Legal

Privacy policy

This policy explains what personal data we process when you use quinq.dev, why, and what rights you have. Last updated: 4 October 2026.

1. Who is responsible

The controller under Art. 4(7) GDPR is:

Frexes, owner Hela Azzabi
Sommerstr. 33b, 13409 Berlin, Germany
Email: [email protected]
Phone: +49 1522 4876021

We are not required to appoint a data protection officer. For any privacy question or request, write to the address above.

2. Visiting this website

When you open this website, your browser automatically sends technical data to our hosting and network providers: IP address, date and time, requested page, referrer, browser and operating system. We need this data to deliver the site and keep it secure (Art. 6(1)(f) GDPR). It is not combined with other data. Details per provider are in section 5.

3. Local storage and cookies

This site stores your light or dark theme and your cookie choice in your browser's local storage. Both are strictly necessary to provide the features you ask for, so they need no consent (§ 25(2) no. 2 TDDDG). They never leave your device.

Analytics cookies are set only if you agree in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time with "Cookie settings" in the footer of every page.

4. Legal bases

  • Consent, Art. 6(1)(a) GDPR: for example analytics cookies or signing up for emails. You can withdraw consent at any time with effect for the future.
  • Contract, Art. 6(1)(b) GDPR: processing needed to sell and deliver what you buy and to support you.
  • Legal obligation, Art. 6(1)(c) GDPR: for example retention duties under tax and commercial law.
  • Legitimate interests, Art. 6(1)(f) GDPR: a secure, working website, measuring reach without tracking individuals, and answering your messages.

5. Services we use

We work with the providers below. Where they process data on our behalf, we have a data processing agreement with them (Art. 28 GDPR). Several are based in the USA. Transfers there rely on the EU-US Data Privacy Framework where the provider is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) otherwise.

Hosting (Vercel)

Hosts the Quinq website and runs its server functions, such as the waitlist sign-up and payment notifications.

  • Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
  • Data: Server log data your browser sends with every request: IP address, date and time, requested URL, referrer, browser and operating system. Plus whatever you submit through a form on this site.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a reliable and secure website. Vercel processes the data on our behalf under a data processing agreement (Art. 28 GDPR).
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Request logs are kept only for Vercel's short log retention period, then deleted.
  • Vercel privacy policy

Content delivery, Web Analytics and email (Cloudflare)

Every request to Quinqpasses through Cloudflare's network, which serves the site quickly and blocks attacks. Cloudflare Web Analytics counts visits, referrers, countries, browsers and page load times without cookies, local storage or fingerprinting, so we see totals, not individuals. Emails you send to our addresses on this domain are routed through Cloudflare Email Routing to our inbox.

  • Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA
  • Data: IP address, request details (URL, time, referrer, browser), security signals; for email: sender and recipient addresses, headers and the message while it is forwarded.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests are a fast, secure site, measuring reach without tracking individuals, and receiving your emails. For emails about a purchase: Art. 6(1)(b) GDPR. Cloudflare acts as our processor under a data processing agreement.
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Request logs are kept only briefly for security purposes. Web Analytics stores aggregated counts only. Forwarded emails are not stored by Cloudflare.
  • Cloudflare privacy policy

Google Analytics 4 (only with your consent)

Shows us how visitors use Quinq: pages viewed, scrolling, outbound links, and which buttons lead to waitlist sign-ups and checkouts, including the campaign (UTM parameters) that brought you here.

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Data: A pseudonymous ID stored in the cookies _ga and _ga_* (kept for up to 2 years), the pages and events above, referrer, device, browser, operating system, screen size, language and approximate location (derived from your IP address, which Google Analytics 4 does not log or store for EU visitors). Google signals and ad personalisation are switched off.
  • Legal basis: Your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google Analytics loads only after you choose "Accept all" or switch on Analytics in the cookie settings. Before that, your browser sends nothing to Google. You can withdraw consent at any time with "Cookie settings" in the site footer: we then delete the cookies and stop the tag. Withdrawal does not affect processing that happened before.
  • Transfer outside the EU: Google may process data via Google LLC in the USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Event data is deleted automatically after 14 months. Cookies expire after at most 2 years, or when you withdraw consent.
  • Google privacy policy

Waitlist

Lets you sign up to hear when Quinq launches and about the founders' price.

  • Data: Your email address, optionally your name, and the time you signed up.
  • Legal basis: Your consent, Art. 6(1)(a) GDPR, given by submitting the form. You can withdraw it at any time through the unsubscribe link in every email or by writing to us. We store the sign-up with Resend and Airtable (see below).
  • Retention: Until you unsubscribe or ask us to delete it, and at the latest when we close the waitlist.

Email delivery (Resend)

Stores waitlist contacts and sends our emails, such as the launch announcement and messages about your purchase.

  • Provider: Plus Five Five, Inc. (Resend), USA
  • Data: Email address, optional name, email content and delivery status.
  • Legal basis: For the waitlist: your consent, Art. 6(1)(a) GDPR. For emails about a purchase: Art. 6(1)(b) GDPR. Resend processes the data on our behalf under a data processing agreement.
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Until you unsubscribe or ask us to delete your contact.
  • Resend privacy policy

Customer and waitlist records (Airtable)

Our internal list of waitlist sign-ups and customers, used to manage licenses and answer support requests.

  • Provider: Formagrid Inc. (Airtable), USA
  • Data: Waitlist: email, optional name, sign-up date. Customers: email, name, product, tier, amount, order status, Polar customer and order IDs, purchase date.
  • Legal basis: For the waitlist: your consent, Art. 6(1)(a) GDPR. For customers: Art. 6(1)(b) GDPR (delivering your license) and Art. 6(1)(f) GDPR (our legitimate interest in support and record keeping). Airtable processes the data on our behalf under a data processing agreement.
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Waitlist entries as described above. Customer records for as long as your license exists and for any statutory retention period that applies.
  • Airtable privacy policy

Checkout and payments (Polar)

Polar is the merchant of record for Quinq: it sells you the license, processes the payment, handles VAT and sales tax, issues your invoice and grants your GitHub repository access. The checkout opens on polar.sh.

  • Provider: Polar Software Inc., 3500 South DuPont Highway, Dover, DE 19901, USA
  • Data: Name, email address, billing address, payment details (handled by Polar's payment processor; we never see your card), VAT ID if you provide one, GitHub username and order details. Polar sends us the order details (email, name, product, amount, order and customer IDs) so we can deliver your access and support you.
  • Legal basis: Art. 6(1)(b) GDPR (performing the purchase contract). Polar processes payment and tax data as its own controller under its privacy policy and its legal obligations.
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Polar keeps order and tax records for the periods required by law. Our copy: see Airtable above.
  • Polar privacy policy

Repository access (GitHub)

Quinq is delivered as a private GitHub repository. After your purchase, your GitHub account receives an invitation to it.

  • Provider: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA
  • Data: Your GitHub username and anything you post in the repository (issues, pull requests, comments). Posts are visible to us and to other customers with access to the repository.
  • Legal basis: Art. 6(1)(b) GDPR (delivering what you bought). GitHub processes your account data as its own controller under its privacy statement.
  • Transfer outside the EU: USA. Covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and by the EU Standard Contractual Clauses otherwise.
  • Retention: Access stays for the lifetime of your license and is removed after a refund.
  • GitHub privacy statement

Feedback board, roadmap and changelog (UserJot)

Our feedback board, roadmap and changelog are hosted by UserJot on a separate site. This website only links to it and sends no data to UserJot.

  • Data: If you open the board, UserJot processes the usual connection data. If you sign in, post or vote, it also processes your name, email address and your posts.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is collecting product feedback and publishing updates. UserJot processes data about board users on our behalf.
  • Retention: Posts stay on the board until you or we delete them. Ask us to delete your account data at any time.
  • UserJot privacy policy

6. How long we keep data

We delete personal data as soon as we no longer need it for the purpose it was collected for, you withdraw your consent, or you successfully object, unless a statutory retention period applies. Accounting and tax records must be kept for up to 10 years (§ 147 AO, § 257 HGB). Specific periods are listed per service in section 5.

7. Your rights

Under the GDPR you have the right to:

  • access the data we hold about you (Art. 15)
  • have incorrect data corrected (Art. 16)
  • have your data deleted (Art. 17)
  • restrict processing (Art. 18)
  • receive your data in a portable format (Art. 20)
  • withdraw consent at any time, for the future (Art. 7(3))

Right to object (Art. 21 GDPR). Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop unless we can show compelling legitimate grounds.

To use any of these rights, email [email protected]. You also have the right to lodge a complaint with a data protection authority (Art. 77 GDPR), for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

8. Do you have to provide data?

No law requires you to give us personal data. Some features can't work without it: for example, we can't email you without your email address, and a purchase can't be completed without checkout details. We do not use automated decision-making or profiling (Art. 22 GDPR).

9. Changes

We update this policy when our services or the law change. The current version is always available on this page.

← Back to the site