Last updated: May 14, 2026
OverlayQA is a visual QA tool for web product teams. It ships as a Chrome extension and a companion web dashboard at overlayqa.com. When you use a feature — capturing a bug, running an accessibility audit, or comparing a live page to a Figma frame — OverlayQA turns that interaction into a structured issue report and stores it in your account.
"Service" means the OverlayQA Chrome extension, the dashboard at overlayqa.com, and the API at api.overlayqa.com. "We", "us", and "our" mean OverlayQA. "You" means the person using the Service.
This policy explains what information we collect, how we use it, who we share it with, and the rights you have over it. OverlayQA's use and transfer to any other app of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
When you create an OverlayQA account, we collect your email address, password, and name (managed by our authentication provider, Clerk). Passwords are hashed by Clerk before storage and are never stored in plaintext or accessible to OverlayQA staff. If you sign in via Google, no password is collected. A signed session token (JWT, HMAC-SHA256, 30-day TTL) is stored locally in chrome.storage.local to keep you logged in. If you connect Figma, Jira, Linear, or Notion, we store the OAuth access tokens those services issue, encrypted at rest using AES-256-GCM.
We use this information to identify your account, associate your issues with you, keep you signed in across browser restarts, and send you product-related communications.
The Chrome extension collects data only when you explicitly trigger a feature such as capture, accessibility audit, Figma comparison, or AI analysis. Nothing in this section is collected passively or in the background.
When you initiate a feature, the extension captures:
tabs.captureVisibleTab API and uploaded to our server.innerText of elements you actively pin for bug capture. We do not capture text from form inputs, password fields, or content that is not visibly rendered.outerHTML for elements associated with reported issues or accessibility violations.color, background-color, font-family, font-size, font-weight, line-height, letter-spacing, padding, margin, gap, border-radius, border styles, display, flex properties, width, and height.:root stylesheets), client-detected inconsistency findings (near-duplicate colors, orphan font sizes, off-scale spacing) with element selectors and bounding rectangles, optional Figma design tokens (if a Figma file is connected), the page URL, and viewport dimensions are forwarded to OpenAI's GPT-4o API for enrichment analysis. No form inputs, passwords, or hidden content are captured during this sampling.color, background-color, font-size, font-weight, line-height, display, and bounding rectangles), the total element count on the page, a screenshot of the current browser tab, and — if you have linked a Figma frame — the Figma frame image. Our server forwards this bundle to OpenAI's GPT-4o API, which visually analyzes the page to identify WCAG violations that automated tools cannot detect (non-text contrast, touch target size, clickable-but-not-focusable elements, hover/focus dismissal issues, ARIA composite pattern gaps, color-only information conveyance). The full page DOM is never transmitted.navigator.userAgent string) and attaches it to the issue as reproducibility context for the developer fixing the bug:
We use this information to generate the issue report, draft AI-powered title and severity suggestions, compare your Figma design against the live page for visual comparison, and run accessibility audits. Issue reports can be exported to Jira, Linear, or Notion when you choose to do so.
The extension also maintains a local LRU index in IndexedDB of pages where you have used OverlayQA features (maximum 200 entries, 50 per hostname). Each entry contains the page URL, title, visit timestamp, and a compressed 200×200 JPEG thumbnail of the page captured at the time you used the feature. This index is stored only on your device and is never transmitted to our servers. It is removed when you uninstall the extension or clear browser data.
Passive browsing history. We do not track, record, or transmit a list of every page you visit. Page URLs and titles are only captured at the moment you actively use a feature such as creating an issue, running an accessibility scan, or starting a design comparison.
Passive page content. The extension does not read, log, store, or transmit the content of pages you visit unless you actively use a feature (creating an issue, running an audit, or starting a comparison). When you are signed in, an authenticated Server-Sent Events connection to api.overlayqa.com is maintained to deliver real-time notifications and Figma comment updates to your browser; this connection only carries notification payloads from our server to your browser and does not transmit page content, browsing history, or user activity from your browser back to us.
We collect basic usage data to understand how the Service is used and to improve it:
You can create an OverlayQA account using Google. When you sign up or log in to your OverlayQA account using Google, we store your profile information (name, email address, and profile picture), as authorized by you.
We use the information described above to:
We do not sell, rent, or trade your personal data. We share data only with the sub-processors listed under "Third-Party Services We Use" below, and only as required to operate the Service.
When you create an issue, run an accessibility audit, start a Figma design comparison, run a Design Token Audit, or verify a fix, the following data is forwarded to OpenAI's GPT-4o API: page screenshots, Figma frame images (when a Figma frame is linked), element selectors and metadata, computed CSS for pinned elements, element text content (innerText, up to 200 characters), page URL, page title, viewport dimensions, axe-core accessibility violation results, design system token data sampled from up to 200 page elements, and — for Design Token Audits — the token inventory (extracted CSS values, frequencies, CSS custom property declarations), client-detected findings with element selectors and bounding rectangles, and optional Figma design tokens. For Fix Verification, we additionally forward the original screenshot URL, the current (re-captured) screenshot URL, the issue title, issue description, element selector, and severity; for accessibility-issue verifications, we also include the WCAG criterion, the axe-core rule ID, and the boolean results of re-running axe-core (whether the rule still flags the page and whether it still flags the original selector), plus an optional single-sentence note when the element is no longer present or the viewport differs from the original capture. Your name, email, and account credentials are never sent to OpenAI. Per our agreement with OpenAI, data sent through their API is not used to train their models.
When you connect Figma, Jira, Linear, or Notion, the relevant issue or design data is sent to those services via their APIs using your OAuth credentials. This only happens when you initiate the connection and choose to export.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
You have the right to request access, correction, or deletion of your personal data; to delete your account; to disconnect integrations (which revokes our access to those services); to unsubscribe from communications; and to uninstall the extension at any time (which removes all locally stored data). To exercise any of these rights, contact hello@overlayqa.com.
If you are in the EEA or the UK, we process your personal data under the following legal bases: contract performance (to provide the Service you signed up for), consent (for optional integrations and marketing communications), and legitimate interests (product analytics to improve the Service, including the IP address and derived geolocation data that PostHog captures on every analytics event — see the PostHog entry under Sub-processors). You have the right to access, rectify, erase, restrict, object to, and port your personal data.
If you are a California resident, you have the right to know what personal information we have collected about you, to request deletion, to opt out of the sale of personal information (we do not sell personal information and have no plans to do so), and to non-discrimination for exercising these rights.
We use the following third-party services that collect or process data on our behalf:
assets.apollo.io) only. Apollo collects page views, IP address, and browser metadata for visitors to our marketing pages. Not loaded by the Chrome extension.Each of these services operates under their own privacy policies. We encourage you to review them.
Children. OverlayQA is not intended for use by children under the age of 13. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 13, we will delete it promptly.
Do Not Track. The extension does not alter its data collection in response to DNT signals, but performs no passive background tracking regardless of DNT settings — data is only collected when you actively use a feature.
International transfers. Data may be processed in the United States and other countries where our sub-processors operate. By using OverlayQA, you consent to this transfer. We ensure that all third-party processors maintain appropriate data protection standards.
Cookies and local storage. Our services use cookies and similar technologies (localStorage, chrome.storage) to maintain your session, remember preferences, and collect product analytics (PostHog, which also receives your IP address and derived geolocation — see Sub-processors). You can control cookie behavior through your browser settings. The Chrome extension's local storage can be cleared by removing the extension.
Changes to this policy. We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at hello@overlayqa.com.