriverIO command log, the page elements around each failed locator or selector, the accessibility snapshot of the page at the failure, network requests (never their bodies) and console errors, short source excerpts, and recent code changes that mention the failure. Password and token field values, authorization and cookie headers, credentials in URLs, and other sensitive fields are masked before the preview. Masking recognizes credentials, not every kind of personal data: names or email addresses in your test data can still appear, so test with data you may share. It never contains full files, full diffs, your repository, the full page DOM, or image pixels; screenshots and videos are described by size and dimensions only. If you use --capture, it can also contain the locators Playwright generated for elements on the live page. For Cypress and WebdriverIO, --capture records each failed attempt's page into .kwikqa/capture/ on your machine; only the parts around the failure enter the packet, and text typed into password, token, or card fields is never shown. Run npx kwikqa analyze --local to see the summary KwikQA would build, without sending anything.

Code changes are matching hunks of source files from your uncommitted changes and your branch's recent commits (at most 12), with commit subject lines. Author names, emails, commit bodies, and documentation are never read. --no-changes leaves them out.

Where it goes

The KwikQA service forwards the payload unchanged, and refuses a hosted request that doesn't ask for zero data retention. It stores account, plan, and usage records and, for each request, its kind, model, provider, test framework, status, token counts, cost, and a hash of the payload. It never stores the evidence, your source, or the model's answer, which it holds in memory until your CLI collects it, for at most 15 minutes. Security lists how long each record is kept.

Team insights

If your team's owner turns on team insights, your CLI also shares the names, files, and projects of failing and flaky tests, their test framework, and the outcome of each fix with your team. It never shares evidence, source, diffs, or error messages, and --local runs share nothing. npx kwikqa status shows whether insights are on.

From CI

kwikqa ci sends KwikQA nothing beyond what analyze sends. What it publishes goes only to your own systems, with your own credentials:

• GitHub Actions. It writes the job summary, and comments on the pull request through GitHub's API with the job's GITHUB_TOKEN.
• Azure Pipelines. It attaches the build summary, and writes the pull-request thread through Azure DevOps' API with the build's System.AccessToken.
• GitLab CI/CD. It prints the summary in the job's log, and writes the merge-request note through GitLab's API with your GITLAB_TOKEN.
• Jenkins. It prints the summary in the console log, and comments through the API of the pull request's host, GitHub or GitLab, with the token your Jenkinsfile binds. It calls only the https host the build's branch source names.
• Fix pull requests. With a ci.fix policy, kwikqa fix commits its validated repair through your code host's API with the same token, on a new kwikqa/fix- branch, and opens a draft pull request. Its description holds the diagnosis and the repair's intent; the evidence stays in the report.
• What a summary holds. The summary and comment list the failure groups, their owners, and the flaky tests. The evidence stays in the report.
• Slack and Teams. It posts to the webhooks you store as CI secrets. A message holds no error text, evidence, or source code.

KwikQA never prints a token or webhook URL, and never writes one to the report, the summary, .kwikqa/, or the KwikQA service.

What stays on your machine

Your controls

• Decline any request at its preview; nothing is sent.
• Use --local to keep analysis entirely on your machine.
• Use --no-changes to leave recent code changes out of the packet.
• Use a BYOK plan to keep evidence off KwikQA's servers.
• Export or delete your account data from Account.

The privacy policy has the full details.