Your data stays
yours

Shuddhi QA (shuddhiqacloud.vercel.app) is an AI-powered QA test case generator built and maintained by Ramya, Senior QA Engineer, Bengaluru, India. This privacy policy explains what data is collected, how it is used, and your rights regarding that data.

When signed in, Shuddhi QA syncs a small set of non-sensitive preferences to Google Firestore so your settings follow you across devices. This data is stored in your personal Firestore document at users/{your_firebase_uid} and is accessible only to you.

For anonymous users (no sign-in), Shuddhi QA collects only what is stored in your own browser:

When you generate test cases, your requirement text and uploaded documents are sent to the selected AI provider. Each provider processes this data under their own privacy policy:

Shuddhi QA integrates with the following services:

• Google Firebase (Authentication + Firestore) — Used for optional sign-in and cross-device preference sync. Governed by Firebase Privacy Policy. Data stored in the us-central1 region.
• Azure DevOps — Test plan push uses your Personal Access Token, stored in browser localStorage and forwarded via our proxy to dev.azure.com.
• Jira (Atlassian) — Ticket fetch uses your API token, stored in browser localStorage and forwarded via our proxy to your Jira instance.
• Cloudflare Pages — Hosts the application. May retain standard server access logs (IP, path, timestamp) for up to 30 days per Cloudflare's Privacy Policy. No request body is logged.
• Google Fonts — Fonts loaded from fonts.googleapis.com. Google may log the font request IP address.
• Exchange Rate APIs — USD→INR rate fetched from exchangerate-api.com for cost display. No personal data is sent.

No analytics services, advertising networks, or social media trackers are used.

When you invoke Shuddhi QA from Microsoft 365 Copilot or any other Model Context Protocol (MCP) client (Claude Desktop, Cursor, Continue, etc.), the following data flows occur:

1. Tool invocation requests — Your MCP client sends a JSON-RPC 2.0 request to our MCP server at https://shuddhiqa-mcp.ramya9-b.workers.dev/mcp. The request includes the tool name (generateTestCases, fetchJiraIssue, pushToADO, listTemplates, detectPlatform), the arguments you provided, and any caller-supplied credentials.

2. What we store from MCP calls — Operational metrics only: request counts, error rates, tool-name frequencies. Retention: 90 days, then aggregated to monthly counts for 12 months. We do not store the text of your requirements, the content of Jira tickets you fetch, the test cases generated for you, or any caller-supplied credentials.

3. What we forward, and to whom — Depending on the tool you invoke, your data is forwarded to:

• generateTestCases → the AI provider you select (Anthropic, Google, Groq, OpenAI, Together AI, or Azure OpenAI). The provider's privacy policy applies.
• fetchJiraIssue → your Jira instance (the URL you provide). We act as a stateless proxy.
• pushToADO → dev.azure.com. We act as a stateless proxy with your supplied PAT.
• listTemplates → no external call. Templates are bundled in the MCP server.
• detectPlatform → our hosted detection endpoint, which forwards to your configured AI provider.

4. Where the MCP server runs — Cloudflare Workers global edge network. Stateless — no database, no persistent storage of customer content. Cloudflare's privacy policy applies to network-level telemetry.

5. Caller-supplied credentials — Jira API tokens, Azure DevOps PATs, and AI provider keys you pass in tool calls are held in memory for the duration of a single request and explicitly discarded before the request completes. They are never logged, persisted, or shared.

6. Data residency for AI provider responses — We do not control the geographic region of most AI provider responses. Organizations with data residency requirements can use the Azure OpenAI provider (live now) — bring your own Azure endpoint and the request is processed in your chosen Azure region — or self-host the Shuddhi QA MCP server (source at github.com/ramya9b/shuddhiqacloud) in their preferred region.

• Browser localStorage — Persists until you clear browser data or click Reset all data in Settings → Usage & Cost.
• Browser sessionStorage — Deleted automatically when you close the browser tab.
• Firestore preferences — Retained as long as your Firebase account exists. Delete via Settings → Usage & Cost → Reset all data (signed in), then revoke access in your Google or Microsoft account settings.
• Firebase Auth account — Exists as long as you have signed in at least once. To delete your account and all associated data, click your avatar → Delete my data & account from inside the app. This permanently deletes your Firestore document, clears all localStorage, and removes your Firebase Auth account.
• Generated test cases — Stored only in browser localStorage (last 20 sessions). Never on servers.
• Server logs — Cloudflare Pages access logs retained up to 30 days. No request body content is logged.

You have the following rights regarding your data:

• Access: Open DevTools → Application → Local Storage / IndexedDB to see all locally stored data.
• Delete local data: Settings → Usage & Cost → Reset all data, or clear browser data for this site.
• Delete Firestore data: Sign in → Settings → Usage & Cost → Reset all data, then sign out.
• Delete Firebase Auth account: Click your avatar → Delete my data & account inside the app. This deletes your Firestore document, clears all shuddhi localStorage keys, and permanently removes your Firebase Auth account.
• Revoke Google Sign-In: myaccount.google.com/permissions → Shuddhi QA → Remove access.
• Revoke Microsoft Sign-In: account.microsoft.com/privacy/app-access → Shuddhi QA → Remove.
• Revoke Google Billing access: Settings → Usage & Cost → Disconnect, or via Google Account permissions.
• Data portability: Export usage data as CSV from Settings → Usage & Cost → Download CSV.

• All network traffic uses HTTPS/TLS encryption.
• API proxy endpoints validate request origins and reject cross-origin requests from non-whitelisted domains.
• OAuth tokens (Google Cloud Billing) are never written to persistent storage or server-side logs.
• Firebase Authentication is managed by Google. Shuddhi QA never sees or stores your Google or Microsoft password.
• The application is deployed on Cloudflare Pages with DDoS protection and WAF.
• Firebase Firestore security rules restrict each user's document to their own Firebase UID only: allow read, write: if request.auth.uid == userId.

The updated date at the top of this page will be updated when this policy changes materially. Since Shuddhi QA collects email addresses only for signed-in users and does not use them for marketing, we cannot proactively notify users. Please check this page periodically.

Continued use of Shuddhi QA after policy changes constitutes acceptance of the updated policy.

For privacy questions, data deletion requests, or concerns:

The free trial gate includes an optional LinkedIn share unlock. Clicking the share button opens LinkedIn's native share dialog in a new tab.

• Shuddhi QA has zero access to your LinkedIn profile, connections, posts or account data.
• No LinkedIn data is collected or stored. The share is entirely client-side.
• Clicking "I've Shared — Unlock" resets your local generation counter only.