Privacy Policy

• Account details: your email address, and if you sign in with Google, the name and profile image Google shares with us.
• Session data: sign-in tokens and their expiry, so you stay signed in across visits.
• Billing details: your Stripe customer ID, plan, and subscription status. Card numbers never reach us; Stripe holds them.
• Feedback you send: the message, any screenshot you attach, the page you sent it from, and your browser type.
• Server logs: IP address, browser type, and request timestamps, kept for security and debugging.
• Usage analytics: the pages you view and what you click, the site that sent you, your browser and device type, and a random ID that is linked to your account once you sign in, so we can see how people find and use Qaytona.

Qaytona does not run advertising trackers, does not sell or rent personal data, and does not ask for patient information. Please do not enter patient identifiers anywhere in the service, including feedback.

• To sign you in and keep your session alive.
• To run your access and bill your subscription, if you have one.
• To answer feedback and fix the problems you report.
• To keep the service secure and to investigate abuse.
• To understand which pages people use and which visits lead to a subscription.
• To email you about your account, billing, and material changes to the service. We do not send marketing email without asking first.

We use a small number of providers, each bound by their own privacy terms, to run Qaytona:

• Convex hosts our database and backend functions, including account, session, and feedback records.
• Vercel hosts the web application and keeps request logs.
• Google handles Google sign-in and shares your basic profile with us at your request.
• Resend delivers sign-in codes and account email.
• Stripe processes payments and stores your card and invoice history.
• PostHog records page views, clicks, errors, and session recordings of how pages are used, with anything typed into a field hidden, and links them to your account once you sign in.

Qaytona sets cookies to keep you signed in, and one analytics cookie from PostHog that holds a random ID so repeat visits count as the same person. Your browser's local storage holds interface preferences such as the theme you chose. There are no advertising or cross-site tracking cookies.

Account and billing records stay for as long as your account exists. Sessions expire automatically. Feedback is kept until it has been addressed and then may be retained for product history. Server logs are kept for a limited period by our hosting providers and then discarded.

You can view and change your name, email, and billing details from Account settings. To export or delete your data, or to close your account, email info@qaytona.com from the address on your account and we will complete the request within 30 days. Deleting your account removes your profile, sessions, and feedback; Stripe keeps invoice records for as long as tax and accounting rules require.

If you are in a jurisdiction that grants specific rights over personal data, such as access, correction, portability, or objection, you can exercise them through the same address.

Data is encrypted in transit and at rest by our providers. Sign-in tokens are stored in HttpOnly cookies, one-time codes expire after 15 minutes, and access to production systems is limited to the people who operate the service. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

Qaytona is built for health practitioners and is not directed at anyone under 18. We do not knowingly collect data from children.

We will post updates here and change the effective date. For material changes we will also email the address on your account.