Original
Your material
Questions, claims, files, notes, sources, decisions, and retained outcomes remain distinguishable as your work. Quantaible does not convert possession of that material into ownership of it.
Privacy & data
Your work stays yours.
Your material remains yours. How Q is powered stays visible. Web retrieval requires separate permission. Retaining, sharing, and deletion stay explicit.
Original preserved
Permission required
You decide what persists
Current behaviour and release-gated capabilities are identified separately below.
The privacy boundary
Three things stay distinct.
Your material, external processing, and what persists should remain visibly separate. More capacity or collaboration does not create a weaker or stronger baseline privacy standard.
Permission
External processing
Local processing, provider processing, and web retrieval remain distinct boundaries. Material crosses the local boundary only as needed for an action you request or explicitly permit, with purpose, destination, scope, and important limits visible.
Continuity
What persists
Persistence, export, recovery, sharing, and deletion remain explicit controls. Convenience does not silently become indefinite storage or broader access.
Current boundary
What happens today.
These statements describe the present product boundary. They are intentionally narrower than the controls planned for broader release.
Current now
Local investigation state
The current QHub investigation state stores resumable snapshots in browser local storage so work can continue on the same device and browser.
Browser storage is device-specific. Clearing Quantaible site data removes these local records; dedicated in-product deletion controls remain release-gated until verified end to end.Controlled route access
A valid preview path establishes an opaque HttpOnly access cookie. Protected responses are configured as private, non-indexed, and non-cached.
The access cookie authorises entry to a protected route. It is not a public-sharing mechanism and does not itself create an account.Founding access applications
The Founding access form collects submitted identity and contact details, intended use, programme interests, and the applicant's acknowledgement of participation expectations.
Submitted information is included in applicant and administrator receipt emails. Email delivery currently uses a third-party service.Account identity
Where account routes are enabled, Quantaible uses server-side account and session records with secure one-time email links for authentication.
Account identity and session records remain separate from investigation content. External infrastructure supports persistence and email delivery without turning account identity into investigation content.Release-gated capability
Managed model processing
Managed model processing is release-gated, not a claim that public provider execution is already available. Controller, disclosure, cost, credential, persistence, and failure boundaries must pass verification before the capability opens.
When model processing is activated, the active compute mode remains visible, attributable, and receipted where applicable. Provider output remains a Q proposal and cannot silently become accepted evidence, Retain authority, or a user decision. Provider choice remains separate from permission to retrieve from the web.Permissioned web retrieval
Web retrieval is part of the locked Q capability contract, but it is off by default and is not a claim that unrestricted public web access is already enabled. Local and Local + web remain explicit source scopes.
Choosing Quantaible Managed, a user-connected provider, or Local compute does not authorise web retrieval. When web retrieval opens, each retrieval action must remain attributable in the record and subject to the user's source permission.Processing and source access
How Q is powereddoes not decide what Q may access.
Quantaible Managed, Your provider, and supported Local compute are processing choices. Source retrieval is a separate permission. Provider and model differences must remain visible where relevant.
Show the boundary
Purpose, compute mode, provider and model where applicable, relevant material, source scope, and important limits remain visible before external processing occurs.
Expose only the permitted scope
A request or approval for one provider action or source scope does not grant open-ended access to an investigation, account, the web, or future work.
Record the execution
Compute mode, provider and model identifiers where applicable, source scope, timing, retries, fallbacks, and capability limits enter the record and Receipt where retained.
Return a proposal
Model/provider output returns as a Q proposal. It does not silently become evidence, change source permission, change compute mode, or approve Retain.
Release-gated default compute
Quantaible Managed
When available, Quantaible Managed is the default way Q is powered. Quantaible selects a supported compute path for the requested work, so the user does not need to choose a provider or manage credentials.
Provider and model execution remains attributable where applicable. This mode does not open until the processing boundary, provider disclosures, security controls, and relevant provider terms pass verification.Release-gated connected mode
Your provider
A user may connect supported provider credentials where released. This means supported provider/API credentials, not a consumer ChatGPT or Claude login.
Credentials must stay server-side, encrypted, redacted, removable, and absent from browser code, logs, Receipts, and exports. Connecting a provider does not enable web retrieval.Supported where available
Local / self-hosted
Supported local or self-hosted models can power the same Q without sending model-processing material to an external provider path for that action.
Local does not mean identical performance: latency, context, raw output, model behaviour, and capability can differ. Local compute also does not silently authorise web retrieval.Locked data rules
What Quantaible will not turn your work into.
These are release conditions, not aspirational copy. A new provider, plan, programme, or feature does not silently override them; it must satisfy them before it opens.
Not sold
Your work is not inventory.
Quantaible will not sell reasoning paths, files, Receipts, source choices, claims, evidence, decisions, pilot feedback, or behavioural signals.
Not advertising data
Private work does not become an ad profile.
Investigation content and founding pilot participation are not advertising profiles. Quantaible will not target advertising from reasoning behaviour or private work.
No hidden profiling
Patterns are not silently repurposed.
Investigation trails, feedback, and decision patterns must not be silently converted into undisclosed personal, political, commercial, or behavioural profiles.
No permission creep
One approval does not authorise another.
Approving one file action, provider request, source scope, preview test, or export does not authorise unrelated access or future processing. Provider choice never silently enables web retrieval.
No default training use
Private customer work is not training material by default.
Quantaible will not use private customer work to train Quantaible models without a separate, specific opt-in. External provider processing remains subject to the disclosed provider terms and processing boundary; a Managed provider path does not release unless those terms are compatible with Quantaible’s stated privacy commitments.
No implied sharing
Retained does not mean published.
A retained outcome, Receipt, or pilot feedback response remains private unless the user deliberately exports or shares it through a clearly identified action.
Deletion must be unambiguous
Remove and permanently purge are different actions.
In the current local environment, clearing site data removes the local record. Dedicated deletion controls do not ship until workspace removal, permanent purge, and any recoverable backup boundary are explicit and tested.
Founding pilot data
Programme participation stays outside the investigation.
Founding access and preview feedback may help shape Q, but they do not become hidden profiling and do not transfer product authority.
Applications
Name or organisation, email, intended use, plan interest, and programme interests are collected only when a person deliberately submits the Founding access form.
Pilot feedback
Preview and pilot feedback are programme input. They are not hidden behavioural profiling and do not transfer product authority.
Decision summaries
Quantaible should explain what input was accepted, deferred, rejected, or left unresolved. Individual private feedback is not published without a clear permission boundary.
Release contract
The claim is the release gate.
Quantaible does not lower a locked privacy commitment to match an unfinished implementation. The capability stays closed until its technical behaviour, failure path, and user-facing controls satisfy the claim and pass verification.
Provider disclosure
Publish the provider and subprocessor schedule, Managed selection boundary, processing locations or terms where relevant, compute and model-processing boundaries, web-retrieval boundary, fallback behaviour, and relevant material-retention terms.
Retention and deletion
Define retention windows, distinguish workspace removal from permanent purge, and test the complete deletion path end to end.
Portable export
Provide reliable export of record state and Receipts in a documented portable format before continuity claims broaden.
Credential protection
Keep connected-provider credentials server-side, encrypted, redacted, revocable, and absent from browser code, logs, Receipts, and exports.
Separation, workspace authority, and sharing
Keep account, billing, participation, personal work, and investigation data appropriately separated. Before collaboration releases, make contributors, recipients, permissions, retention, approval, revocation, version, and disclosure boundaries visible. Organisation policy must not silently convert private personal work into shared workspace material.
Public claims match reality
Complete legal privacy notices, contact processes, incident handling, and user-facing controls must be verified before public wording expands.
Public-release rule
Implement the claim. Verify it. Then release the capability.
Privacy questions
Clear answers, including current limits.
Does Quantaible sell user data?
No. Selling user work, reasoning paths, source choices, Receipts, pilot feedback, or behavioural signals is outside the locked product model.
Will my work be sent to an AI provider?
If Quantaible Managed is the active compute mode, material needed for the requested action may be processed by a disclosed supported provider. Your provider sends the permitted action to the provider you connected. Supported Local processing can keep model processing within the local boundary. Web retrieval is a separate permission and remains off by default.
Is everything stored only on my device?
No. Current investigation snapshots are stored locally in the browser, while access applications, email receipts, enabled account functions, and future permissioned provider processing or web retrieval involve network services. Each boundary is disclosed separately rather than hidden behind a blanket local-only claim.
Does a Receipt expose my investigation publicly?
No. A Receipt is a reviewable record of the work, not an automatic publication. Exporting or sharing remains a separate user action.
Can I delete an investigation?
Current local records can be removed by clearing Quantaible site data in the browser. A dedicated Quantaible deletion control does not release until workspace removal and permanent purge have distinct, tested behaviour, including any recoverable backup boundary.
Is founding pilot feedback private?
When collected, it remains within the disclosed pilot boundary unless the participant explicitly agrees to broader attribution or publication. Feedback does not silently become an advertising or behavioural profile.
Can I connect my ChatGPT or Claude subscription?
Not as a consumer-account login. Supported connected-provider modes may use separately issued provider/API credentials where released. Those credentials must stay server-side, permissioned, encrypted, redacted, revocable, and absent from browser code, logs, Receipts, and exports.
Does choosing a provider turn on web search?
No. Processing control and source control are separate permissions. Quantaible Managed, Your provider, or Local determines how Q is powered; Local or Local + web determines the permitted retrieval scope. Web retrieval is off by default.
Do paid plans get stronger privacy?
No. Plans can increase managed compute, online acquisition, cloud persistence and sync, collaboration, and organisational controls—not the baseline privacy contract or whether Persistent Investigations are available. A feature that introduces additional storage, sharing, or external processing must disclose that boundary and satisfy the same release requirements before it opens.
Is this the final legal privacy policy?
No. This page states the product's privacy architecture, current boundaries, and release requirements. A complete legal privacy notice, provider schedule, retention schedule, and contact process must be finalised before broad paid release.
The rule
Your material stays yours.
Processing, retrieval, persistence, sharing, and deletion stay explicit rather than becoming silent assumptions. Compute and source permissions remain separate, and new capability stays closed until its privacy boundary is implemented, visible, and verified.