Privacy Policy

Who We Are & Legal Basis

Data controller. This website and the QNSQY billing/account services are operated by Quantum Sequrity, Inc., a Delaware corporation and the maker of QNSQY. You can reach the people responsible for your data at [email protected]. These services and our Terms are governed by the laws of the State of Delaware, United States.

Legal basis for processing (GDPR Art. 6). Where the EU or UK GDPR applies, we rely on the following bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, license and deliver the software, and process purchases.
• Consent (Art. 6(1)(a)) — for our anonymous website event log and the Sentry error-monitoring SDK, both of which load only after you accept the cookie banner. You can withdraw consent at any time via “Cookie Settings” in the footer.
• Legitimate interests (Art. 6(1)(f)) — to secure our services (e.g. Cloudflare DDoS protection, rate limiting and the sign-in security records described below) and to respond to support requests, balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to retain billing and tax records where required by law.

1. Information We Do NOT Collect

QNSQY is designed with privacy as a core principle. The Software does NOT collect, transmit, or store:

• Your passwords - Passwords are processed locally and never leave your device
• Your encryption keys - Keys are derived locally using Argon2id
• Your data or its contents - All encryption happens on your device
• The names or paths of your files - Usage receipts carry a hash of the file's path, never the path or name itself (section 2 explains what such a hash can reveal)
• Raw device identifiers - The program derives a device ID on your device, one way, from system identifiers and a random value stored on the device. Only that derived ID is sent (see section 2), never the identifiers it is made from
• Your IP address (from the encryption software itself) - Data encryption runs locally. Note: the billing client (login and subscription check-ins) does contact billing.quantumsequrity.com over HTTPS; that request necessarily exposes your IP to our billing server and to Cloudflare (which fronts the billing worker). The website you are reading now is also served through Cloudflare

2. Information We May Collect

We only collect information when you explicitly provide it:

What the QNSQY Program Sends When You Are Signed In

The program never sends your data, its contents, your passwords or your keys. When you are signed in, it sends our billing server the following. At sign-in and at each subscription check-in: the device ID described in section 1, your computer's name as the operating system reports it, and the operating system type (for example linux or windows); we store these with your subscription to apply your plan's device limit. Before a metered operation (one that uses credits): the operation type, the data size, the program version and the algorithms chosen; afterwards, whether it succeeded, the bytes processed and how long it took. For every operation, paid or free, including decrypt and verify: a usage receipt with the operation type, data size, time, result, credits used and a hash of the file's path (in the standard program a BLAKE3 hash). The path itself is not sent, but whoever holds a receipt can check a guessed path against its hash, so a path that is easy to guess, for example one containing a person's name, is not hidden by it. Receipts are linked in a chain so that a removed or altered receipt shows, are kept on your device and are sent in batches; we store them with your account and device ID, without an IP address. We use these records for billing, for your plan's limits and to detect abuse.

Account and Billing Security Records

When you sign in, our billing server records the time, your account and a hash of your email address, the sign-in method and result, and the IP address and browser or app identifier of the request; your active sign-in session stores the same IP address and identifier. When you create an account, we also record where you started it: the QNSQY Academy, another page of this website, the QNSQY program, a purchase, your organization's single sign-on, or our staff. We use this only to count sign-ups. When the QNSQY app checks in for a metered operation, the server records your account, the API key used, the operation type, data size, credits used, the result and the request's IP address. Organization admin actions, and our own staff's admin actions, are recorded with the IP address in audit logs. When you open a customer or restricted document in your dashboard, the server records your account, your organization, the document and its version, the time and a fingerprint (SHA-256) of the copy you received; each copy shows your email address and organization, so a copy that leaks can be traced. No IP address is stored for document openings; a wrong two-factor code entered to open a restricted document is recorded like a failed sign-in step, with your account, the time, the IP address and the browser identifier. Openings of restricted documents also appear in your organization's audit log. To slow down repeated attempts, the IP address is also held for about two minutes in a temporary counter. None of these records contain the data you encrypt, your passwords or your keys. We use them to run billing and to protect accounts: to stop abuse, to slow down repeated sign-in attempts, to email you when a sign-in comes from a new location, and to investigate security incidents; our staff can read them for those purposes. The legal bases are our contract with you (billing) and our legitimate interest in keeping the service secure, so no separate consent is asked. Session records are deleted when you sign out, when you return after the 12-hour sign-in limit, and in any case 30 days after their last use. Our software only adds to the audit records and never edits or deletes them, and they are currently kept without a fixed deletion date. When your account is erased (30 days after you delete it), the IP address is removed from its usage records; sign-in security records are kept.

Website Visits

Our website uses Cloudflare Web Analytics for aggregated traffic patterns. This data does not include personal identifiers.

Website Error Tracking

Our website loads the Sentry JavaScript SDK to capture unhandled errors so we can fix bugs quickly. Sentry receives browser error stack traces, basic session metadata (browser, OS, URL), and a truncated IP address for geolocation. Sentry loads only after you accept the cookie banner (consent), and it is never loaded on the login, account, or admin pages. Sentry is scoped to the public website only; the QNSQY desktop software itself has no Sentry SDK and no analytics. You can also block Sentry with any tracker-blocking browser extension without affecting the encryption functionality of the downloaded software.

Anonymous Event Tracking

To measure how the website performs (which pages load, where the signup flow drops people, how many users reach checkout) we operate our own anonymous event log at analytics.quantumsequrity.com. No third-party analytics provider is involved — the events go to a Cloudflare Worker we run, write to Cloudflare's Workers Analytics Engine, and are deleted after 90 days.

• Anonymous distinct ID — a random UUID is generated locally in your browser the first time you accept this banner and stored in localStorage. It is not derived from your account, email, IP, or any device identifier. Reject the banner or clear site data to wipe it.
• UTM attribution — if you arrive from a link with utm_source/utm_medium/utm_campaign parameters, those values are stored locally for 30 days so we know which traffic source produced an account.
• Page path and event name — e.g. page_view, plan_select, checkout_start. The full list is published in our public tracking plan.
• Country — derived by Cloudflare from your IP at the edge. The IP itself is not stored; it is hashed with a rotating server-side pepper and lives only as a rate-limit dedup key for at most 120 seconds.
• What we do NOT collect: your IP, your user agent (used only as part of the rate-limit hash), referrer URLs from outside our site, mouse movements, scroll depth, session replay, fingerprints.

This event log covers the website only; what the QNSQY program sends when you are signed in is described in section 2. This event log applies to website behaviour only.

Purchases

When you purchase a license, we collect:

• Email address (for license delivery)
• Name (optional)
• Payment information (processed by the Merchant of Record you choose at checkout, Stripe through Link or Lemon Squeezy; we don't store card details)

Waitlist & Contact Forms

If you join our waitlist or contact us, we collect your email address and any information you provide in your message.

Support Requests

If you contact support, we retain your email and the content of your request to assist you.

3. How We Use Collected Information

Information we collect is used only to:

• Deliver your purchased license
• Notify you about product updates (if you opted in)
• Respond to your support requests
• Improve our website (aggregated analytics only)

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Storage & Security

Any data we collect (email addresses, purchase records) is stored securely using industry-standard encryption. We use:

• HTTPS encryption for all website traffic
• Secure cloud infrastructure (Cloudflare)
• Encrypted databases for any stored data

5. Third-Party Services

We use the following third-party services:

Stripe and Link (Payment Processing)

If you choose Stripe at checkout, Stripe is the Merchant of Record and appears as Link (part of Stripe) at checkout, on receipts and on your card statement. Stripe processes the payment and handles sales tax or VAT in the more than 80 countries it covers. We send Stripe your email address and your QNSQY account ID so the purchase is linked to your account. Your payment information is processed according to the Stripe Privacy Policy. We do not store your credit card details.

Lemon Squeezy (Payment Processing)

If you choose Lemon Squeezy at checkout, payment processing is handled by Lemon Squeezy, the Merchant of Record and the authorized reseller of QNSQY subscriptions, which also handles any applicable sales tax or VAT. Your payment information is processed according to their Privacy Policy. We do not store your credit card details.

Resend (Account Emails)

We send account and billing emails (verification codes, sign-in links, password resets, security alerts, invoices and subscription notices) and replies to inquiries through Resend, which processes your email address and the message. See their Privacy Policy.

Google (Sign in with Google)

If you choose Sign in with Google, Google confirms your identity and shares your email address and name with us. See their Privacy Policy.

Cloudflare (Hosting & Security)

Our website and API are hosted on Cloudflare. See their Privacy Policy.

Sentry (Website Error Monitoring)

Our public website loads the Sentry error-monitoring SDK only after you accept the cookie banner. Sentry may process a truncated IP address and browser/error metadata to help us fix bugs. See their Privacy Policy. Sentry is not loaded on login, account, or admin pages, and the desktop software contains no Sentry SDK.

6. Your Rights

You have the right to:

• Access - Request a copy of any personal data we hold about you
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your data ("right to be forgotten")
• Portability - Receive your data in a structured, commonly used, machine-readable format
• Restriction - Request that we restrict processing of your data
• Objection - Object to processing based on our legitimate interests
• Withdraw consent - Withdraw any consent you gave (e.g. analytics or error monitoring) at any time, without affecting processing carried out before withdrawal
• Opt-out - Unsubscribe from marketing emails at any time
• Complain - Lodge a complaint with your local data-protection supervisory authority (e.g. an EU member-state authority or the UK ICO)

To exercise these rights, contact us at [email protected]

7. Cookies

Our website uses minimal cookies:

• Theme preference - Stores your light/dark mode preference (localStorage)
• Cloudflare security - Essential cookies for DDoS protection

We do not use advertising cookies or cross-site tracking. Non-essential storage (our anonymous website event log and the Sentry error-monitoring SDK, which is a third-party processor) loads only after you accept the cookie banner, and you can withdraw consent at any time via “Cookie Settings” in the footer.

8. Children's Privacy

QNSQY is not intended for children under 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

9. International Data Transfers

Our services are operated from India and the United States. If you are accessing our services from the European Union, United Kingdom, or other regions, your information may be transferred to and processed in countries with different data protection laws. Where personal data of EU/EEA or UK residents is transferred outside those regions, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the equivalent transfer mechanisms operated by our sub-processors Cloudflare and Lemon Squeezy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website. Your continued use of the Software after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or concerns:

Email: [email protected]