Privacy Policy

Last updated: June 1, 2026

This Privacy Policy describes how QuantumFlow ("we", "us", "our") collects, uses, and protects your personal data when you use our application.

1. Data We Collect

Data you provide:

Email — used for registration and authentication
Display name — shown in the interface and workspaces
Password — stored server-side and never displayed back to you

Data collected automatically:

IP address and User-Agent — logged for all requests for security and operational purposes
Session identifier — a random identifier generated per browser tab for session management, not linked to your hardware or device
App activity — creating, editing, and deleting tasks
Session tokens — for authentication (stored in your browser's local storage; see Section 11)

We do NOT collect: racial or ethnic origin, political opinions, religious beliefs, biometric data, health data, or sexual orientation.

2. How We Use Your Data

Purpose	Data Used
Registration and login	Email, password (hash)
App functionality	Display name, task activity
Account security	IP address, User-Agent, session identifier
Server health monitoring	Aggregated, non-personal metrics

3. Legal Basis

Jurisdiction	Basis	Reference
EEA (GDPR)	Performance of a contract	Art. 6(1)(b)
EEA (GDPR)	Consent (confirmed at registration)	Art. 6(1)(a)
EEA (GDPR)	Legitimate interest (security)	Art. 6(1)(f)
Russia	Performance of a contract	Federal Law 152-FZ, Art. 6(1)(5)
Russia	Consent (electronic form)	Federal Law 152-FZ, Art. 6(1)(1)
Belarus	Consent	Law No. 99-Z, Art. 6
Belarus	Performance of a contract	Law No. 99-Z, Art. 9

4. How We Protect Your Data

Passwords — stored server-side; never displayed back to you
Access control — token-based authentication with email verification enforcement
Logging — actions involving personal data are recorded for security purposes; email addresses may appear in server-side security logs
Backups — managed by our hosting provider; data removed from backups within 90 days of account deletion

5. Data Retention

Data	Retention Period	Basis
Account (email, name)	While you use the service + 1 year after last activity	Legitimate interest (account recovery)
Contract data (payment records, subscription status)	Contract period + 5 years	Tax and accounting legislation (Tax Code of the Russian Federation, Art. 23)
Auth and request logs (IP, User-Agent)	1 year	Legitimate interest (security)
Server logs containing email addresses	1 year	Legitimate interest (security)
Consents (date, version, IP)	Account lifetime + 3 years after deletion	Evidentiary basis

6. Third-Party Sharing

Your data is not shared with third parties, except:

Hosting provider — to operate the service
Email service provider (Brevo) — for sending verification emails
With your explicit consent
When required by law

We do not sell personal data with advertising networks, data brokers, or analytics platforms.

7. Cross-Border Transfer

Your data is processed on servers located in the Russian Federation. Data may also be processed in other countries. We ensure protection through:

Jurisdiction	Mechanism
EEA	Standard Contractual Clauses (SCC) or adequacy decision
Russia	Federal Law 152-FZ, Art. 12 — receiving country must ensure adequate protection

8. Your Rights

All users:

Access information about what data we process
Correct inaccurate data
Delete your account and all data
Withdraw consent

For EEA users (additional):

Restrict processing (GDPR Art. 18)
Object to processing (GDPR Art. 21)
Lodge a complaint with a supervisory authority

For users from Russia (additional):

Appeal operator's actions to Roskomnadzor or in court

For users from Belarus (additional):

Appeal operator's actions to the authorized data protection body

9. Account Deletion

You can delete your account in app settings: Account → Delete Account. You will need to enter your password to confirm.

When deleted:

All your data is removed from active databases immediately
Data in backups is removed within 90 days
Data we are legally required to retain is kept for the legally mandated period

Deletion request processing times:

Jurisdiction	Deadline	Basis
EEA	30 days	GDPR Art. 17(1)
Russia	30 days	Federal Law 152-FZ, Art. 21(3)
Belarus	30 days	Law No. 99-Z, Art. 17

Deletion is irreversible.

10. Withdrawing Consent

You may withdraw your consent to personal data processing at any time in settings. Withdrawing consent results in account deletion, as data processing is necessary for the service to function.

Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11. Local Storage and Session Management

We do not use cookies. Session management is handled via secure tokens stored in your browser's local storage:

Storage Key	Purpose	Required
`sys_auth_session`	JWT authentication token for API requests	Yes

Your authentication token is sent with each API request via the Authorization header. This token cannot be disabled — without it the service does not work.

12. Minors

This service is not intended for children under 13 years of age. If you are under 18 years of age (for users in Russia and Belarus) or 16 years of age (for users in the EEA), use of the service indicates that your parent or guardian has reviewed this Policy and consented to the processing of your personal data.

13. Policy Changes

When we update this policy, you will see a notification at login and must confirm your acceptance of the new version. Without confirmation, access to functionality will be limited.

Note: The notification and confirmation mechanism is currently being implemented. Until it is available, policy changes will be communicated via in-app announcements and email.

14. Contact Us

For questions about personal data processing:

Email: privacy@quantumflow.app
Through the "Support" section in the app

Response time — 10 business days (Russia), 30 calendar days (other jurisdictions).

If you are in the EEA and did not receive a satisfactory response, you have the right to contact your country's supervisory authority. If you are in Russia, you may contact Roskomnadzor or the courts.