Privacy Policy

Summary

Repliqa runs entirely on your device. It does not have a server, does not send your data anywhere on its own, and does not include any analytics, advertising, or tracking code. Everything Repliqa captures is stored locally in your browser and only ever leaves your device when you explicitly export or share a report.

What Repliqa accesses

When you click the Repliqa icon (or use "Start Recording") on a page, it can capture:

• A screenshot of the visible page, and any additional screenshots you choose to add via the snip tool.
• A DOM snapshot of the page at the moment of capture.
• Console output (log, info, debug, warn, error, and uncaught exceptions) from the page and its frames.
• Network activity: request/response metadata (URL, method, status code, timing, headers, and for JSON/text responses, bodies) for requests made by the page while Repliqa is active.
• Reproduction steps, if you start recording: clicks and form field changes on the page, logged as short descriptions (e.g. "Clicked Checkout button").
• What you type into Repliqa itself: the title, description, and notes fields of the bug report you're composing.
• Basic environment info: the page URL, browser/OS, and screen/viewport size, used to fill in the report's metadata.

When capture happens

Repliqa only captures this on pages where you actively invoke it. It does not run in the background collecting data from every page you visit.

Sensitive data handling

Repliqa is designed to avoid capturing credentials and payment details as part of reproduction steps and network logs:

• Password fields, and any field whose name, id, placeholder, or autocomplete attribute matches patterns for card numbers, CVV/CVC, SSNs, PINs, tokens, or similar, are recorded as "changed" without ever recording the value typed into them.
• Sensitive HTTP headers (Authorization, Cookie, Set-Cookie, X-Api-Key, Proxy-Authorization) are redacted from the network activity log before they're ever shown in a report.

Screenshots and DOM snapshots

These protections apply to the step recorder and network log specifically. A screenshot or DOM snapshot is a capture of whatever is visibly on the page, so avoid capturing a page that is itself displaying sensitive information you don't want included in a report.

Where your data is stored

All of the above is stored locally in your browser using Chrome's storage APIs:

• Local storage: your theme preference and your local report history (past reports you've exported or sent, kept so you can re-download or delete them later).
• Session storage: an in-progress draft of the report you're currently composing (so closing and reopening the sidebar doesn't lose what you've typed) and the state of an active recording session (so it survives a page reload while you're reproducing a bug). Session storage is cleared automatically when the browser closes.

No remote access

None of this is synced to a remote server, an account, or any third party by Repliqa. We do not operate a backend, and we do not have access to any of this data ourselves.

When data leaves your device

Data only leaves your device when you take an explicit action to make that happen:

• Copy to Clipboard: copies the plain-text or Markdown report to your system clipboard.
• Download HTML Report / Download ZIP Archive: saves a file to your Downloads folder using Chrome's downloads API. What you do with that file afterward (email it, upload it, paste it into a chat) is entirely up to you.

No automatic uploads

Repliqa itself never uploads, transmits, or sends captured data to any server, API, or third party.

No remote code

Every script Repliqa runs is bundled with the extension at build time. Repliqa does not download, fetch, or evaluate any remote or dynamically-loaded code.

No third parties, no ads, no tracking

Repliqa does not sell, rent, or transfer your data to third parties. It contains no analytics SDKs, no advertising code, and no tracking pixels. We don't know how many people use Repliqa, what pages they use it on, or what's in their reports, because none of that is ever sent to us.

Your control over your data

• Report history: viewable and individually deletable from the Repliqa settings page, with a "Clear All" option to remove every saved report at once.
• Uninstalling the extension removes all locally stored Repliqa data (settings, drafts, and history) along with it, per standard browser behavior.

RepliQA Dashboard & Embeddable Snippet (a separate, in-development product)

Everything above describes the Repliqa browser extension. We are also building a separate product for agencies: a web dashboard plus an embeddable JavaScript snippet that agencies add to their clients' websites, so a visitor to that website can report a bug directly from the page. This product has not yet launched publicly. This section describes its intended data practices ahead of launch and will be revised, with an updated date above, once it ships.

Unlike the extension, this product has a server-side backend. A multi-tenant service used by many agencies can't run entirely on-device the way the extension does: when a site visitor triggers the snippet, the captured report is sent to and processed by our backend (hosted on Google Cloud / Firebase) before it appears in the agency's dashboard.

When triggered, the snippet can capture:

• The page URL and title.
• Console errors and warnings from the page.
• Network failure metadata — endpoint, status code, and timing for failed requests. Full request/response bodies are not captured by default; an agency can opt a specific client site into full-payload capture for their own debugging, and redaction (below) still applies even then.
• A short list of recent steps (e.g. "Clicked Submit button"), recorded as brief descriptions, not full session recordings.
• Basic device/browser info (browser, OS, device type, viewport size).
• An optional written description the visitor types in before sending the report.
• A short screen recording, only if the visitor explicitly checks an on-page opt-in box before it starts — never automatically. Text input fields are visually masked while recording, the same way password fields are, so typed content isn't captured in the video.

Optional Jira and Azure DevOps integration

An agency may optionally connect one of their clients' sites to that client's own Jira or Azure DevOps board, so captured reports automatically become tickets there. This is off by default and requires the agency to explicitly authorize it through Jira's or Microsoft's own OAuth consent screen — we never access a Jira or Azure DevOps account without that explicit authorization.

Once connected, a captured report's title, description, redacted console/network summary, and video (if one was recorded) are sent to create a ticket on that specific board. The access token from that authorization is encrypted before it's stored and is scoped only to the client site it was connected for — it is never used to access any other client's board, including other clients belonging to the same agency.

Sensitive values are redacted before a report is sent anywhere: passwords, authorization headers, cookies, and common patterns such as emails, card numbers, and access tokens are stripped both in the visitor's browser and again on our server as a backstop, before a report is stored or sent to Jira/Azure DevOps.

Captured reports and any recording are automatically deleted after a retention window the agency configures for that client site (30 days by default), or immediately after a ticket is successfully created, if the agency chooses that setting instead.

In this product, the person whose activity is captured is typically a visitor to an agency's client's website, not the agency itself. The agency is responsible for its own end users under applicable law; we act as the agency's service provider for the data captured on their behalf.

Children's privacy

Repliqa is a developer/QA tool not directed at children, and we do not knowingly collect data from children.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above and, for material changes, note them here.

Contact

Questions about this policy or Repliqa's data practices can be sent to: hi@douglasmasho.com