Privacy Policy

This Privacy Policy explains how Qiu Technologies LLC ("we," "us," or "our") collects, uses, and shares information when you use Q Chat: Connect, Help, Belong (Package ID: com.q.qchat), including version 2.0.0 and later releases and associated websites and services (collectively, the "App").

1. Eligibility & Child Safety

The App is intended for people 16 years and older. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 is using the App or that we have collected information about a child under 16, please email support@qiutechnologies.com so we can take appropriate action.

2. Information We Collect

2.1 Account and Profile

• Authentication data (Google Sign-In or email-based login).
• Profile details: display name/username, avatar, country, gender, date of birth, and optional "About Me" text.
• Your selected purpose for using Q Chat (friends, communities, business, or local buy/sell), interests, matching preferences, and verification or safety eligibility state.
• Visibility settings for date of birth/age/zodiac, country, gender, and avatar.

2.2 App Activity and Content

Version 2.0.0 launches as a text-only open beta. Images, GIFs, audio, video, documents, executables, and arbitrary attachments are not accepted in beta rooms.

• Text messages, fixed intent-room membership, device identifiers generated by Q Chat, block lists, reports, and relay metadata such as sender account, event ID, sequence, and timestamps.
• Temporary relay: beta messages are encrypted on the device before ciphertext is stored in a temporary Supabase relay for about 24 hours. Q Chat and Supabase can access the server-readable room key, so this beta is not end-to-end encrypted.
• Safety checks: outgoing text is checked by the temporary Supabase Edge moderation function and on-device rules before encryption. Received text is checked again on-device before display. Automated and local checks can miss harmful content.
• Reports and blocks: you can long-press a received message to report its sender or block that account. Plaintext report evidence is off by default; it is included only when you explicitly enable that option. Report category, optional details, target identifiers, and any evidence you choose to include are stored privately for safety handling.
• Leaving a room stops future relay access for that device but cannot erase text already cached on another participant's device. Room membership has no automatic expiry during this beta.

2.3 Referrals, Contributions, and Product Analytics

• Your referral code and invite link; the code claimed by a referred account; accepted and activated referral counts; reward milestones; and timestamps needed to prevent duplicate or fraudulent rewards.
• If you opt in to the referral leaderboard, your pseudonymous username, rank, and activated-referral count. You can opt out at any time.
• Contribution signals used for disclosed rewards, such as an upheld reviewed report, a post reaching a quality threshold, or a healthy hosted-room day. Store ratings and reviews are not reward eligibility signals.
• Limited product events such as first intent, first match, first and third message, return intervals, invitations, referrals, Q Coins earned or spent, and first or repeat purchase. We do not place message text in these product-event records.

2.4 Q Coins and Virtual Currency

• Current Q Coin balance and per-coin chat usage balance.
• Daily check-in timestamps, streak count, and reward amounts.
• Chat consumption events, contribution and referral rewards, milestone awards, gifts, cosmetics, boosts, and other append-only ledger entries needed to keep the balance accurate and auditable.

2.5 In-App Purchase and Transaction Data

In-app purchases are processed through Google Play Billing. When you make a purchase, we receive:

• Google Play purchase token and product ID for verification and fulfilment.
• App package name (for purchase verification).
• Transaction state (purchased, pending, refunded, or error) for delivery, correction, and recovery.
• For one-time passes, the pass family, effect, start time, and expiration time. Q Chat passes are not auto-renewing subscriptions.

We do not collect or store your payment card details, Google account payment information, or billing address — these remain with Google Play.

2.6 Device & Technical Data

• Crash and error logs, app version, operating-system and device information, performance diagnostics, and release-only Firebase Analytics events used to operate and improve the App.
• App-instance, integrity, push-notification, and purchase-verification identifiers needed for Play Integrity, Firebase services, secure delivery, fraud prevention, and transaction fulfilment.
• Firebase Analytics may collect the resettable Android Advertising ID for user analytics when it is available under the device's settings. We do not display third-party ads or use personal information for cross-context behavioral advertising.

2.7 Permissions

• Notifications (optional) — to alert you to messages, events, and daily reward reminders.
• Camera/Photos (optional) — for avatar or profile image functionality.

3. How We Use Information

• Operate, maintain, and improve the App (authentication, text messaging, moderation, reporting, blocking, and troubleshooting).
• Provide intent-first matching, explain why a match was suggested, and operate daily discovery and community surfaces.
• Administer Q Coins: maintain accurate coin balances, process in-app purchases, verify Google Play transactions, and recover interrupted purchases.
• Administer deterministic rewards for check-ins, activated referrals, disclosed milestones, and eligible community contributions.
• Provide one-time Flow, Signal, and Creator passes, apply their disclosed effects, and end those effects when a pass expires.
• Enforce chat limits based on server-configured chats-per-coin restrictions.
• Protect the App and our users (abuse prevention, anti-spam and anti-fraud safeguards, integrity checks).
• Keep communication welcoming across religion, nationality, race, ethnicity, caste, disability, sex, gender, sexual orientation, age, and other protected characteristics while allowing respectful discussion and disagreement.
• Apply the same universal halal conduct and commerce policy to Muslim and non-Muslim members without asking for, inferring, or profiling religion. This includes moderation of sexual solicitation, gambling promotion, intoxicant trade, predatory interest-bearing lending, and religious coercion while preserving education and recovery discussion.
• Enforce our Terms of Service and Published Standards.
• Communicate with you about updates, security alerts, purchase confirmations, and policy changes.

Where the GDPR applies, we process account, messaging, purchase, safety, and support information as necessary to perform our contract with you; to comply with legal obligations; and for legitimate interests such as service security, fraud prevention, moderation, and product reliability. We ask for consent where required, including for optional device permissions. You may withdraw consent, but withdrawal does not affect earlier lawful processing and may require account deletion when the processing is necessary to operate Q Chat.

4. Sharing of Information

• People you interact with: We transmit your messages and basic profile info as needed to deliver communications within the App.
• Google LLC (Google Play Billing): In-app purchases are processed by Google Play. Google receives your payment information and provides us with purchase tokens for verification.
• Supabase: Supabase provides beta authentication, database, relay, reporting, and Edge moderation services. Outgoing plaintext is processed by the Edge moderation function before encryption; relay storage receives ciphertext plus delivery metadata, while the room key remains server-readable.
• Firebase and Google: Firebase services and Google may process limited data for Google Sign-In, app integrity, analytics, crash reporting, remote configuration, push notifications, Google Play distribution, and purchase verification where enabled.
• Later safety providers: Thorn, Hive, Gemini, and other external safety-vendor processing are not enabled for this text-only beta. We will update this Policy before enabling a new provider. Suspected CSAM images are not sent to an LLM; image uploads are disabled in this beta.
• Legal & safety: We may disclose information to comply with law or protect users and the public, including reporting suspected CSAM/CSAE to competent authorities.

We do not sell personal information for money. We also do not use personal information for cross-context behavioral advertising. California residents may still record a “Do Not Sell or Share” preference in Settings → Privacy & account; we honor it for any future integration that could qualify as sale, sharing, or targeted advertising.

5. Data Retention

We retain personal information only as long as necessary to provide the App, comply with legal obligations, resolve disputes, and enforce agreements. Beta relay messages expire after about 24 hours unless removed sooner. In-app account deletion immediately removes the active Supabase Auth account, beta profile, device bindings, room memberships, blocks, and that account's relay envelopes. Safety reports and review audit records may be retained for up to 365 days. Safety evidence may be preserved when required by law or legal hold. Copies already cached on another participant's device remain outside our control. Backups expire under the service provider's backup lifecycle rather than being altered individually. Purchase, tax, refund, and fraud-prevention ledgers may be retained for up to 7 years when those systems apply.

6. Your Choices & Rights

• Request access to and a portable copy of personal information from Settings → Privacy & account.
• Request correction of inaccurate profile information and contact support for other corrections.
• Object to or request restriction of certain processing where applicable.
• Withdraw recorded privacy consent and review consent history in the App.
• Opt out of sale, sharing, and targeted advertising and receive equal service without retaliation, subject to features reasonably connected to the data.
• Choose whether your pseudonymous profile appears on the referral leaderboard.
• Access and edit your profile and privacy settings within the App.
• Delete your account from in-app settings or by emailing support@qiutechnologies.com. Deletion is permanent and forfeits any remaining Q Coin balance. See our account deletion instructions.
• Block and/or report other users, and control your profile visibility (hide DOB/age/zodiac, country, gender, or avatar).
• For in-app purchase refunds, submit requests directly through the Google Play refund process. For purchase delivery issues, contact us.

We may need to verify that a requester controls the account. Authorized agents may submit California requests through the contact details below, with proof of authorization. We normally respond within the period required by applicable law. You may appeal a denied request through support and may lodge a complaint with your local data-protection authority.

7. Security

We use technical and organizational safeguards appropriate to the risk, including transport security, authenticated relay access, row-level authorization, bounded queues, rate limits, device-side encryption, and integrity checks. The temporary Supabase relay is not end-to-end encrypted because its room key is server-readable. No system is perfectly secure; please share responsibly.

8. International Transfers

Your data may be processed in countries other than your own. Where required, we implement safeguards consistent with applicable laws.

9. Changes to This Policy

We may update this Policy. If changes are material — including changes to how purchase or Q Coin data is collected or used — we will provide notice within the App or by other appropriate means. Continued use after the effective date means you accept the revised Policy.

10. Contact Us

© 2026 Qiu Technologies LLC. All rights reserved.