Security
Security and Data Handling
How OverlayQA handles your data: what we collect, how it is protected, where it is stored, and how to have it deleted. The privacy policy is the full legal version of everything on this page.
Last updated: October 15, 2026
What we collect, and when
- The Chrome extension collects data only when you start a feature, such as capturing an issue, running an accessibility audit, or comparing a page to a design. Nothing is collected passively or in the background.
- When you capture an issue, OverlayQA records a screenshot of the current tab, the selected element, its computed styles, the page URL and title, and your browser and viewport details.
- OverlayQA does not capture text from form inputs, password fields, or content that is not visibly rendered.
How your data is protected
- All data in transit is encrypted with HTTPS/TLS.
- OAuth tokens for connected tools such as Jira, Linear, Notion, Asana, Trello, Slack, and Figma are encrypted at rest with AES-256-GCM.
- Passwords are handled by our authentication provider, hashed before storage, and never visible to OverlayQA staff. You can also sign in with Google.
- Extension sessions use signed tokens that expire automatically after 30 days.
- API endpoints are protected by authentication and rate limiting.
Who can see your issues
- Issues and comments are visible to the members of the team that owns them, with role-based access for teammates.
- Every comment has an audience: Team only, the default, or Team and clients. Clients on a review link see only what you share with them.
- Shared issue links and client review links are opt-in. You choose what to share.
How AI features use your data
- AI features run only when you use them. Each one sends the data listed for it in our privacy policy, such as a screenshot and element details.
- Our agreement with our AI provider means data sent through its API is not used to train its models.
- Issue comments are never sent to an AI provider.
- Our privacy policy names the AI provider and lists exactly what each feature sends.
Where your data is stored
- The database is hosted in the United States, and the API servers run in the United States.
- Screenshots and design images are stored with Cloudflare R2.
- We do not sell, rent, or trade your personal data.
- Every service that processes data for us is listed in the sub-processors section of our privacy policy.
Retention and deletion
- Account data and issues are kept while your account is active.
- Screenshots and design images are kept for as long as the issue they belong to exists.
- In-product help chat transcripts are deleted automatically after 90 days.
- You can ask us to delete your account and all of its data at any time by emailing hello@overlayqa.com. Uninstalling the extension removes the data it stored in your browser.
Your rights
- You can request access to, correction of, or deletion of your personal data, and disconnect any integration to revoke our access to it.
- Users in the EU, EEA, and UK have GDPR rights, and California residents have CCPA rights. The privacy policy explains both.
Questions, a security review, or something to report? Email hello@overlayqa.com. Read the full privacy policy.