Privacy Policy

Controller

The controller of the data processed in the Qubit service (the mobile apps and qubit.qcomply.tech) is QComply AG, Zurich, Switzerland. Contact: qubit@qcomply.tech.

What the server cannot see

The content of messages, photos, videos, voice messages, conversation and group names, profile photos and group photos is encrypted on your device (AES-256-GCM) with a key that never leaves the devices of the people in the conversation. The server stores ciphertext only and has no way to read it. We do not collect your phone number, address book or location.

Your account

A generated nickname, a bcrypt hash of your password, an optional sign-in name if you set one, and an optional recovery email address if you add one. For each session: a device label, the app identifier (user agent), and when it was created and last used. Like any internet service, the server sees the IP address you connect from; it is used to limit abuse and is not stored with your account.

Conversations and groups

For a one-to-one conversation: both sides’ pairing codes, the name you give the conversation (encrypted by the apps from iOS 2.4 and Android 2.6; earlier versions send it readable), your keep-history setting, and whether you archived or muted it. For a group: who is a member, a random member handle, when each member joined or left, whether they archived or muted it, and each member’s vote to keep the group’s history (other members only ever see whether everyone agrees); the group’s name, its photo (which any member may change) and members’ names are encrypted, and the server records only when the photo last changed, not who changed it. Unlike one-to-one conversations, the server knows which accounts belong to the same group — it could not authorise access otherwise.

Message metadata

For each message: sender and recipient (as pairing codes or group member handles, not account numbers), its kind, when it was sent to the second, its size, and when the recipient’s device collected it — used for the delivery tick and to start the retention period. For photos and videos also their dimensions and duration; for voice messages their duration.

Notifications

If you allow notifications, we store your device’s Apple (APNs) or Google (FCM) push token and the sound you chose. Notifications carry no content, sender or conversation name — only that a new message arrived. The token is passed only to Apple or Google to deliver the notification. You can turn notifications off in the app (Profile, Notifications); the server then deletes the token. Archived and muted conversations send no notifications. For an iPhone, we also store whether the token came from a test or a store build of the app, to send it to the right Apple service.

Subscriptions

If you buy Qubit Pro, we store the store’s transaction identifier, the subscription status and its expiry. Payment is handled by the App Store or Google Play; we never receive card details.

Reports, blocks and support

Abuse reports (reason, description and the message referred to), your blocks, and the text of messages you send through the support form. A report does not reveal message content to our moderators — it is encrypted.

Retention

A message is deleted from the server 90 days after the recipient’s device collects it (in a group, once every current member has), unless both sides of the conversation choose to keep history. A message nobody has collected is not deleted. Deleting your account immediately removes the account, your conversations, both sides’ messages, your group memberships with the messages you sent in them, your sessions and device tokens. We keep no backups from which deleted data could be restored.

Processors

Apple and Google, to deliver notifications and to process store payments; the hosting provider that runs our servers. We do not sell data, and we do not use it for advertising or profiling.

Your rights

You have the right to access, rectify, erase, restrict and port your data, and to complain to a supervisory authority. You can delete your account and its data yourself in the app. For anything else, write to qubit@qcomply.tech.

Changes

We will announce material changes to this policy in the app or on this page before they take effect.