Who this covers

This policy applies to the GoodQA web application at goodqa.app, the GoodQA browser extension, the GoodQA desktop app, and the GoodQA mobile apps for iOS and Android. GoodQA is a bug tracking and guided-testing platform. When you use it as part of an organization, that organization is the controller of the data you submit.

What we collect

• Account data — your name, email, and (for password accounts) a hashed password. If you sign in with Google or GitHub, we receive your basic profile and email.
• Content you create — projects, issues, comments, test plans, testing missions, and any screenshots, screen recordings, or files you attach.
• Bug context you choose to capture — page URL, browser/OS, console/network details, and, if you allow it, your approximate location. Every one of these is shown to you on the report form with a tick box, and reaches GoodQA only if you leave it ticked. Two details worth knowing: the browser extension keeps the last 50 console messages the page you are on has printed, in memory, so they are still there to attach when you find a bug; and location is off until you turn it on. The browser extension and the desktop app ask you before the first lookup, with two separate choices — your approximate city, and your IP address — so you can share one without the other. Decline both and no request is ever made to ipapi.co. See Subprocessors below.
• Diagnostics and product interactions — the GoodQA web app, mobile apps, desktop app, and our servers use Sentry for crash reports, performance traces, logs, and sampled session replays. Replays may capture navigation, taps, clicks, scrolling, and replayed UI state during sampled ordinary sessions as well as sessions with errors; text content is masked. Sentry may also receive device and app context, network IP address, and component stacks. This diagnostic reporting runs on every visit — including before you answer the cookie banner, and if you choose "Reject non-essential" — because it is error and reliability monitoring rather than advertising or product analytics. Sentry processes this data in the United States.
• Connected repositories — if you connect a GitHub repository, the GoodQA GitHub App requests permission to read your code, create issues, and open pull requests. Reading your code and creating issues is how GoodQA works today. GoodQA does not open pull requests or otherwise write to your repository unless your organization turns on Fix Studio's optional "propose as pull request" feature, which is off by default.
• Google Calendar connection data — if an organization manager connects a Google Calendar, GoodQA stores encrypted OAuth credentials while that connection is active and reads upcoming primary-calendar event identifiers, titles, start and end times, locations, and Google Calendar links for the organization's Ops/Reminder agent. GoodQA asks Google for those fields and no others — the request restricts the response to exactly that list, so event descriptions, attendee and organizer lists, attachments and conference/meeting-link data are never returned to GoodQA at all. Event titles, times and locations are sent to OpenRouter to generate the agent's reminder output, under the no-training routing described in "Google user data & Limited Use" below, and can be stored in GoodQA's own database where the agent quotes them in a reminder. GoodQA keeps no other copy of your calendar: each agent run reads the upcoming window fresh and discards it. Disconnecting and organization deletion remove GoodQA's encrypted Calendar credentials locally and stop future Calendar reads. Deleting the connecting person's GoodQA account keeps organization-owned Google accounts connected until an organization administrator disconnects them. GoodQA does not automatically revoke access at Google because Calendar and Google sign-in share an OAuth project; the Google account holder can remove GoodQA in Google Account permissions to remove provider-side consent.

The browser extension & desktop app

The extension and desktop app capture screenshots and screen/tab recordings only when you start a recording, and upload them to your GoodQA organization to attach to a bug report or testing step. Optional meeting detection notices when a video-call tab or window is open and offers to record it — it never records without your explicit action. We do not read your browsing history or your keystrokes, and we do not read the page you are on — with one deliberate exception, described next.

The browser extension reads the console output of pages you visit. On every http/https page it replaces the page's own console.log, console.info, console.warn and console.error with wrappers that keep the last 50 messages in memory. It does this so that when you find a bug, the errors the page already printed are still there to attach — the same lines a developer would read out of devtools. It reads nothing else on the page: not the page text, not form fields, not cookies. Nothing is written to disk, the buffer is discarded when the tab closes, and the messages leave your browser only when you open the report form, see them in a Console field, and leave that field ticked. A page can log anything it likes, including your own data, which is exactly why we show you the lines before they are sent and let you untick them. The desktop app does not do this at all.

Recordings can include audio and camera as well as your screen. The desktop app asks once, before your first recording, whether it may record your microphone, and remembers your answer; it is never turned on for you, and you can change or withdraw the answer at any time in the desktop app's settings. On Windows, system audio is on by default and can be turned off there too; the camera overlay is off by default. When you start a guided testing mission from the browser extension, your microphone and the tab's audio are recorded so the session has narration and call audio. System and tab audio means the voices of other people on a call can be captured.

You are responsible for telling the other people present that you are recording, and for obtaining their consent where the law requires it — many jurisdictions, including several US states and parts of Canada and the EU, require every party to a conversation to consent before it may be recorded. See our Terms of Service.

Google user data & Limited Use

GoodQA's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

The GoodQA Chrome extension offers Google sign-in, and its use and transfer of information received from Google APIs likewise adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. This sentence is about the extension specifically; the web application's Google Workspace access is governed by the two policies named above.

What Google user data GoodQA accesses. If you sign in with Google, GoodQA receives your Google account's basic profile and email address. If an organization administrator explicitly connects Google Calendar, GoodQA additionally reads, through the read-only calendar.events.readonly scope you authorize, your upcoming primary-calendar events: the event identifier, title, start and end time, location, and Google Calendar link. GoodQA's request to Google restricts the response to exactly those fields, so event descriptions, attendee and organizer lists, attachments and conference data are never returned to GoodQA.

How GoodQA uses it. Your profile and email authenticate you and identify your account within your organization. Calendar events are used for one purpose only: to produce the reminders and calendar insights that organization's Ops/Reminder agent is configured to generate. We never use Google user data to serve ads, never sell it, and never use it for a purpose unrelated to the GoodQA features you choose.

Artificial intelligence and machine learning. Google Workspace APIs are not used to develop, improve, or train non-personalized artificial-intelligence or machine-learning models. GoodQA does not train models on Google user data, including data aggregated, anonymized or derived from it. OpenRouter chat requests carry the provider-routing preference data_collection: "deny". Embedding requests currently do not carry this preference; this is not an all-feature training or retention guarantee. Provider terms and configuration govern downstream handling.

Who else receives it. To generate the Ops/Reminder agent's output, event titles, times and locations are sent to OpenRouter under the routing preference above. No other third party receives Google Calendar data. Your Google profile and email are used only to sign you in and identify your account and are not sent to an AI provider — though your display name, like any name in your organization, can appear inside content our AI features summarise, as described under Subprocessors. GoodQA does not allow its staff to read your Google Calendar data; the only exceptions are the narrow ones the Limited Use requirements themselves permit — where you have given specific consent, where it is necessary for security purposes, or where the law requires it.

How long GoodQA keeps it, and how to remove it. The OAuth credentials for a Calendar connection are stored encrypted, and only while that connection is active. GoodQA stores no copy of your calendar itself — each agent run reads the upcoming window fresh from Google and discards it; only the text the agent actually quoted in a reminder persists, inside your organization, and is deleted with it. Disconnecting Google Calendar or deleting the organization removes the stored credentials and stops all further Calendar reads. Deleting the connecting person's GoodQA account keeps organization-owned Google accounts connected until an organization administrator disconnects them. Because Calendar and Google sign-in share one OAuth project, GoodQA does not revoke the grant at Google for you: you can remove GoodQA at any time from your Google Account permissions.

How we use data

To provide the service: authenticate you, store and display your team's issues and recordings, run AI features you invoke (test-plan generation, bug enrichment) via our AI provider, and send notifications you've enabled. If you allow analytics cookies (see below), we also use aggregate usage data to understand how GoodQA is used and improve it. We do not sell your data, and we do not use Google Analytics for advertising — ad personalization and Google Signals are turned off for our property.

Cookies & tracking

GoodQA sets session/authentication cookies so you can stay signed in — these are strictly necessary and are not optional. We also use localStorage for the multi-account switcher, your theme preference, and your cookie choice itself. None of this is advertising or third-party tracking.

With your permission — asked via the cookie banner shown on your first visit, and changeable at any time — we use Google Analytics 4 (GA4), provided by Google, to understand product usage: which pages are viewed, and whether a visit leads to a handful of named product milestones — signing up, finishing onboarding, creating a project or a testing mission, sending or accepting a team invite, and upgrading to a paid plan. GA4 sets its own cookies to do this. We do not send GA4 anything before you make a choice, and it never runs at all if you choose "Reject non-essential."

To change your choice at any time: manage your cookie preferences.

Subprocessors

Infrastructure and optional processor pathways are derived from code and configuration:DigitalOcean (Hosting, database, object storage and job execution; Data entered into the corresponding feature; account and application data for infrastructure.); Cloudflare (Bot-check (Turnstile) verification on protected forms; Cloudflare operations an organization requests for its own sites; desktop app download hosting; Data entered into the corresponding feature; account and application data for infrastructure.); Google Cloud (Configured Google storage, speech transcription and Vertex AI; Configured storage contents, speech audio, screenshots and transcript text for AI summaries); OpenRouter (AI prompts, code context and embeddings; underlying model providers also process requests; Ticket content, related code context and attachments, source code, message text and embeddings); Anthropic (Direct AI requests when the organization supplies its own credential; Data entered into the corresponding feature; account and application data for infrastructure.); OpenAI (Direct AI requests when the organization supplies its own credential; Data entered into the corresponding feature; account and application data for infrastructure.); Resend (Transactional email recipients and message content; Data entered into the corresponding feature; account and application data for infrastructure.); Stripe (Checkout, subscriptions, billing details and refund requests; Data entered into the corresponding feature; account and application data for infrastructure.); Sentry (Configured error diagnostics and sampled telemetry; Data entered into the corresponding feature; account and application data for infrastructure.); Expo (Push device tokens and notification content; Device push token, notification title/body/link); Google Analytics 4 (Consent-gated usage events; Data entered into the corresponding feature; account and application data for infrastructure.); ipapi.co (Opt-in IP geolocation; Data entered into the corresponding feature; account and application data for infrastructure.); GitHub (Connected repository data and configured writes; Data entered into the corresponding feature; account and application data for infrastructure.); Klaviyo (Configured marketing contacts and email; Data entered into the corresponding feature; account and application data for infrastructure.); Apollo.io (Configured prospecting inputs and contacts; Data entered into the corresponding feature; account and application data for infrastructure.); Postiz (Configured social scheduling content; Data entered into the corresponding feature; account and application data for infrastructure.); Twilio (Configured calls, SMS and telephony metadata; Data entered into the corresponding feature; account and application data for infrastructure.). Actual processing depends on which features and credentials are configured. The directory below distinguishes hosting definitions from optional integrations; it does not attest to live settings.

For the full list — including exactly what each one receives, where it operates, and how to be notified if this list changes — see our Subprocessors page.

ipapi.co is used by the browser extension and the desktop app only, and only if you say yes first. The first time you open the report form, it asks — before anything is sent — with two independent choices: whether we may look up your approximate city, region and country, and separately whether we may record your IP address. Until you answer, and if you decline both, no request is made to ipapi.co at all.

If you allow either, we send one HTTPS request to ipapi.co and nothing else — no account, no page, no identifier. Because that request comes from your own machine, ipapi.co receives your IP address: that is how IP lookup works, and it is true even if you shared only your city. What declining the IP means is that GoodQA never records or transmits it — we discard it the moment the answer arrives. The only choice that keeps your IP away from ipapi.co entirely is declining both.

What comes back is shown to you as two separate fields — Approximate location (IP-based) and IP address — each with its own tick box, and each attached to the report only if you leave it ticked. We use it so a developer can reproduce location-dependent bugs (a CDN edge, regional pricing, a language or currency default). It is not used to track you over time and we do not store it outside the bug report you chose to file. You can change or withdraw your answer at any time — in the browser extension's options, or in the desktop app under Settings › Location on bug reports. If you decline, the location fields simply say so and stay empty. ipapi.co has its own privacy policy at ipapi.co/privacy.

AI processing pathways are derived from the application code. Depending on the feature and organization credentials, data may reach:

• Google Cloud — Configured Google storage, speech transcription and Vertex AI
• OpenRouter — AI prompts, code context and embeddings; underlying model providers also process requests
• Anthropic — Direct AI requests when the organization supplies its own credential
• OpenAI — Direct AI requests when the organization supplies its own credential

• OpenRouter — test-plan generation and refinement, bug enrichment, Suggest Fix (the ticket you're viewing plus related code context and issue attachments), Project Intelligence (see below), repository scanning (your source code), Slack message triage, and agent/QA evaluation. With your separate meeting consent, live microphone and meeting audio are sent in short speech windows using your organization's OpenRouter key. Transcript text is used for meeting summaries, action items and proposed tickets. Tickets require your approval; summaries may become notes on uniquely matched contacts in your organization. Saved meeting transcripts follow recording retention and deletion rules, including protection for active meetings.
• Google (Vertex AI and Google AI Studio, the Gemini models) — issue summaries (issue title, description, comment bodies, decision text and author names), chat and direct-message summaries (message bodies and author names), mockup generation (the screenshot you supply), our own marketing and SEO tooling, and — when someone asks GoodQA to suggest tickets from a screen recording — that recording's transcript text.
• Google Cloud Speech-to-Text — transcription of a screen recording, and only when someone on your team enables automatic transcription for that recording or asks for that specific recording to be transcribed. What is sent is the recording's audio — which is whatever was being said while it was captured, including anyone whose microphone was on — converted to speech-only audio and sent in short pieces. The video is not sent. We keep the resulting text and its timestamps; the audio we extract to send exists only for the length of that job and is never stored.

Project Intelligence is off unless a project owner connects a repository and explicitly turns it on. When on, GoodQA indexes that repository's source code and sends it to OpenRouter so you can ask questions about it.

AI processing location depends on provider routing. Vertex AI uses a global endpoint by default; we do not claim US-only or EU-only processing.

OpenRouter chat clients set data_collection: "deny" as a provider-routing preference. Embedding clients currently do not set this preference. It is not a separately negotiated zero-retention agreement or a guarantee across all features. The preference does not reach Google or direct providers. Direct providers and customer-supplied credentials follow their own configuration and terms; data-logging and model-improvement settings require separate verification. Counsel review of training, retention and transfer commitments is pending.

If your organization uses our sales and marketing tooling, Klaviyo (email delivery), Apollo.io (business-contact enrichment) and Postiz (social scheduling) also process data you put into those features. These are not used to run the bug-tracking product itself.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect it. Deployment definitions target DigitalOcean. Traffic between you and GoodQA travels over HTTPS, with HTTP Strict Transport Security set so supported browsers keep using it; storage protections depend on the configured service. Passwords are never stored in a recoverable form — only as an Argon2 hash. Third-party credentials you connect, including your Google OAuth tokens, are additionally sealed by GoodQA with authenticated AES-256-GCM encryption before they reach the database, and each envelope is bound to its organization, project, resource and purpose, so ciphertext copied to another context fails to open at all. Recordings and files are never publicly addressable: they are held in private cloud storage and served only over short-lived signed links.

Access to your organization's data is scoped to that organization and checked against an explicit permission on every protected action, through the same role, custom-role and time-bounded grant system you can see in the app. Cross-tenant access is exercised by integration and adversarial tests.

More detail, and how to report a vulnerability, is on our Security page. To report a security issue, email support@goodqa.app. No system can be guaranteed perfectly secure, and we will notify affected users and organizations of a breach as required by applicable law.

Retention & your rights

Data persists while your account/organization is active. You can edit or delete issues, attachments, and recordings in the app, and you can permanently delete your own account yourself, at any time, from Account settings — no need to contact us. You'll be asked to type your email address to confirm; if you're the sole owner of an organization you'll be asked to promote another member first, so the org isn't left without an owner. Content you authored (issues, comments, test plans) stays with your team after deletion, with your identity removed from it. Where required by law, you may also request access to or deletion of your personal data by contacting us.

Screen recordings and their attachments also have a fixed outer retention window, after which an automated sweep deletes them even from an active account: 365 days on the Free plan, and 730 days on the Pro and Enterprise plans. Before a recording is deleted for reaching that window, we email the organization a warning — first 14 days ahead, then a final notice 3 days ahead — so there is time to download it if you want to keep it. You can always delete a recording yourself sooner.

Contact

Questions about this policy: support@goodqa.app.