Privacy Policy

Introduction

Qu4zr ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our visual programming platform.

Qu4zr is a place where you build and run things: workspaces, APIs, scheduled jobs and public pages. So this policy covers two different questions — what we hold about you, and what happens to the things you create. The second is the one that surprises people, so it is spelled out rather than summarised.

Information We Collect

Account Information

When you register, or sign in with Google OAuth, we hold:

• Your email address
• Your name, where you or your identity provider supplied one
• A unique identifier from your identity provider, when you use one

User Content

We store the content you create, including:

• Workspaces, blocks, links, zones and the code you write
• Code files, including HTML pages you publish as sites
• API endpoints, domains and their deployments
• Version history of your work
• Data your workflows write to the built-in key-value store

Usage Data

We collect usage metrics to enforce quotas and operate the service:

• Number of workflow executions and scheduled runs
• API endpoint calls
• Workspace and block counts
• AI assistant credits consumed, per run and per model call

Execution Logs

When you turn logging on for a block, we store what that block received, what it returned, anything it printed, and any error — so that you can debug it. Logging is off by default, per block. If your block handles personal data, its logs will contain that data, and you decide whether they exist.

Scheduled jobs additionally keep a short run history — the time, the outcome, the duration and the status code. These rows carry no request or response content, and are deleted after 30 days.

Secrets and the Vault

Secrets you store in a workspace vault — database passwords, API keys, signing keys — are encrypted with a per-workspace key, which is itself encrypted with a master key. They are write-only: once stored, no API and no page will return the value to you or to anyone else. They are decrypted only inside the sandbox, at the moment your code uses them, and are never written to logs.

Because of this, a secret is not part of your workspace document. It is not copied by a commit, is not included when a workspace is published, and is not copied when someone forks your work.

Publishing and the Public Gallery

You may publish a workspace to the public gallery, where it is readable at a public address by anyone, with no account. This is always a deliberate act — nothing is published by default, and nothing is published automatically.

When you publish, the following become public:

• Your blocks, links, zones, code and code files, exactly as committed
• The title, summary, category and licence you chose
• A byline. This is the local part of your account name — the portion before the @ — never your full email address

The following are not published, and are not copied when someone forks your workspace:

• Vault secrets, and the data behind them
• Store data, deployments, domains, API keys, schedules, collaborators and version history

Published code is scanned for credentials before it goes live, and a publish is refused when a likely live key is found. This is a safety net, not a guarantee — you remain responsible for what your code contains.

You can withdraw a publication at any time, which removes it from the gallery. Workspaces others have already forked remain theirs; a fork is a copy taken at the moment it was made, and withdrawing yours does not reach into anyone else's account.

Published pages record a view count. Views are throttled to one per address per day, and the address is hashed with a key that is regenerated when the service restarts. We do not keep a record of who viewed what.

API Endpoints and Sites You Publish

When you deploy an endpoint it is reachable over the internet. You choose whether it requires an API key or is anonymous. Anonymous endpoints — including any HTML page you serve — are public to anybody who knows or guesses the address, and may be indexed by search engines.

You are the controller of the data your endpoints receive. If your workflow collects personal data from visitors, it is your responsibility to tell them so and to have a lawful basis for it. We process that data on your behalf, to run your code and to store what your code asks us to store.

We log the requests reaching your endpoints for operational purposes: rate limiting, abuse prevention, quota accounting and diagnostics.

The AI Assistant

When you use the in-app assistant, your prompt and the parts of your workspace needed to answer it — block code, file contents, endpoint and schedule listings — are sent to the model provider that serves the model you selected. Today that is Anthropic. Vault secret values are never included; only the handles that name them.

We keep a record of each run and each model call: which model, how many tokens, the cost and the duration. This is what your credit balance is computed from.

Some accounts may be granted a model that runs on our own hardware. Where that model is used, the same content is sent to a machine we operate rather than to a third party.

Collaboration

You can share a workspace with other people. Collaborators can see everything in it that their role allows, including code, files, stored data and execution logs. Inviting somebody by email tells them who invited them and which workspace. If the address has no account yet, we retain the invitation until it is claimed or cancelled.

Data Storage and Security

Your data is stored in a PostgreSQL database. Our security measures include:

• HTTPS encryption for all data in transit
• Envelope encryption for vault secrets, decrypted only inside the execution sandbox
• Passwords stored only as salted hashes
• API keys and client secrets stored only as hashes, shown once at creation
• Every request scoped to the authenticated user, through a single authorization check
• User code executed in a sandbox with no filesystem access, no network access to private addresses, and enforced memory, time and request limits
• Regular backups

Cookies

We use cookies for authentication and session management. These are essential cookies required for the service to function. We do not use tracking or advertising cookies, and we run no third-party analytics.

Third-Party Services

We use the following third-party services:

• Google OAuth — optional sign-in
• Stripe — payment processing, if you subscribe to a paid plan. Card details are handled by Stripe and never reach our servers
• Anthropic — the models behind the AI assistant, when you use it
• An email provider — account, invitation and alert email

These services have their own privacy policies governing how they handle data.

Separately, code you write may call any service you choose. Those requests come from our infrastructure, but what they send is determined by you.

Data Retention

We retain your data as long as your account is active. If you delete your account, we will delete your personal data and workspaces within 30 days. Some data may persist in backups for a limited period.

Scheduled-run history is deleted after 30 days. Published workspaces are removed from the gallery when you withdraw them; copies other people forked remain in their accounts.

Your Rights

You have the right to:

• Access your personal data
• Export your workspaces and stored data
• Correct inaccurate information
• Delete your account and associated data
• Request information about how your data is processed
• Object to processing, or ask us to restrict it

To exercise any of these, write to the address below.

Children's Privacy

Qu4zr is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at:
Email: privacy@qu4zr.com