What QA Tools keeps, and for how long

Every request it captures, exactly as received: method, path, query string, headers and body up to 1 MB.

With each one, its size, time and the sender's IP address.

A session created with the sender's IP turned off keeps no sender IP address; the headers the sender sent are kept as sent.

The answer the session sent back, and the response, response queue and response rules you set up.

A private session keeps a fingerprint of its access key, never the key itself.

Anyone with the session's URL — on its page, through the API or through the MCP server — unless the session is private.

A private session: only someone with its access key. Its URL only sends requests to it.

I can, as the operator. Nobody else: captured requests are never sold or shared.

Session pages are hidden from search engines.

Until you delete it, or until the session goes unused for 7 days; it is then removed within 10 minutes.

Nightly backups keep it up to 3 days longer.

Each night the server records daily totals, kept indefinitely: numbers of sessions, requests and deletions.

Also each day's 20 most frequent User-Agent values, content types and methods.

And its 20 most frequent sender networks: an IPv4 /24 or an IPv6 /48, never a full address, kept 90 days and up to 3 days longer in nightly backups.

No session ids, bodies, paths or query strings.

The server's log records each request's method, URL and time, but not the sender's IP address.

The URL includes the first eight characters of the session id and any query string.

The proxy in front of the server records a sender's IP address in its error log when a connection fails, for example when the sender drops it mid-request. That log stays on the server until the proxy restarts; it is not backed up or sent anywhere.

Limits keep an IP address in memory for up to a minute, or while its connection stays open, and write it nowhere.

No cookies, no ads, and no analytics or other third‑party scripts.

Local storage keeps the sessions you opened, the access keys of your private sessions, which requests you have read, your filters, one panel's state and the interface language you chose.

Only session ids and the access keys of private sessions leave your browser, to open those sessions and check that they still exist.

On a server in Moscow, Russia (FirstVDS), with encrypted backup copies in Yandex Object Storage, also in Russia.

Mail to contact@qa-tools.ru is received by Apple iCloud Mail.

The status page, status.qa-tools.ru, is run by Statuser, a separate service.

Delete a request, all requests or the whole session on its page or through the API.

Or write to contact@qa-tools.ru, and I'll delete a session for you.

Changes that make QA Tools keep more data, keep it longer or share it with anyone new are announced here at least 14 days before they apply, unless the law requires them sooner. Other changes apply when published.

From 2 November 2026, the server's log records the IP address of a sender that sends far more requests than the limits allow, at most once a minute.

From 8 November 2026, mail to the contact address is received by Yandex 360, in Russia, instead of Apple iCloud Mail.

Questions about your data: contact@qa-tools.ru.

Companies can ask for the operator's details, or for a data processing agreement, by email.