Privacy Policy

1. Who we are

Qwox is provided by QWOX LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, New Mexico 87110, USA (“Qwox”, “we”). We are the controller of the personal data described here. For anything about your data, write to hey@qwox.ai.

This policy covers the Qwox apps (web, Android, iOS) and this website. It applies wherever you live; the sections on your rights explain what the GDPR, UK GDPR, Turkey’s KVKK and California law add.

2. What we collect

• Account: your email address; if you sign in with Google, your name, email, profile photo and the sign-in tokens Google gives us.
• Your content: what you write or send to Qwox, the records it keeps from it, their earlier versions, your chat history and the record types it sets up for you.
• Photos: resized on your device with location and camera data removed, read by the assistant into your records, and not stored. Text read from a photo can become part of a record.
• Settings: language, time zone and country or region from your device, notification preferences, and a push token if you allow notifications.
• Sign-in and security: one-time sign-in codes (stored only as a hash), and for each session your IP address and browser or device type. Bot checks on the web send your IP address to Cloudflare Turnstile.
• Usage: how many messages you send and what they cost us to process, and simple product events (for example “opened the app”) tied to a random session ID. We use no third-party analytics or advertising SDKs.
• Payments: your plan, its status and dates. Card details go directly to Stripe, Apple or Google; we never see your card number.
• Support: the messages you send to hey@qwox.ai.

3. How we use it, and why we may

We use personal data only for these purposes, each with its legal basis under the GDPR and KVKK:

• To provide Qwox: keep, search and organize your records, run the assistant, write the morning list, send the sign-in code and the reminders you turn on, and apply your plan (performance of our contract with you).
• To keep Qwox safe: prevent abuse, fraud and overload, and secure accounts (our legitimate interest in a secure service).
• To improve Qwox: measure cost and reliability from usage records and de-identified product events (our legitimate interest; we do not read your records for this).
• To send notifications: only if you allow them on your device (your consent, which you can withdraw in your device settings).
• To meet legal duties: keep billing and tax records and answer lawful requests (legal obligation).

4. How the AI works

When you write to Qwox, our server sends your message, the parts of your records it needs, your name as you want to be addressed, your local time and language to Claude, a model made by Anthropic, and stores the answer in your records. Your device never calls the model directly, and we do not send your email address or account ID to Anthropic.

Anthropic processes this data for us as a service provider under its commercial terms: it does not use it to train its models and deletes it after a limited period, except where it must keep it longer to enforce its usage policy or the law.

The assistant organizes your own notes. It does not make decisions about you that have legal or similarly significant effects.

5. Who we share it with

We do not sell personal data and do not share it for cross-context behavioral advertising. We share it only with service providers that run Qwox for us, under contracts that limit them to that work:

• Cloudflare: hosting, database, sign-in emails and bot checks (Turnstile).
• Anthropic: the assistant (Claude).
• Stripe: web payments. Apple and Google: in-app payments, and Google sign-in if you use it.
• RevenueCat: keeps your plan the same on every device (it receives an account ID, not your email).
• Expo: delivers push notifications to your phone (it receives a push token and the notification text, which contains only counts).
• Microsoft 365: our support inbox.

6. International transfers

We are based in the United States and our providers process data in the US and other countries. When personal data from the EU, UK, Switzerland or Turkey leaves those regions, we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum), the EU–US Data Privacy Framework where a provider is certified, and for Turkey the safeguards required by KVKK article 9.

7. How long we keep it

• Your account, records, versions and chat history: until you delete your account. A record you delete leaves your lists but stays in its history until then, so you can see what changed.
• After you delete your account: everything on it is removed from our live systems right away and from backups within 30 days. Usage and product-event records are kept only without your account ID.
• Using Qwox without an account: guest data is deleted after 30 days without activity.
• Sign-in codes: valid for 5 minutes; deleted when used or within 24 hours.
• Sessions with IP address and device type: until 30 days after the session was last used.
• Security and rate-limit records with IP addresses: up to 24 hours.
• Usage and cost records: up to 24 months.
• Billing records: as long as tax and accounting law requires, usually 7 years.
• Support emails: up to 3 years after our last exchange.

8. Security

Data is encrypted in transit, sign-in codes are stored only as hashes, the AI key and other secrets stay on our server, and every database query is limited to the signed-in account. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

9. Your rights

Everyone can download all their records as one file from Account, correct them in the app, and delete their account from Account at any time. Deleting your account does not cancel a subscription bought in the App Store or Google Play; cancel it there first.

EU, UK and Switzerland: you can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can also complain to your local data protection authority.

Turkey (KVKK article 11): you can learn whether your data is processed, ask for information, correction or deletion, learn the third parties it is transferred to, object to results of automated analysis, and claim compensation. You can also apply to the Personal Data Protection Authority (KVKK Kurulu).

California and other US states: you can know what we collect, ask us to delete or correct it, and opt out of sale or sharing, which we do not do. We will not treat you differently for using these rights. An authorized agent can ask for you.

To use a right, write to hey@qwox.ai from your account email. We answer within 30 days (45 where California law allows) and may ask you to confirm your identity.

10. Cookies and similar technology

This website sets no cookies and uses no trackers. The Qwox app uses one essential sign-in cookie (valid for 30 days, renewed as you use it) and stores your app preferences, such as language, in your browser or device. Cloudflare Turnstile may use its own technology to tell people from bots. We use no advertising or analytics cookies, so there is nothing to consent to.

11. Children

Qwox is not for anyone under 16. We do not knowingly collect their data; if we learn we have, we delete it.

12. Changes

If we change this policy in a way that matters, we will tell you in the app or by email at least 30 days before it takes effect. The date at the top shows the latest version.

13. Contact

hey@qwox.ai · QWOX LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, New Mexico 87110, USA