# Privacy

Quivvo is run by Altria LLC ("we"). This page says what we collect when you use tryquivvo.com, the Quivvo CLI, the REST API and the MCP server, why we collect it, and who else handles it.

## What do we collect?

- **Your account:** your email address. If you sign in with GitHub or Google, the account ID and email address they send us. We never see a password.
- **Your workspace:** your machines, snapshots, API keys (stored only as a hash), your place in the queue and how many people joined with your invite link, your plan, your credit and usage per machine and day.
- **What you run:** commands sent through the API and their output, kept up to a size limit per machine and deleted with the machine, plus setup scripts and published ports. The files on a machine's disk are yours. We don't look at them unless running or protecting the service needs it, or the law requires it.
- **Payments:** Stripe handles them. We keep the Stripe customer ID and what was paid, never card numbers.
- **Technical data:** IP addresses and request details in server logs. For rate limits we store a hash of the IP address, not the address itself. We count how often the Markdown docs are read by kind of client, such as "browser" or "claudebot", and nothing about who read them.
- **Visits to tryquivvo.com,** counted by us, with no cookies and no third party: the page, the site that linked to it, the campaign tags in the link (such as `utm_source`), the country and whether it's a phone or a computer. A visitor is a hash of the IP address, the browser and the day, salted with a secret, so it changes every day and can't be turned back into either. The IP address isn't stored. When you sign up, we note which visit brought you. The dashboard isn't counted, and neither is a browser that sends Global Privacy Control.
- **Invites:** when we invite someone to skip the queue, their email address, to send the invite and let them in when they sign up with it.
- **Problem reports** that you or your agent send us.

## Why do we collect it?

To run the service and sign you in, to bill you, to see which pages and links bring people to Quivvo, to run the queue, to stop abuse (the welcome credit is once per mailbox, for example), to send service emails (sign-in links, "it's your turn", warnings before an abandoned machine is deleted) and to fix problems. For people in the EU and UK, the legal bases are the contract with you, our legitimate interest in keeping the service secure and free of abuse, and legal obligations.

We show no ads, use no tracking or analytics cookies, and don't sell your data.

## Which cookies do we use?

One: the sign-in session cookie, which keeps you signed in. Without it the dashboard can't work.

## Who else handles your data?

| Service | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Vercel | Hosting the site and the API | Global, with functions in the US |
| Fly.io | Running your machines | The region you choose |
| Resend | Sending email | EU (Ireland) |
| Stripe | Payments | US and EU |
| GitHub, Google | Sign-in, only if you use them | US |

Where data leaves the EU or UK, it goes under each provider's data processing terms.

## How long do we keep it?

- **Your account:** while it exists. Ask us to delete it and we remove it within 30 days, except billing records the law requires us to keep.
- **Deleted machines and snapshots:** their records are removed 35 days after deletion. A machine's command history goes when the machine does.
- **Problem reports:** 90 days.
- **The welcome credit check:** a one-way hash of each mailbox that has had the credit, kept so the credit can't be claimed twice. It isn't your address and can't be turned back into it.

## What are your rights?

You can ask to see, correct, export or delete your data, and you can object to how we use it. Email hello@tryquivvo.com. If you're in the EU or UK, you can also complain to your data protection authority.

## Changes

When this page changes, the date at the bottom of it changes too.

Contact: Altria LLC, hello@tryquivvo.com.