Privacy

Last updated October 30, 2026.

kiqr.cloud is the small hosted service behind KIQR. KIQR itself runs on your own computer; kiqr.cloud is where you sign in, link your KIQR agents, and finish sign-ins with services that only call back over https. It keeps as little as it can, and this page lists all of it.

What is stored

• Your account: your email address (encrypted), a password hash if you set a password, the state of email confirmation, password reset and lockout, and, if you sign in with GitHub, Google or Facebook, which of those you use and your id there.
• Your linked KIQR agents: each agent's name (such as “KIQR on studio”) and its sign-in tokens, kept only as one-way digests, with when it was linked and last active.
• Usage pings from KIQR: a random id each install makes for itself, its version, operating system and architecture, whether it runs in Docker and is signed in, how many abilities it has and which marketplace abilities they are. No IP address, hostname, account, project name or private ability name is part of it. Turn it off with kiqr telemetry off, KIQR_TELEMETRY=0 or DO_NOT_TRACK=1.
• Short-lived data: an open relay lives for ten minutes and is used once; rate-limit counters are keyed by a hash of your address, never the address itself.
• Logs: request lines without client IP addresses, with passwords, tokens and relay queries filtered out.

What is never stored

Your name, IP address, sign-in history, or any token or data a connected service (such as Google Analytics or GitHub) hands back. When an ability connects to a service through kiqr.cloud, the service's answer goes straight back to your own KIQR and is neither stored nor logged here. What your KIQR does with it stays on your computer.

Data from Google

Signing in with Google gives kiqr.cloud your email address and Google account id, used only for your account. Connecting an ability to Google asks for read-only access to Google Analytics and Search Console; the tokens pass through kiqr.cloud to your KIQR and are not kept. kiqr.cloud's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. It is not sold, used for advertising, or read by people.

Cookies

kiqr.cloud sets only the cookies it needs to work, so there is no cookie banner to click through:

• _cloud_session: keeps you signed in and protects forms against forgery. It is removed when you close the browser.
• remember_user_token: only if you tick “Keep me signed in”. It keeps you signed in for 30 days, or until you sign out.

There are no analytics, advertising or tracking cookies, and no scripts, fonts or images are loaded from anyone else.

Who else sees anything

• Have I Been Pwned: when you set a password, the first five characters of its SHA-1 hash are checked against known breaches. Your password and email never leave kiqr.cloud.
• Email delivery: confirmation and password-reset emails are sent through an email provider, which sees your address and the message.
• GitHub, Google and Facebook: only when you choose to sign in or connect with them, under their own privacy policies.
• Hosting: the providers that run kiqr.cloud's servers and database store the data above on its behalf.

Nothing is sold or shared for any other purpose.

Why, and for how long

• Your account and linked agents are needed to provide the service you signed up for (GDPR Art. 6(1)(b)). They are kept until you delete the account.
• Logs, rate limits and the breached-password check keep the service and your account secure (legitimate interest, Art. 6(1)(f)). Relays and rate-limit counters expire within minutes; logs are rotated.
• Usage pings show how KIQR is used so it can be improved (legitimate interest, Art. 6(1)(f)). They carry no account, IP address or name, so they can't be tied to you, and you can turn them off at any time.

Your rights

Under the GDPR you can ask to see the data kept about you, to correct it, to have it deleted, to get a copy of it, and to restrict or object to its use. Your email can be changed and your account deleted yourself, from the account page; for anything else, write to [email protected] from your account's email address, and you'll get an answer within a month. You can also complain to the data protection authority in your country.

Deleting your account

Delete your account from the account page. It removes the account and every linked agent and token at once. How to delete your account and data has the steps, including what to do if you can't sign in.

Contact

Questions, or a request about your data: [email protected].

Changes

When this page changes, the date at the top changes with it.