Privacy Policy

1. Scope

This Privacy Policy describes how Quantum Pipes Technologies LLC, a Wyoming limited liability company ("Quantum Pipes," "we," "our," "us"), handles information about you when you visit www.askqp.com, create an AskQP account, download or run the AskQP desktop application, or use the AskQP iPhone app (together, the Service).

AskQP runs on your devices. Your files, your Vault, your conversations, and your audit chain live on your hardware. This Policy explains every path by which information leaves your device, which of those paths reach us, what we receive, what we do with it, and what we never do with it.

Separate written agreements (for example, an enterprise contract, a Business Associate Agreement, or a Data Processing Addendum) govern any commercial relationship you sign with us. Where a written agreement conflicts with this Policy, the written agreement controls for that relationship.

2. The data path

AskQP is local-first. The desktop application and the iPhone app process your work on the device that holds it. By default, nothing you write, ask, or store is sent anywhere. The paths below are the only ways information leaves your device, and each one starts with a choice you make.

What lives on your device

• Your Vault. Documents, notes, voice memos, scans, images, and other files you add to AskQP are stored in AskQP's data folder on your Mac. They are protected by your macOS account and, when it is turned on, by FileVault disk encryption. We recommend FileVault. On the iPhone, the Vault is encrypted by the app as described in Section 3.
• Your conversations and outputs. The full history of prompts and generated work lives on your device.
• Your Capsule audit chain. AI answers and actions are sealed into a tamper-evident, cryptographically signed record on your device.
• Local AI. With a local model, answers are generated on your device and your prompt never leaves it.

Paths you choose

• A cloud model. If you add your own key for a cloud AI provider, AskQP may send a request, including the relevant context from your Vault, to that provider. Each Space has a model policy. A Space set to local only never uses a cloud model. The provider handles that request under its own terms, with your account, and we are not a party to it.
• Web search and research. When you ask AskQP to search the web or research a question, your question and the public pages it reads go to the search and AI services configured for research. In a Space set to local only, research uses local models, and the search itself still goes to the web.
• Connected accounts. If you connect an account such as your email, calendar, or Zoom, AskQP reads from that service directly to your device. To complete a Zoom connection, the sign-in passes through our sign-in broker at auth.askqp.com, which exchanges the authorization code with Zoom and hands the resulting credentials to your device. The broker keeps that sign-in session for at most ten minutes and then deletes it. Nothing you read or write through a connected account passes through us.
• Shared Spaces. If you share a Space with another person or another of your devices through the AskQP relay at sync.askqp.com, each file is encrypted on your device before it is uploaded, with keys held only by the Space's members. The relay stores and forwards that encrypted data. We cannot read file contents or names. We can see which Space and which member account used the relay, how many files it holds and how large each one is, when they changed, and the IP address of each request.
• A hub you run yourself. You or your organization can connect AskQP to a hub hosted on your own infrastructure. Data you send to your own hub goes directly from your device to a server you control, never through Quantum Pipes infrastructure.
• Updates and models. The desktop application checks dl.askqp.com for updates, which shares your IP address and the time of the check with our hosting provider. AI model files download from the registry of the model runtime you use. Neither carries any of your work.

3. The AskQP iPhone app

The AskQP iPhone app collects no data. Its App Store privacy label reads "Data Not Collected," and that describes what the software does. The app has no account, no sign-in, no analytics code, no advertising code, and no tracking. It sends nothing to Quantum Pipes.

• Permissions. The microphone, speech recognition, camera, Face ID, and local network permissions serve features that run on your iPhone: voice memos and their transcripts, document scans, unlocking your vault, and reaching a hub you name. Transcription and text recognition happen on the device.
• Your vault. Everything you capture is encrypted on the device with keys protected by the Secure Enclave, and your files are excluded from backups. Erase this device, in Settings, destroys the keys.
• Siri and Shortcuts. When you ask Siri to open AskQP, Apple processes that request under Apple's privacy policy. AskQP answers inside the app, never in Siri. Siri can see a document's title only while your iPhone is unlocked.
• The Share sheet. Text, a page, or a link you share to AskQP is written to the app's encrypted storage on your iPhone. It is not uploaded.
• Downloads. Some on-device features, such as the reading voice and on-device search, download their files from Apple through the App Store. Those downloads carry nothing of yours.
• Notifications. Push notifications are offered only when you connect a hub. If you accept, your iPhone registers with Apple's push service and sends the resulting token to your own hub, not to us.
• Crash reports. If you choose in iOS Settings to share analytics with app developers, Apple may provide us with crash reports. That sharing is Apple's, is governed by Apple's privacy policy, and is off unless you turn it on.

4. Information we collect

The information below comes from the website and from AskQP accounts. None of it comes from the iPhone app.

Account information

• Email address. You provide it to receive a magic-link sign-in and your download link, to reserve early access, and so we can reply to you. An early-access reservation also records the optional note you write about how you would use AskQP.
• Magic-link tokens. Single-use, short-lived tokens issued for sign-in. Tokens expire quickly and are deleted on use.

Information you give us directly

• Email correspondence. When you write to wecare@quantumpipes.com or hello@quantumpipes.com, we receive whatever you send so we can respond.

Information collected automatically

• Edge request logs. Our hosting provider, Cloudflare, Inc., processes routine network metadata for every request to the website: IP address, user-agent string, requested URL, response status, and approximate timing. This is standard CDN telemetry used to deliver pages, mitigate abuse, and keep the Service online.
• Privacy-respecting analytics (when enabled). On the website we may use Cloudflare Web Analytics, which records aggregate page metrics without setting cookies, fingerprinting browsers, or identifying individual visitors.

Cookies

The website uses one application cookie: __Host-session, set on the askqp.com domain after you complete a magic-link sign-in. It is HttpOnly, Secure, SameSite=Lax, scoped to the askqp.com host, and contains an opaque session identifier with no personal data. It expires when your session ends.

Cloudflare may set short-lived strictly-necessary cookies (for example, __cf_bm for bot management or _cfuvid for rate limiting) when its security features are active. These cookies do not contain personal information, are not used for advertising or cross-site tracking, and expire on a short timeline.

We set no advertising cookies, no cross-site tracking cookies, and no marketing-automation pixels.

5. What we do not do

• We do not sell or rent your information to anyone.
• We do not share your information with data brokers or advertisers.
• We do not load third-party advertising or marketing-automation scripts.
• We do not receive your prompts, your Vault contents, or your generated outputs. They are processed on your devices, or by a provider you choose as described in Section 2. Shared Spaces reach our relay only in encrypted form.
• We do not put analytics, advertising, or tracking code in the desktop application or the iPhone app.
• We do not perform browser fingerprinting on the website.
• We do not use session-recording, replay, or heatmap tools.
• We do not engage in cross-site tracking of any kind.

6. AI training and model improvement

We do not use your prompts, your Vault contents, or your generated outputs to train any AI model, ours or any third party's.

This follows from how AskQP is built: models run on your devices, and your work never reaches us in readable form, so there is nothing for a training pipeline to read. If you connect a cloud AI provider, that provider's own terms govern whether it trains on what you send it. Check them before you add a key.

If we ever introduce an opt-in evaluation or feedback program (for example, a "rate this output" feature that asks you to submit a specific prompt and response for quality review), participation will be explicit, per-submission, and revocable. We will not enroll you in such a program by default.

7. Sub-processors

We engage a small set of vendors to operate the website and accounts. Each is contractually bound to handle data on our behalf only.

Apple distributes the iPhone app through the App Store and provides the platform services described in Section 3. Apple acts under its own privacy policy, not as our sub-processor.

We update this list when it changes. Material additions are reflected here with an updated effective date and announced to account holders by email at least thirty (30) days before they take effect, except where the addition is required for security or fraud prevention.

8. Healthcare and HIPAA

Quantum Pipes is not a Covered Entity under the U.S. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Because AskQP processes your work on your devices, information in your Vault, including any Protected Health Information ("PHI"), is not transmitted to us in readable form. If you use a cloud AI provider or a connected account with PHI, your agreement with that provider governs it. The standard AskQP account does not establish a Business Associate relationship.

For qualifying enterprise customers who need a Business Associate Agreement or a dedicated deployment configuration, contact hello@quantumpipes.com. Do not send PHI to us by email.

9. Legal bases (EU/UK visitors)

If the EU or UK General Data Protection Regulation applies to you, we rely on the following legal bases:

• Performance of a contract. Operating your account, signing you in, and delivering your download.
• Legitimate interests. Securing the Service, preventing abuse, and operating it reliably. Our interest is keeping the Service available and trustworthy, balanced against your reasonable expectations.
• Consent. Early-access reservations and any optional feature that requires explicit opt-in.
• Legal obligation. Tax, accounting, fraud prevention, and responses to lawful process.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to the processing of personal information about you. We honor these rights for all users, regardless of jurisdiction.

To exercise any right, email wecare@quantumpipes.com with the subject line "Privacy Request." We verify your request and respond within thirty (30) days, or sooner where the law requires.

California (CCPA / CPRA)

In the past twelve months we have collected the categories of information described in Section 4: identifiers (email and IP address), internet activity (request logs), and the contents of communications you initiate. We do not sell or share personal information as those terms are defined under California law and have not done so in the past twelve months. We do not use sensitive personal information for purposes that trigger a right to limit.

You may submit "Right to Know," "Right to Delete," "Right to Correct," and opt-out requests to wecare@quantumpipes.com. We will not discriminate against you for exercising any right.

Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Florida, and other state frameworks

Residents of states with comprehensive privacy laws (including VCDPA, CPA, CTDPA, UCPA, OCPA, TDPSA, FDBR, and analogous frameworks in Indiana, Iowa, Tennessee, Montana, Delaware, New Hampshire, New Jersey, Kentucky, and others as enacted) have rights to access, correct, delete, and obtain a portable copy of personal information; to opt out of targeted advertising, sale, and certain profiling; and to appeal a denied request. Use the same email address above to exercise these rights.

EU, UK, and Switzerland (GDPR / UK GDPR)

You have rights to access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and to lodge a complaint with your supervisory authority. We prefer that you contact us first so we can resolve the issue directly.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We will ask for written proof of authorization and, where required, may also verify directly with you.

11. International transfers

Our infrastructure is operated primarily in the United States. Cloudflare's edge network is global, which means a request to the website may be served from a data center outside your country. Where the GDPR applies, we rely on Standard Contractual Clauses and supplementary measures with each sub-processor for international transfers.

The Service is offered from the United States and is not actively targeted to residents of the European Economic Area, the United Kingdom, or Switzerland. We have not appointed an Article 27 representative under the GDPR. If you access the Service from those regions, you do so at your own initiative and are responsible for ensuring that your use complies with local law. EU/UK/Swiss residents retain the rights described in Section 10 and may exercise them by contacting wecare@quantumpipes.com.

12. Retention

• Account information. Retained while your account is active. On account deletion, deleted within thirty (30) days, except where retention is required by law, audit obligations, or fraud prevention.
• Early-access reservations. Retained until downloads open and we have told you, or until you ask us to delete your reservation.
• Magic-link tokens. Single-use; expire and are deleted within minutes of issue.
• Edge request logs. Retained by Cloudflare under their default retention policy.
• Email correspondence. Retained for as long as needed to address your inquiry plus a reasonable archival period.

13. Security

AskQP authenticates website accounts with magic-link sign-in, not passwords. Sign-in tokens are single-use, short-lived, and generated from a cryptographically secure random source. Sessions ride on __Host-prefixed, HttpOnly, Secure first-party cookies containing only an opaque session identifier. The desktop sidecar binds to loopback only and fails closed. The iPhone app keeps its keys in the Secure Enclave and unlocks your vault with Face ID.

The Service uses modern cryptography throughout: AES-256-GCM for symmetric encryption, SHA3-256 for hashing, Ed25519 and ML-DSA-65 for signatures (a dual classical and post-quantum scheme so the audit chain remains verifiable after large-scale quantum computing is practical), and X25519 and ML-KEM-768 for key exchange. The cryptographic posture claims here describe what the supported configuration permits; see the forward-looking-statements note in the Terms of Service.

No Internet service can guarantee perfect security. If you discover a vulnerability, please follow our Vulnerability Disclosure Policy: email hello@quantumpipes.com with the subject line "Security: ASKQP <short description>." Good-faith research within the policy's scope is covered by an explicit safe harbor.

14. Do Not Track and Global Privacy Control

Because the website does not engage in cross-site tracking and the Service sets no advertising cookies, browser signals such as Do Not Track (DNT) and Global Privacy Control (GPC) have no third-party tracking to suppress. We do not change behavior based on those signals because we do not engage in the conduct they are designed to prevent.

15. Children

AskQP accounts are intended for adults. We do not knowingly collect personal information from anyone under eighteen (18) years of age, and consistent with the Children's Online Privacy Protection Act ("COPPA"), we do not knowingly collect personal information from children under thirteen (13). The iPhone app collects no personal information from anyone. If you believe a minor has provided information to us, contact wecare@quantumpipes.com and we will delete it.

We do not subject any user to decisions based solely on automated processing that produce legal or similarly significant effects (GDPR Article 22). California residents may also request, under California Civil Code § 1798.83 ("Shine the Light"), a list of any third parties to whom we disclosed personal information for those parties' direct marketing in the past calendar year. We do not engage in such disclosures.

16. Changes to this policy

We may update this Policy as the Service evolves. The "Last updated" date at the top reflects the most recent material change. For substantive changes, we will publish a notice on the website and, for account holders, by email at least thirty (30) days before the change takes effect.

17. Contact

Quantum Pipes Technologies LLC
30 N Gould St, Ste N
Sheridan, WY 82801, USA
General: hello@quantumpipes.com
Support and privacy requests: wecare@quantumpipes.com (subject line "Privacy Request")