Privacy policy

This policy explains what personal data KwikQA ("we") collects when you use the KwikQA command-line tool, website, and hosted service, what reaches the AI providers that produce diagnoses and repairs, and what you can do about it. It describes what the software and service do today; when that changes, this policy changes first.

In short

• KwikQA runs on your machine. Only a redacted, size-limited evidence packet that you have previewed and approved leaves it.
• On hosted plans, that packet passes through our service to the AI model and is never stored by us. The model's answer is held in memory until your CLI collects it, for at most 15 minutes.
• Every hosted request goes only to an AI endpoint with a zero-data-retention policy, so the AI providers don't keep it either.
• We store your GitHub id and username, your plan, and metadata about each request, not its content. We don't store your email address, and we use no analytics or advertising cookies.
• You can download your data or delete your account from your dashboard.

Who we are

KwikQA is responsible for the personal data described here: the data fiduciary under India's Digital Personal Data Protection Act 2023, and the controller under the GDPR. Contact us about privacy, or with a grievance, at privacy@kwikqa.com.

What we collect

Account

When you sign in with GitHub, we ask only for read access to your profile (the read:user scope). We store your GitHub numeric id and username. We don't store your email address or the GitHub token, and we get no access to your repositories. Your browser loads your profile picture directly from GitHub.

Plan and billing

We store your plan, billing period, seats, the identifiers Paddle gives your customer record and subscription, and a record of each refund. When you cancel, we look up your earlier refunds at Paddle to apply the limit of one full refund in 12 months, without storing what we read. Paddle is our merchant of record: it collects your name, email address, billing address, and payment details to sell you the subscription and handle tax, under its own privacy policy. We never receive your card details.

Teams

If you own a team, we store the GitHub usernames you invite and who joined. A team's owner can see each member's username, when they joined, and how many analyses and fixes they used through the team's plan.

Team insights

Only if a team's owner turns on insights: for each analyze, fix, and validate run on that team, we store the titles, workspace-relative file paths, and projects of failing and flaky tests, the test framework (Playwright, Cypress, or WebdriverIO), the outcome and reason code of each fix, how many files and lines it changed, a hash linking a fix to its validation, and who ran it. Everyone on the team can see these on the Insights page. Insights never include evidence, source code, diffs, or error messages, and --local runs share nothing.

Requests

For each AI request made through the hosted service, we store when it happened, its kind (diagnosis or repair), the model and provider, the test framework of the run it was about, its HTTP status, whether it counted toward a plan and whose, token counts, its cost to us, and a SHA-256 hash of the request. On bring-your-own-key plans, the CLI reports each request's kind, model, provider, and test framework, so it counts toward your plan. We also keep monthly usage counters, one-use retry tickets, and analysis sessions, which record how many requests one analysis or fix may make.

Model jobs

While a hosted model request runs, the service keeps a job record of the account, the request's id, and whether it has been answered, so it can give back a request that went unanswered. The job, and the answer it holds, are deleted when your CLI collects the answer, and in any case after 15 minutes. The answer is held only in memory and is never written to storage.

Tokens and sessions

We store SHA-256 hashes of your CLI and CI tokens and website sessions, never the tokens themselves, along with the names you give tokens and when each was created and last used.

Cookies

The website sets three cookies, all strictly necessary for signing in:

We use no analytics, advertising, or tracking cookies, and no third-party scripts except Paddle's checkout, on the checkout page only.

Service logs

Our hosting provider, Cloudflare, processes IP addresses and request details to deliver the service and protect it from attacks. We don't store IP addresses. When a request fails unexpectedly, our logs record only its method, path, and the kind of error, never its content.

Support

If you email us, we receive your email address and what you write, and keep it for as long as we need to help you and keep a record of the request. Please don't send evidence, secrets, or source code by email.

What we don't collect

• We never store your source code, evidence packets, diffs, or the model's answers.
• On bring-your-own-key plans, evidence goes from your machine directly to OpenRouter and never reaches our servers.
• Run records, patches, transaction journals, captures, and validation output stay on your machine, in .kwikqa/ in your project.
• The CLI sends no telemetry or analytics. It contacts our service only for your account (sign-in, plan, and billing), to count and send the requests you approve, and to share team insights where a team's owner turned them on.

What reaches AI providers

The CLI builds an evidence packet on your machine from your failing tests: selected report fields, trace events or the Cypress and WebdriverIO command log, the page elements around each failed locator, the accessibility snapshot of the page, failed requests and console errors, short source excerpts, and recent code changes that mention the failure, with their commit subjects but never author names or emails. Screenshots and videos are described by size only. Before you see the preview, the CLI removes the credentials and secrets it recognizes: password and token fields, authorization and cookie headers, credentials in URLs, and values named like passwords, secrets, tokens, or API keys.

Redaction recognizes credentials, not every kind of personal data. Names, email addresses, or other personal data in your test data or on the pages under test can appear in the packet. Use test data you may share, check the preview, and decline a request you don't want to send. Security describes the packet in detail.

When you approve a request on a hosted plan, our service forwards the packet unchanged to OpenRouter, which sends it to the model endpoint named in the preview:

• Claude, for diagnoses and repairs, on Google Cloud Vertex AI; and
• GPT, for a second repair attempt after the first fails validation, on Microsoft Azure.

Every hosted request asks OpenRouter for zero data retention. Our service refuses any request that doesn't, and OpenRouter sends it only to an endpoint whose policy is to keep neither the request nor the answer, or refuses it. OpenRouter itself doesn't store the content of requests; it keeps metadata such as token counts and timing. Because the request isn't kept, it isn't used to train models. These are the providers' own commitments, under their terms with OpenRouter: we check on every request that zero retention was asked for, but we can't inspect their systems.

On bring-your-own-key plans, requests go from your machine to OpenRouter under your own OpenRouter account, its privacy settings, and its terms. KwikQA's default model routes ask for zero data retention there too; a route you choose yourself doesn't.

How we use it

• to provide the service: sign-in, plans, usage limits, teams, and forwarding the requests you approve;
• to bill you, refund you, and keep billing records;
• to keep the service secure and prevent abuse;
• to answer support requests; and
• to monitor the service's costs and usage in aggregate.

We don't sell or rent personal data, use it for advertising, or use your data to train AI models.

Why we may process it

Under India's Digital Personal Data Protection Act 2023, we process the personal data you give us for the purpose you gave it, which is to provide the service you signed up for, and with your consent where that is needed. You can withdraw consent at any time by deleting your account; that doesn't affect what was done before.

Where the GDPR or UK GDPR applies, we process account, request, and billing data to perform our contract with you, security and cost-monitoring data for our legitimate interest in running a reliable and affordable service, and billing records to meet legal obligations.

Who processes it

We'll update this list before a new provider receives your evidence. We also disclose data when the law requires it, and to a successor if the business is transferred, under this policy.

Where it is processed

Our database's primary copy is in Cloudflare's Asia-Pacific region, and Cloudflare serves the website and service from the data center nearest you. OpenRouter, the AI providers, Paddle, and GitHub may process data in the United States, the European Union, and other countries. India's law allows these transfers except to countries the Government of India restricts. Where the GDPR or UK GDPR requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

Your choices and rights

• Access and export: download your account, tokens, usage, requests, team, and insights as a JSON file from Account in your dashboard. Email us for anything else we hold.
• Erasure: delete your account from the same page. This cancels any subscription, refunding as cancelling would under the refund policy, and at once removes your account, tokens, sessions, requests, usage, team memberships and invitations, insights, and refund records. Paddle keeps the billing records the law requires.
• Correction: your username updates each time you sign in. Email us to correct anything else.
• Nomination: under India's law, you may nominate someone to exercise these rights for you if you die or become unable to. Email us to do so.
• Other rights: depending on where you live, you may also object to or restrict processing.

Email privacy@kwikqa.com for any of these, or with a grievance about how we handle your data. We reply within 30 days. If you aren't satisfied, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

Security and breaches

Data is encrypted in transit and at rest, tokens and sessions are stored only as hashes, and access to production systems is limited to KwikQA's operator; Security has the details. If a personal data breach affects you, we'll tell you, and the authorities the law requires, including the Data Protection Board of India, without undue delay and within the time the law sets.

Children

KwikQA is for professional use and is not intended for anyone under 18. We don't knowingly collect children's data; if you believe a child has an account, email us and we'll delete it.

Changes

We'll post any changes here and update the effective date. For material changes, such as a new kind of data or a new provider that receives evidence, we'll tell you in the dashboard before they apply.