How Quality keeps your data private.

Quality sits on top of the product your team is building. Every thread comes with a replay of the page, the actions taken, and the console and network activity behind it. That’s what makes the feedback useful, and it’s also why we treat it as yours, not ours.

Here’s what that means in practice.

Private data never leaves the browser

Replays are cleaned on the page, before anything is uploaded:

• Typed text is hidden. Every form field is recorded as ***, including fields that were already filled in.
• Credentials are removed. Auth headers, cookies, API keys, and fields like passwords and tokens in requests, responses, URLs and console messages are replaced with [REDACTED].
• You choose what else stays out. Mark any part of your page to hide its text or leave it out of replays entirely. Here’s how.

Our servers apply the same rules again when a replay is stored and when it’s played back, so nothing slips through if a page sends something unexpected.

Our team can’t browse your workspace

The tools Quality’s team uses to run the service show what we need to keep it running: accounts, plans and how much a workspace uses. They have no way to open a thread, read a comment, play a replay or look at console and network logs. Those screens don’t exist, and neither does anything behind them that could show them.

• We don’t see what you’re building either. The addresses of your projects, and the sites our script runs on, are hidden from our tools.
• Signing in to those tools takes a password and a code sent by email, sessions end after 12 hours, and every change made with them is recorded.
• The one exception is a problem you report to us. Our support team sees the message and any files you choose to attach.

Keep replays in your own storage

If your team needs more than our word, keep your files somewhere we can’t reach. Connect your own S3-compatible bucket, such as Amazon S3 or Cloudflare R2, and replays, recordings and screenshots go straight from the browser into it. They never pass through Quality’s servers, we never read them, and every link to a file expires within the hour. Get in touch to turn it on for your workspace.

You decide who sees what

• Your team sees its projects, threads and the full session behind each one.
• Guests see only the projects they were added to, and never the console, network or action logs.
• Shared links keep those logs hidden unless you choose to share them. On paid plans, owners can limit links to signed-in members.
• The script only runs, and only signs people in, on the sites you list for a project.

Signing in and secrets

• You sign in with a one-time email code or Google. There are no Quality passwords to leak.
• Every session is checked on each request, so signing out or removing someone takes effect at once.
• Everything travels over HTTPS. Tokens for Slack, Jira, Linear and GitHub, and keys for your own storage, are encrypted before they’re stored.

Your data stays yours

You can download everything Quality holds about you, or delete your account, from Settings → Account → Your data. Deleting a workspace deletes its files from our storage too.

The full details are on our security page. If you find a problem, tell us with Report a problem in the dashboard. We take every report seriously.