Privacy Policy

• User registration and identification
• Service provision and maintenance (QA annotation, issue tracking, screenshot capture, session replay)
• AI-based issue analysis (automatic reproduction step generation, root cause analysis)
• Payment processing and settlement
• Customer support and complaint resolution
• Statistical analysis for service improvement and new service development
• Compliance with legal obligations

Required Items:

• Email address, name (nickname), password (not collected for social login)

Social Login:

• Social account unique ID, email address, profile name

Automatically Collected During Service Use:

• IP address, browser information (User-Agent), access time, device information, viewport size
• Screenshot images (screens captured directly by the user, may contain personal information)
• Session replay data (when the user activates this feature, DOM change records)
• Console logs and network request logs, including limited request/response body text up to 2KB where available (automatic sensitive information filtering applied)
• CSS selectors, selected element text, computed element styles, and React component tree information
• JavaScript errors and stack traces (error messages, file locations, call stacks)
• SPA route change records (in-page URL change history)
• Framework/library detection information (React, Vue, Angular, etc. usage and version)
• Performance metrics (Web Vitals: LCP, FCP, CLS, INP, TTFB, Navigation Timing, Resource Timing)
• Environment information (accessibility settings, language/timezone, network connection status, GPU info, zoom level)
• Optional storage and DOM snapshots (localStorage, sessionStorage, browser-accessible cookies, and rendered DOM outerHTML) only when enabled by the project and separately confirmed by the user

Payment:

• Payment method information (processed through PortOne; the Company does not directly store card numbers)

• Records of contracts or subscription withdrawal: 5 years (Electronic Commerce Act)
• Records of payment and supply of goods: 5 years (Electronic Commerce Act)
• Records of consumer complaints or dispute resolution: 3 years (Electronic Commerce Act)
• Login records: 3 months (Protection of Communications Secrets Act)

• GitHub — Issue synchronization (only when the user has configured the integration)
• Slack — Notification delivery (only when the user has configured the integration)

• Request to access personal information
• Request correction of errors
• Request deletion
• Request to suspend processing

Destruction Procedures:

• Information entered by users is transferred to a separate database after the purpose has been achieved, stored for a designated period per internal policy and applicable law, then destroyed
• Upon account deletion, personal information and service data (issues, screenshots, session replays) are immediately deleted

Destruction Methods:

• Electronic files: Permanently deleted using methods that prevent recovery
• Paper documents: Shredded or incinerated
• Cloud storage (R2): Complete object deletion

• Encrypted password storage (argon2id hashing algorithm)
• Transport encryption (HTTPS/TLS 1.2 or higher)
• Encryption at rest (AES-256-GCM)
• Access control management and minimization (RBAC: Owner, Admin, Member, Viewer)
• Personal information access logging and audit trails
• Automatic masking of sensitive information (passwords, API keys, tokens, card numbers) in console logs and network requests
• Regular security vulnerability assessments

Cookies Used:

• access_token — JWT access token (expires: 2 hours), for authentication purposes
• refresh_token — Refresh token (expires: 30 days), for session maintenance purposes

How to Reject Cookies:

• You can block cookies through your browser settings.
• However, blocking authentication cookies will prevent you from logging in to the service.

Behavioral Information Collected:

• Session replay: DOM changes, mouse movements, clicks, scroll event records
• Console logs: JavaScript console output content
• Network requests: API request/response metadata and limited request/response body text up to 2KB where available
• User action logs: Click, input, navigation events

Purpose of Collection:

• Support for QA issue reproduction and debugging
• Understanding the context of bug occurrences

How to Opt Out:

• You can disable the session replay feature in project settings.
• You can toggle individual data collection on/off in Chrome Extension settings.

Prerequisites for Data Collection:

• The user must be logged in to the Extension.
• A project must be selected.
• The user must explicitly consent on the data collection consent screen.
• If all three conditions are not met, the Extension does not collect any data.

Technical Metadata Collected:

• Console logs: console.log/warn/error output from the page (max 200 entries, most recent 100 upon issue submission)
• Network requests: fetch/XMLHttpRequest request/response metadata and limited body text up to 2KB (max 50 entries, sensitive headers like Authorization/Cookie automatically masked)
• JavaScript errors: Error messages, file locations, stack traces (max 50 entries)
• SPA route changes: pushState/replaceState/popstate events (max 30 entries)
• Framework detection: Presence of React, Vue, Angular, etc.
• React component tree: Component names, props, state (depth 10, max 20 keys)
• Performance metrics: Web Vitals (LCP, FCP, CLS, INP, TTFB), Navigation/Resource Timing
• Environment information: Accessibility settings, language/timezone, network status, GPU, zoom level
• Selected element metadata: CSS selectors, visible text snippets, layout, size, and computed style information
• Optional storage/DOM snapshots: localStorage, sessionStorage, browser-accessible cookies, and rendered DOM outerHTML only when the project allows it and the user confirms a separate prompt

Data Storage and Transmission:

• Collected data is temporarily stored in browser memory and is transmitted to the server only when the user submits an issue.
• If no issue is submitted, the data is automatically deleted from memory when the page is navigated away from.
• All server transmissions are encrypted via HTTPS.
• The Extension does not sell collected data to third parties or use it for advertising purposes.

Sensitive Information Protection Measures:

• Automatic masking of 13 types of sensitive headers in network requests including Authorization, Cookie, and API Key
• Masking of 14 types of sensitive URL query parameters including token, password, and api_key
• Masking of 13 types of sensitive fields in request/response bodies including password, credit_card, and ssn
• Automatic masking of input fields during session replay
• Automatic masking of sensitive input values during user action tracking
• Sensitive-key and sensitive-value masking for optional storage and DOM snapshots

Automated Processing:

• Automatic issue reproduction step generation: Automatically generates bug reproduction procedures based on collected technical metadata
• Root cause analysis: Analyzes console logs, network requests, and user actions to suggest probable causes

User Rights:

• AI analysis results are for reference only; final judgment is made by the user.
• AI analysis can be disabled in project settings.
• Data used for AI analysis is not used for OpenAI model training.

• Name: (To be designated)
• Position: CEO
• Contact: privacy@qanote.app

Limited Use Compliance:

• Collected data is used only for the Extension's single purpose (QA bug reporting).
• Collected data is not used for advertising purposes.
• Collected data is not sold or transferred to unrelated third parties.
• Data is not used for creditworthiness assessment or loan qualification screening.
• Data collection does not begin without the user's explicit consent.