Privacy Policy

Quell ("we", "us", "our") is a read-later application for iOS and Android developed by Software Flow Yard S.R.L., based in Romania. This policy explains what personal data we collect when you use Quell, why we collect it, how we store it, and what rights you have over it.

Contact: office@softwareflowyard.com

---

1. Who We Are

Quell ("we", "us", "our") is a read-later application for iOS and Android developed by Software Flow Yard S.R.L., based in Romania. This policy explains what personal data we collect when you use Quell, why we collect it, how we store it, and what rights you have over it.

Contact: office@softwareflowyard.com

2. What Data We Collect and Why

2.1 Account Information

When you register, we collect your email address and a bcrypt-hashed password (we never store your password in plain text). We use this to authenticate you and to identify your account. We also store session tokens (refresh tokens) in our database so that you can stay logged in across app restarts and so that you can fully revoke all sessions when you log out.

Legal basis (GDPR): Performance of a contract — this data is necessary to provide the service.

2.2 Timezone

We store your device timezone (for example, "Europe/Bucharest") when you use features that depend on local time, such as computing commitment deadlines (midnight tonight, this weekend, this week) and scheduling local notifications at the correct time for you.

Legal basis (GDPR): Performance of a contract.

2.3 Saved Content Items

When you save a URL, we store the following in our database, linked to your account:

• The URL you submitted
• The title and one-sentence AI-generated summary of the article or video
• The source type (article, video, podcast, tweet, or other)
• The category (assigned by AI or overridden by you)
• The estimated read or watch time
• A thumbnail URL (if one was found on the page)
• Your chosen commitment (Today, This Week, This Weekend)
• The computed deadline based on your commitment and timezone
• The status of the item (queued, consumed, archived, or expired)
• Timestamps for when the item was saved and consumed

This data is the core of the service. Without it, Quell cannot function.

Legal basis (GDPR): Performance of a contract.

2.4 URL Analysis via AI

When you submit a URL in the Save tab, that URL is sent from our server to the Groq API, which runs the openai/gpt-oss-20b and openai/gpt-oss-120b open-weight models, to generate a title, summary, category, and estimated read time. This means the URL you submit is shared with Groq as a sub-processor. We cache the result in Redis for 24 hours, which means that if you or another user submits the same URL within that window, the URL is not re-sent to Groq.

We do not send your name, email, or any other personally identifying information to Groq alongside the URL.

Groq does not share your data with the developers or publishers of the underlying models — the models are hosted entirely within Groq's own infrastructure. Groq's processing of API customer data is governed by their Data Processing Addendum, which includes GDPR-compliant commitments. Please refer to Groq's Privacy Policy for further information.

Legal basis (GDPR): Performance of a contract; legitimate interest in providing AI-assisted categorisation.

2.5 Clipboard Access

The Save tab automatically reads your device clipboard when it comes into focus, in order to pre-fill the URL input if a URL is present. We read the clipboard value only to check if it is a valid URL. We do not store, log, or transmit the contents of your clipboard to our servers if it is not a URL, and we do not retain clipboard content beyond the current session.

Legal basis (GDPR): Legitimate interest in providing a convenient user experience.

2.6 App Settings and Preferences

We store your in-app preferences in our database, linked to your account:

• Queue limit (number of items, between 3 and 10)
• Whether morning reminder notifications are enabled
• Whether expiry warning notifications are enabled
• Your preferred notification time

These are required to sync your settings across devices and app restarts.

Legal basis (GDPR): Performance of a contract.

2.7 Behavioural Usage Data (Stats)

The Stats screen derives insights from your content history: how many items you saved, consumed, archived, or let expire, broken down by month and category. This data is computed from your content items (section 2.3) — we do not collect separate analytics events or page-view tracking. The behavioural profile is visible only to you and is never shared with third parties for marketing or profiling purposes.

Legal basis (GDPR): Performance of a contract; the feature is central to the app's value proposition.

2.8 Notification Interaction Logs

We store a log of notifications sent to you (type, timestamp, whether you opened them). This is used to enforce our rule of no more than one expiry notification per item per day, and to avoid sending a morning notification when your queue is empty.

Legal basis (GDPR): Legitimate interest in preventing notification spam.

2.9 Error and Crash Data (Sentry)

We use Sentry for error tracking. When the app crashes or encounters an unexpected error, Sentry may collect:

• Device type and operating system version
• App version
• Stack traces of the error
• Breadcrumbs (a sequence of recent app actions leading to the error, which may include screen names)

Sentry does not collect your email address or content items. For more information, see Sentry's Privacy Policy.

Legal basis (GDPR): Legitimate interest in maintaining app stability.

3. Data We Do Not Collect

To be explicit about what Quell does not do:

• We do not collect your precise or approximate location.
• We do not access your contacts, camera, or microphone.
• We do not collect advertising identifiers (IDFA, GAID).
• We do not use third-party analytics platforms (no Google Analytics, Mixpanel, Amplitude, or similar).
• We do not sell your data to any third party.
• We do not use your data to train AI models. URLs are sent to Groq solely to generate metadata for your saved items, and Groq does not share customer data with the underlying model providers.
• We do not read the full content of articles or pages you save — only the URL is sent for analysis.

4. Third-Party Sub-Processors

We use the following third-party services to operate Quell. Each acts as a data sub-processor under your agreement with us.

5. Data Retention

• Account data is retained for as long as your account exists.
• Content items are never hard-deleted — they transition through statuses (queued → consumed, archived, or expired). This is necessary for the Stats screen to show accurate historical data.
• Refresh tokens are deleted on logout. Expired tokens are cleaned up periodically.
• Redis cache (AI analysis results) is automatically cleared after 24 hours.
• Notification logs are retained for as long as your account exists.
• Sentry error data is retained according to Sentry's default retention policy (90 days on the free plan).

When you delete your account, all data linked to your account in our database is permanently deleted.

6. Data Security

• Passwords are hashed with bcrypt (cost factor 12) before storage. We never store or transmit plain-text passwords.
• All communication between the app and our server uses HTTPS.
• Authentication tokens (JWTs) are stored in your device's secure keychain (iOS Keychain / Android Keystore), not in plain storage.
• Refresh tokens are stored in our database and are invalidated immediately on logout.
• Our backend is hosted on Railway, which provides infrastructure-level security controls.

7. International Data Transfers

Our backend infrastructure runs on Railway, whose default hosting region is in the United States. If you are located in the European Economic Area (EEA), your data is transferred to and stored in the US. Railway participates in applicable data transfer frameworks. You can review Railway's data transfer commitments in their privacy policy.

If you require EU-region data hosting, please contact us — we may be able to accommodate this in a future update.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your account and all associated data.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a machine-readable format.
• Right to object — you can object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at office@softwareflowyard.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority. In Romania, that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) at dataprotection.ro.

9. Children's Privacy

Quell is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this document. For significant changes, we will notify you through the app. Your continued use of Quell after a change constitutes acceptance of the updated policy.

11. Contact

For any questions or requests regarding this privacy policy or your personal data:

Software Flow Yard S.R.L.
Email: office@softwareflowyard.com
Country: Romania · Reg. Com.: J12/4072/2022
Address: Cluj-Napoca, Jud. Cluj, Str. Migdalului 1-3, Ap. 5, Romania