Privacy Policy

#1. Who is responsible

The controller of your personal data is GALAXICA LLC, the company that operates Quantiko.

For any privacy question or request, use our contact form and choose “Privacy / data request”, or write to us at the postal address above.

#2. Data we collect

Account data

When you create an account: your email address, your name if you choose to give it, and your password if you set one — stored only as a one-way bcrypt hash, never in readable form. We also record which invite was used, when the account was created, when you last used the app (to show activity to administrators and spot abuse), whether an administrator has disabled the account, the language you chose for the app, and a session counter that lets us sign you out of every device when you change your password or choose “Sign out everywhere”.

Signing in with Google

If you choose “Continue with Google”, Google tells us your email address (and whether Google has verified it), your name and your Google account ID. We store the account ID with your account so you can sign in with Google again; we don't store your Google profile picture, and we don't receive your Google password or access to anything else in your Google account. You can also set a Quantiko password in the settings and sign in with email instead.

Waitlist data

When you request an invite: your email address, and optionally your name and a short message about what you would use Quantiko for, plus the date and the status of your request.

Contact form data

When you write to us through the contact form: your name, your email address (so we can reply), the topic you choose and your message, plus the date and whether we have read or archived it. If you are signed in when you send it, we also link the message to your account.

Your content

• The tasks you submit and the messages in your conversations, including the AI's answers (and earlier versions of an answer when you ask for a new one), clarifying questions, and conversation titles.
• Files you attach. For documents (PDF, Word, text, Markdown, CSV, JSON, HTML) we store the file name, type, size, page count and the text extracted from the file — not the original file. For images (PNG, JPEG, WEBP) we store the image itself, with embedded metadata such as GPS location, camera details and text comments removed (photos are also resized in your browser before upload). These are kept with the conversation so the AI can read them, including when you ask follow-up questions.
• Your feedback on answers (thumbs up or down, and an optional comment).
• Sources returned by a web search for an answer (page titles and links).

Routing and usage metadata

For each answer: the type of task, which model was chosen and why, the scores of the models considered, whether a web search was used, whether another model had to take over because the first one failed, whether the answer was produced by a live model, the number of tokens processed, and how long it took. We also keep a timestamp for each task you run to apply the daily task limit.

Technical data

When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser user agent, the pages requested and timestamps, and keeps request logs for security and troubleshooting.

Cookies and local storage

Essential cookies to keep you signed in and protect forms, a cookie that remembers your language, and small preference values in your browser. See our Cookie Policy for the full list.

#3. Purposes and legal bases

We don't make decisions about you that produce legal or similarly significant effects based solely on automated processing. Routing only decides which AI model answers a task.

#4. Processors and recipients

We share personal data only with service providers that help us run Quantiko, and only what they need:

What AI providers receive: the task text, earlier messages in that conversation, the text extracted from files attached to the conversation and any attached images — sent only to the provider of the model chosen for that task. If that model fails before answering, the same content is sent to the provider of the next-best model so you still get an answer (the answer shows when this happened). Two small helper steps use a fast, inexpensive model of one of these providers — which may not be the provider that answers: summing up the goal of a new task in one line and deciding whether to ask you one clarifying question (it receives the text you typed at the start of a task), and suggesting a short title for the conversation (it receives the text you typed and the beginning of the answer; we use the answering provider for this when we can). Neither receives your files. Your email, name and password are not sent to AI providers.

Web search: for research-type tasks, or when you ask for current information (for example today's news or prices) or for sources, the chosen model may search the web using its provider's own search tool (Anthropic's, OpenAI's or xAI's web search). The provider runs the search queries on its side, based on your task; Quantiko stores the titles and links of the sources returned with the answer. Google's search grounding for Gemini is currently not used.

We may also disclose data where required by law, to protect rights and safety, or to a successor if Quantiko is transferred as part of a business sale (you will be informed). We do not sell your personal data, and we don't share it for advertising.

#5. Where your data is processed

Quantiko's app servers and database are located in the EU (Frankfurt, Germany). Static pages may be delivered from Vercel's global edge network, close to where you are.

AI providers may process your prompts outside the EU, for example in the United States. Our AI providers (and our hosting providers) are US companies. Where personal data is transferred outside the EU/EEA or the UK, we rely on appropriate safeguards where applicable — such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (and UK equivalents). You can ask us for more information about these safeguards.

#6. AI training

Quantiko itself does not use your content to train AI models. Your tasks are sent to AI providers through their business/API services, under their terms. These providers' API terms generally state that API data is not used to train their models by default, but they may retain it for a limited period, for example to detect abuse. Each provider's privacy policy and API data-usage terms, published on its own website, describe this in detail.

#7. How long we keep data

• Account data: for as long as your account exists. Deleting your account deletes your profile, conversations, files, feedback and usage records immediately, as well as messages you sent through the contact form while signed in and any waitlist entry for your email. Invite records linked to your email are anonymised (an invite you used is kept without your email, as a record that it was used) or, if still unused, deleted.
• Conversations, attached files and routing metadata: until you delete the conversation or your account. You can delete a conversation — with its messages and files — or your whole account yourself in the app, or ask us through our contact form.
• Files you upload but never send are deleted automatically once they are 24 hours old, normally within 24 to 48 hours of the upload (a cleanup job runs daily, and more often while the app is in use).
• Task timestamps for the daily limit: for as long as your account exists; deleted with it.
• Waitlist entries: until we invite or decline you, and then for a reasonable period (normally no longer than 12 months) to manage invites and avoid duplicates — or sooner if you ask.
• Contact messages: for as long as we need to deal with your message, and then for up to 24 months after the conversation ends, so we have the context if you get back in touch — or sooner if you ask us to delete them.
• Server logs: kept for a limited period according to our hosting provider's log retention.
• AI providers: may retain API inputs and outputs for a limited period under their own terms (see section 6).

We may keep data longer where the law requires it, or to establish or defend legal claims.

#8. Your rights

Depending on where you live (in particular under the GDPR and UK GDPR), you have the right to:

• access the personal data we hold about you and get a copy;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict how we process it;
• data portability — receive your data in a machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, where we rely on consent;
• complain to a supervisory authority, in particular in the EU/EEA country where you live or work (or the ICO in the UK).

You can download a copy of your data (profile, conversations, extracted file text, feedback and contact messages, in a machine-readable JSON file), correct your name, change your password and delete your account yourself in the app's settings. For anything else, use our contact form (choose “Privacy / data request”) and enter the email address linked to your account, or write to us at GALAXICA LLC, 30 N Gould St, Ste 37977, Sheridan, WY 82801, USA. We will respond within one month, and may need to verify your identity first. Exercising your rights is free.

#9. Security

We use appropriate technical and organisational measures, including:

• passwords stored only as salted bcrypt hashes;
• encrypted connections (HTTPS/TLS) between your browser, our servers, the database and AI providers;
• signed, encrypted session cookies, and access controls so each account can only see its own conversations;
• restricted administrative access, limited to what is needed to run the service.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

#10. Cookies and tracking

We use only strictly necessary cookies and preference storage — no analytics, no advertising and no third-party tracking. Fonts are served from our own servers, so your browser makes no requests to third-party font services when you visit. Details are in our Cookie Policy.

#11. Children

Quantiko is not directed at children. You must be 18 or older to use it (see our Terms), and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

#12. Notice for US and California residents

We collect the categories of personal information described in section 2 (identifiers such as email and IP address, account credentials, and the content you submit) for the purposes in section 3. We do not sell or “share” personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You may request to know, correct or delete your personal information through our contact form, and we will not discriminate against you for doing so.

#13. Changes to this policy

We will update this policy when our practices change — for example if we add a new provider. The date at the top shows the current version, and we will notify you of material changes before they take effect.

#14. Contact

For privacy questions and requests, use our contact form and choose “Privacy / data request” — we'll reply by email.

By post: GALAXICA LLC, 30 N Gould St, Ste 37977, Sheridan, WY 82801, USA · Company no. 001344437