Privacy policy
Last updated
QualityLayer keeps tasks, Chats, artifacts, memories and terminal history on machines you control. Your chosen coding agent may send context to its provider under your account and settings. We process licence and trial requests, billing, downloads, updates and reports you choose to send. Older clients may still use the retained services described below during migration.
Who is responsible
Maximilian Ritter, An der kalten Quelle 11, 86825 Bad Wörishofen, Germany, [email protected]. More in the imprint.
Visiting this website
Vercel Inc. (USA) serves the website and our API from Frankfurt. Each request carries your IP address, the page, the time and your browser; Vercel keeps these logs briefly to deliver and protect the service (Art. 6 (1) (f) GDPR). Vercel Web Analytics counts page views without cookies and without identifying you (Art. 6 (1) (f)).
We set only the cookies a function needs: a sign-in cookie for Billing (1 hour) and one while a team owner connects Slack (10 minutes). No tracking or advertising cookies (§ 25 (2) TDDDG).
Licence check and trial
The App checks your licence once a day. It sends your licence key, the activation and a code for this computer to our API, which asks Polar, our licence provider (Art. 6 (1) (b)). For a free trial we keep a one-way keyed hash of the computer’s code and its original trial dates to enforce one trial per computer (Art. 6 (1) (f)). Trial records have no automatic expiry, including after the trial ends. Upstash stores the replacement trial ledger. The App sends no usage events.
Buying and billing
Polar Software, Inc. sells QualityLayer as merchant of record. It processes your payment, invoices and taxes as its own controller, under Polar's privacy policy. To sign you in to Billing, we e-mail you a one-time code through Resend, Inc. (USA); the code is kept for 10 minutes (Art. 6 (1) (b)).
Retained services for older clients
Current local-first clients do not upload task, Chat, artifact or memory content for hosted collaboration. Older clients can still use the services below during the transition. We retain the old-client service and Neon for at least 14 days after both replacement client and backend are available, and until affected users have migrated and the final valid workflow grants and cache allowances have cleared. Some old workflow grants can last 30 days. Retirement requires a separate resource review; elapsed time alone does not authorize deletion. Previously agreed retention and customer rights continue.
Older Team clients can share tasks, plans, comments, artifacts and files. They are encrypted on your computer with your team's key, so we store only ciphertext. To route them we also store your team members' names and e-mail addresses from Polar, task names and steps, who asked whom, who read which version, and each computer's public key (Art. 6 (1) (b)).
Review code travels between your computer and your own Git remote. When an older client uses Ask for review, QualityLayer pushes the task's branch to your team's Git remote, and teammates with access to it read the code there. We store your team's comments on lines of code, the short lines of code they quote (up to 300 characters each) and the repository, branch and commits they point to. All of it is encrypted on your computer with your team's key. Apart from those quoted lines, we never receive the code.
| Service | What it holds | Where |
|---|---|---|
| Neon | The database | Frankfurt |
| Upstash | Short-lived counters and caches | Frankfurt |
| Cloudflare R2 | Encrypted file attachments | EU |
Legacy task records and retained copies are assessed separately during migration and retirement. We do not promise automatic deletion after 30 days while the transition retention applies. Previously agreed deletion obligations and statutory access, deletion and restriction rights remain applicable; this transition does not suspend them. Contact us to exercise those rights.
Older share links
A link's content is sealed with a key that sits after the # in the link and never reaches our server. Links and the comments on them end after 14 days.
Older-client Slack and email
Collaboration notifications over Slack and email are stopped during this transition; pending collaboration notifications are not delivered. Previously enabled delivery sent task titles, questions and participant names through Slack Technologies (USA), or through Resend (USA) to the enabled seat address. Historical connection and notification records may remain while legacy lifecycle purges are frozen. An expiry timestamp alone does not establish that stored text has been physically deleted. The previously stated 72-hour deletion obligation remains applicable; the purge freeze does not extend it or suspend statutory access, deletion or restriction rights.
Product reports and private support
Report bug / idea publishes the title, description, system details and screenshots you approve as a public GitHub issue. Your account name and e-mail are not added automatically. We receive a private e-mail copy through Resend, with licence contact details when available.
Private support sends your message, the diagnostics shown before sending and any attached screenshots to our private GitHub repository and to us through Resend. Contact details are included in the e-mail copy and left out of automatic issue fields.
Feedback screenshots are stored in Cloudflare R2. Private-support screenshot links expire after 90 days. Published screenshot links do not expire automatically. Contact us if a report or image needs removal; copies others already downloaded can remain (Art. 6 (1) (f): handling your report).
Newsletter and videos
When you ask for a video such as the Inside QualityLayer deep dive, we e-mail a confirmation link to your address through Resend. Nothing is stored until you open it; an unconfirmed link expires after 48 hours. Once you confirm, we keep your address, the consent text you agreed to and when you asked and confirmed, send you the video and add you to the QualityLayer newsletter: occasional e-mails about releases, guides and new videos (Art. 6 (1) (a) GDPR). Every e-mail has an unsubscribe link, and you can withdraw consent at any time by writing to [email protected]. We then remove your address from the list and keep only the record of your consent for as long as we may need to prove it.
If you write to us, we use your message to answer it and keep the conversation as long as it is needed (Art. 6 (1) (b) or (f)).
Recipients outside the EU
Vercel, Cloudflare, GitHub, Resend, Slack and Polar may process data in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. Vercel, Neon, Upstash, Cloudflare and Resend process data for us under their data processing agreements. GitHub hosts public reports and private support issues under its own terms. Licence contact details reach us through the private e-mail copy. Polar, as merchant of record, and Slack, in your team's own workspace, are responsible for the data they receive.
Your rights
You can ask for access, correction, deletion, restriction and a copy of your data, and object to processing based on our legitimate interest (Art. 15–21 GDPR). Write to [email protected]. You can also complain to a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach.
We make no automated decisions about you and build no profiles. We update this page when the service changes; the date at the top says when.