Direct answer
TabQA accesses an Android phone the user explicitly authorizes in the browser's WebUSB chooser. ADB credentials, requests, logs, screenshots, video, and text-recognition results are processed locally by default and are not automatically uploaded to TabQA servers.
Device connection and permissions
- The user confirms access in both the browser device chooser and the Android USB debugging prompt.
- The ADB RSA private key is generated and stored in the browser; uninstalling requires authorization again.
- The extension opens no local network port and exposes no arbitrary ADB command input.
- The tabs permission is used only to open, locate, and focus TabQA's own USB authorization page.
How capture data is retained
| Data | Handling |
|---|---|
| Screenshots, video, logs, and reports | Stored in browser IndexedDB, removed after seven days by default, or deleted immediately by the user |
| Raw whole-device log | Deleted after extracting target-app and failure context unless explicitly retained |
| Network requests | Common auth headers and fields containing token, secret, password, session, or auth are masked by default |
| Text recognition | Chinese and English models ship with the extension; images and recognized text stay local |
| Exported files | Leave extension storage only after an explicit copy, download, or export action |
What the user still needs to review
Automatic redaction cannot identify every application-specific field. Full logcat, HAR, screenshots, and video may still include account, device, or test-environment information and should be reviewed before sharing.
This page describes implementation boundaries. The privacy policy is authoritative for data policy and website log retention.