Privacy policy

Last updated: 7 November 2026

Short version

This policy applies to the quadchroma.tech website, the QuadChroma app, purchases through Paddle, the licence server and the customer account. The QC-Phone app for iPhone and iPad has its own QC-Phone privacy policy.

1. Controller

Robert Brandt, trading as QuadChroma
Schenkenberger Str. 3a
04509 Delitzsch
Germany
E-mail: hello@quadchroma.tech · contact form

We are not required to appoint a data protection officer (§ 38 of the German Federal Data Protection Act, BDSG). For any privacy question you can reach us at the e-mail address above.

2. Overview

• quadchroma.tech sets no cookies, has no tracking and no analytics services (we compile simple statistics from our server’s logs ourselves, section 4), embeds no third-party content and loads fonts, scripts and images only from our own server. The only exception: when you click “Continue to checkout” on the buy page, the page loads the Paddle checkout (section 5).
• Our forms (cancel, withdraw, contact, test access and others) send what you enter to our own licence server, not to third-party services.
• The QuadChroma app sends us no usage data, with one exception: after a connection attempt over the internet, it reports, without any identifier, which path worked (section 7). Once a day it asks our update server for new versions (section 8). It contacts the licence server only for the trial and the licence, which includes the self-check reports, and for a computer’s ticket (section 7). It gets this ticket as soon as the computer belongs to a QuadChroma network or remote help is on at it, even while sharing is off. It connects to our connection server only in these cases (section 7):
  – on a computer that shares its screen, while sharing is on and the computer belongs to a QuadChroma network, also if someone else added it (section 7), or remote help is on. If it belongs to no network and remote help is off, as it is out of the box, it does not connect;
  – as a client, when you connect over the internet, i.e. with an internet code, to a computer of your QuadChroma network, or to a computer your device has connected to before and that could be reached over the internet at the time, if it cannot be seen on your local network at the moment;
  – when the “Computers” page is shown, or you check the status there by hand, and it lists computers that could be reached over the internet or that belong to your QuadChroma network. If your device belongs to a network, the app also asks when the “Remote & network” page is shown, and the connection stays open while one of these two pages is open and you are using the window, so that what you see is up to date at once;
  – when you join a network or add a device with a code.
  A client never contacts the licence server.
• The customer account on lizenz.quadchroma.tech sets two strictly necessary cookies (section 9).
• The website, licence server, update server, connection server and mail server run on our own server in Germany. Recipients of your data include STRATO as our host and Paddle as our reseller, for a connection over the internet also the other side, for the online status devices that know your computer, with “My QuadChroma network” and when joining with a code the devices of the network, with remote help the person you let in, and when a licence is transferred, its new holder (section 15).

3. Hosting

The website, licence server, update server, connection server (relay.quadchroma.tech) and mail server run on a virtual server of our own that we rent from STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes the data on this server as a processor on our behalf (Art. 28 GDPR), in data centres in Germany. More in STRATO’s privacy policy.

4. Website server logs

When you open a page of quadchroma.tech, our web server necessarily processes your IP address, the date and time, the requested address (URL), the status code, the amount of data transferred, the previously visited page (referrer) and your browser details (user agent). It writes these into an access log; error messages go to a separate log. We use the logs for operation, troubleshooting, defence against attacks and simple statistics.

The legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). The web server starts new logs every day and deletes them after 5 weeks at the latest.

From the logs we work out totals, for example how often pages and downloads were requested, how often the app checks for updates per version, which websites visitors came from and with what kind of system and browser. We use the IP address for this only to merge repeat requests and to leave out our own devices; we recognise automated requests from the browser details. We build no profiles and do not combine this information with other data about you. For the statistics we use no outside analytics service and do not pass the logs on for them. We keep the totals. The legal basis for the statistics is our legitimate interest in gauging demand and improving what we offer (Art. 6(1)(f) GDPR).

5. Purchase through Paddle

Our licences and subscriptions are sold by Paddle.com as Merchant of Record: by Paddle.com Inc. for buyers in the United States, otherwise by Paddle.com Market Limited. For the data you enter in the checkout, such as name, e-mail address, country and payment details, Paddle is an independent controller. What Paddle does with it is described in Paddle’s privacy notice.

Loading the checkout. The buy page loads Paddle.js, the checkout script, only when you click “Continue to checkout”. Before that, and on every other page of this website, there is no connection to Paddle. After the click your browser loads Paddle.js and a stylesheet from Paddle’s servers and opens the checkout as an embedded window; Paddle receives your IP address and your browser details, among other things. Only inside the checkout may Paddle set its own cookies and similar storage; Paddle is responsible for them. The buy page’s security policy does not allow any further Paddle scripts, for example for analytics. The legal basis for loading the checkout is taking pre-contractual steps at your request, because with this click you start the purchase (Art. 6(1)(b) GDPR).

What we receive from Paddle. After the purchase Paddle reports it to our licence server. We receive your name if you entered one, your e-mail address, your country and order and subscription data. Of this we store: your e-mail address, the language, Paddle’s transaction, customer, price and subscription numbers, whether and which introductory price was used, for a subscription its status and the end of the paid period, and later any refunds or chargebacks. We do not receive payment details. The legal basis is the performance of the contract, i.e. delivering and managing your licence (Art. 6(1)(b) GDPR).

Third countries. According to Paddle, it also processes data outside the EU, for example in the United Kingdom and the United States, and bases such transfers on adequacy decisions of the European Commission or on standard contractual clauses (Art. 45, 46 GDPR). Paddle’s privacy notice has the details.

6. Introductory prices and collecting the licence key

Counter for the introductory prices. On the pricing and buy pages your browser asks our licence server lizenz.quadchroma.tech after loading which introductory price currently applies, and on the buy page again when you continue to checkout more than a minute later or the last answer did not arrive. The request contains no details about you and sets no cookies; the server only answers with prices, numbers of places and the reference the checkout needs for the price, never with details about people. Only the log data from section 7 arise. The legal basis is our legitimate interest in showing you the current price (Art. 6(1)(f) GDPR).

Collecting the key. When the checkout opens, your browser creates a random collection token and passes it to Paddle; Paddle forwards it with the purchase notification to our licence server, which stores only its hash. After the purchase the buy page sends the transaction number and the collection token to lizenz.quadchroma.tech and shows you the key. That way only the browser you bought in gets to see the key. The server keeps it ready for collection for about 24 hours, after that the database holds only a hash. The buy page stores the transaction number and the collection token in your browser’s session storage (sessionStorage, not a cookie) so that it finds the key again after a reload; the entry is deleted when you close the tab and is no longer used after 24 hours. This storage is strictly necessary for the display you asked for (§ 25(2) no. 2 TDDDG). The legal basis for collecting the key is the performance of the contract (Art. 6(1)(b) GDPR).

7. Licence server and app

Without a licence. As a client, i.e. when you only show and control other computers, and without a licence or trial, the app sends nothing to the licence server. Connections between your computers run directly, on your network, through your own VPN or over the internet, always end-to-end encrypted. Picture, sound, input, clipboard and files do not pass through our servers but go directly between your computers. Over the internet, our connection server only helps the computers find each other (paragraphs below). A computer with sharing switched on announces itself on the local network with its device name and device ID so that your other computers find it; this announcement stays on your local network.

Trial. When you start the 7-day trial, the app sends the hashed device ID, the platform (Mac or Windows), the app version and its major version, but no name and no e-mail address. The server keeps the device hash, platform, major version and trial period so that the trial runs only once per device and major version. On Windows, the app also sends a hardware check value. This is a SHA-256 hash, with a fixed prefix of QuadChroma’s own, of your computer’s hardware ID from the BIOS (SMBIOS UUID); the ID itself never leaves your computer. The server does not store this check value, only a hash formed from it with a secret key of the server (HMAC), together with your trial, and deletes it with the trial, 24 months after the trial began. This way the trial runs only once per computer and major version, even if Windows is reinstalled. If the app cannot read the ID or it is a known placeholder that many computers carry, the server stores nothing of it; then, as before, only the hashed device ID counts. The trial file on your computer also contains the check value. Like the hashed device ID, it is pseudonymous. The licence service writes the beginning of the HMAC to its log in some cases (paragraph “Logs.”), for example when the trial on the same hardware has already been used up. If five or more devices report the same value, the server sends us an e-mail with this beginning, at most once a day, so that we can exempt an ID that many computers carry. The licence service deletes the text of this e-mail on its side once it has been sent, after three days at the latest; in our mailbox we keep it like enquiries for 3 years after the case is closed (section 12). If we exempt such an ID, this beginning stays in the server’s settings for as long as we exempt it. On the Mac, the app does not send a hardware check value. The legal basis is our legitimate interest in preventing misuse of the free trial (Art. 6(1)(f) GDPR).

Licence. On activation the app sends the licence key, the hashed device ID, the platform (system), the device name as shown in QuadChroma, the app version and the major version. The server replies with a signed licence file and a random device secret that is stored on your computer and, as a hash, on the server. About every 7 days, daily during the first 14 days after the purchase, a computer confirms its licence with the licence number, hashed device ID, device secret, device name and version. When you sign a device out or move to a new computer, the app sends the details of the same kind needed for that. Every request carries the identifier QuadChroma/<version> (<platform>). The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR): without these details the two device slots cannot be managed. Test licences we issue, for example to the press, are handled the same way.

Hashed device ID. The app reads the identifier that macOS or Windows keeps for the computer and turns it into a SHA-256 hash with a fixed prefix of QuadChroma’s own. Only this hash leaves the computer; it cannot be linked to other services that use the same identifier. For a trial on Windows, the app also sends a hardware check value; it too is only a hash, formed from another identifier (paragraph “Trial.”).

Signing in to the connection server. There is no separate switch for this. A computer signs in to our connection server relay.quadchroma.tech and keeps the connection open while all of the following apply: sharing is on, it has a valid ticket, i.e. a licence or a running trial (paragraph “Ticket.”), and it shares its screen in a QuadChroma network or remote help is on (paragraph “Remote help.”). A computer that belongs to no network and has remote help off, as it is out of the box, does not sign in. While it is signed in, the server knows the computer’s public address, its public device key, a check value of it and the internet code derived from it, the app version, which it only compares with the minimum version, its ticket and, if the computer belongs to a network, the random network identifier (paragraph “My QuadChroma network.”). If a computer signs in without a network identifier, remote help is on at that computer; the server can therefore tell. It keeps all of this in memory only. When one of the conditions no longer applies or the computer disconnects, it is gone at once, after two minutes at the latest. Of the data about a computer, it keeps only an entry on the block list outside memory, if we have blocked that computer’s key (paragraph “Connection server block list.”). What it logs is described in the paragraph “Logs of the connection service.”

Connection server block list. If someone may have copied the keys of one of your computers, we will, at your request, block its old key on our connection server (section 20, “Lost or copied keys.”). For this, you send us, from your licence’s e-mail address, your licence number and the ticket file of the old key from QuadChroma’s folder, and later the computer’s new device ID or new internet code; we’ll tell you how. If the ticket file is missing, the line for this computer from the list of paired computers on another of your devices will do (name, device ID, public key and address). As a rule, so will its entry in the member list or among the removed devices of a device of your network (items “Member list.” and “Removed devices.”). The ticket file contains only the ticket with our signature (paragraph “Ticket.”); neither it nor these entries contain anything secret. We only block the key once the old computer has been removed from your licence and your computer has a new key, so only for a computer you keep using and not, for example, for a stolen one. We then store a hash of the old public key on the connection server. The server rejects every sign-in with this key and at once disconnects an existing one, including your computer’s if it still uses this key after all (for example the service on Windows if you only reinstalled).

From your first message, our support keeps a note on it without names or e-mail addresses. If we block the key, it contains our case number, the hash, the licence number, the day of the block, the day of the removal from the licence and the deadlines for lifting the block and deleting the data. We delete the hash on the server and in the note, the licence number and these days when we lift the block. As a rule we do this 31 days after the block unless you tell us about anything new by then, at the latest after 24 months. Before we lift the block, we check on our licence server which devices are listed on your licence: if one is listed there that we have not noted as yours, or if the licence server counts more device changes for the last 90 days or more activations of your devices than we last noted, we ask you first. If a device or an activation that is not yours is removed from your licence after the block, we lift the block 31 days after that at the earliest. After 24 months we lift it in any case, even before these 31 days are over or if something is unresolved; we tell you so beforehand at your licence’s e-mail address. After the block is lifted, the note only keeps our case number and the day the block was lifted; we delete these 12 months later too.

We keep the note in our support. Until the block is lifted, the details you sent us for it (licence number, ticket file or line or entry, new device ID or new internet code) are kept there too. For the check before lifting the block, we also note there the beginning of the hashed device ID of each device that is listed on your licence when we block the key and belongs to you (if in doubt, we ask you), how many device changes your licence had in the 90 days before, how many activations these devices have and how many other devices are listed on your licence. If anything changes after that, for example because you confirm a device as yours, a device that is not yours is added, a device or an activation that is not yours is removed, or we remove a device from your licence for you, we note the new state and, for a removal, also the day. When we lift the block, we delete all of this there. We handle your message itself like other e-mails to us (section 12). The legal basis is Art. 6(1)(b) GDPR (your request) and (f) (protecting your access against misuse).

If we do not block the key, the same applies, except that we delete your details as soon as the case is settled, at the latest 30 days after your last message. After that, the note only keeps our case number and the day the case was closed; we delete these 12 months later too. If at your request we remove a computer from your licence for you (section 20), we also note, with your details, the beginning of its hashed device ID (paragraph “Hashed device ID.”) and delete it together with them, so in the case of a block only when we lift it. Our licence server also records this removal in its administration log with the licence number, this beginning and the time, and deletes the entry after 90 days (section 16).

Joining a network. In the app, a computer gets into a QuadChroma network in one of two ways: with a join code, or when it is connected to on your local network, also over a VPN, and the controlling device ticks the box to add it. Adding it this way requires the computer’s password or a click on “Allow” on it in the same session, and the computer must not belong to a network yet; this is not possible while “Allow help” is on at it. So anyone who knows your computer’s password, or for whom you click “Allow” on it, can add it to their network. From then on the devices of that network can reach, see and control your computer from anywhere without a password whenever sharing is on; for this it signs in to the connection server as described above, and the devices of the network see when it is online. A computer added this way cannot itself control other computers of the network at first. Afterwards it shows you which device added it, when and how, until you confirm this or undo it. Undoing means: your computer leaves the network, the device that added it is struck off its “Allowed devices” list, and the app replaces a random password with a new one; a fixed password stays. Under “Remote & network” you can leave a network the app shows there at any time; after that your computer no longer signs in while remote help is off. On Windows with the QuadChroma service there is an exception to this (item “Removing and setting up the service again.”).

Setting up a connection. When you connect over the internet, the app sends the server the computer’s internet code or a check value of its public key, together with an encrypted message that only the computer can read. The server does not learn your device key: the app uses a new throwaway key for every request. The computer first gets your request without your address. It sees only a short value derived from it that changes daily, so that it can slow down repeated requests. Only when the computer agrees does the server tell each side the public addresses of the other. It agrees to devices of its network without asking, whether remote help is on or not (paragraph “Joining a network.”); to all others, including a device that is already on its “Allowed devices” list, only while remote help is on at it, and then only if your device still counts as a remote help guest there or, while remote help accepts new connections, the computer’s password is right or someone clicks “Allow” at it (paragraphs “Remote help.” and “Remote help guests.”). For this, both devices send short check requests to the server. Then the computers connect directly. Over the encrypted path, the computer also tells your device its addresses on the local network; the server cannot read them. The server knows the public address of the requesting device for this request for two minutes at most.

My QuadChroma network. If a computer belongs to your QuadChroma network (“My network” in the app), it also sends a random network identifier and an encrypted entry with its name, system and version when it signs in. Only devices that have the network’s key can read it (section 20). The server sees which signed-in computers belong to the same network, and the address from which devices of the network fetch the list.

Live status. While the “Computers” or “Remote & network” page is open on a device of the network and you are using the window, the app keeps a connection to the server open. When a computer of the network signs in or out, the server sends the current list over this connection at once. The other pages of the app keep no connection for this and show the last status. Nothing is kept for devices without an open page. The server knows the device’s address together with the network identifier only for as long as this connection lasts, 10 minutes at most; if the page is still open then, the app opens a new one. If the window is minimised, hidden or covered, or you don’t use it for 10 minutes, the connection ends.

Presence. This way all devices of your network see when each computer of the network is online, i.e. switched on, with sharing on and signed in to the server. If computers of several people belong to one network, for example in a family or at work, these people see this about each other. The server keeps no history such as “last online”. A device that was removed from the network but still has the network’s key can go on reading the entries and seeing presence until the network has been renewed as described in section 20, and for computers that do not have the renewed network yet, even after that. If it is a computer, it can also go on signing in to the network with it; for just as long, the devices of the network then see when it is online, with its name, system and version. In addition, any device that knows your computer’s public key can ask whether it is signed in at the moment (paragraph “Online status.”).

The server keeps all of this in memory only. When the last computer of the network signs out, everything is gone, after two minutes at the latest. The server never gets the network’s key; it stays on your devices.

Online status. When the “Computers” page is shown, at most once a minute, or you check the status there by hand, the app asks our server whether certain computers are signed in to it right now: those your device has connected to before, that could be reached over the internet at the time, for example during remote help, and that cannot be seen on your local network at the moment. A computer it reached only through remote help is kept for this only while the connection with it lasts (if the app ends unexpectedly, the app removes it at the next start). Once remote help has ended, it therefore no longer asks about it. It sends only check values of the public device keys. The server answers “signed in” or “not signed in” and does not keep the question. Anyone who knows your computer’s public key can see in this way whether it is signed in at the moment, i.e. switched on, with sharing on and in a QuadChroma network or with remote help on. Technically, someone who cannot come in themselves can also ask this, for example someone who helped you through remote help before. They cannot see where your computer is. There is no history such as “last online”.

Joining with a code. When you add a device with a code, both devices connect to a short-lived meeting point on our server. It passes a few messages live between them that it cannot make use of, and stores none of them; the actual content is encrypted. The server does not get the secret part of the code. It sees only the code’s channel number and the addresses of the two devices. The meeting point is gone after the device has joined, after ten minutes at the latest.

Remote help. Remote help lets someone who does not belong to your network reach your computer over the internet, for example so that they can help you. It is off out of the box. You turn it on at your computer in one of two ways:

• “Allow help” (until done): your computer accepts new connections through remote help for 60 minutes only. When these 60 minutes are up, it does not disconnect help that is running. From then on, however, nobody new gets in through remote help, not even with your password or “Allow”; only a remote help guest (paragraph “Remote help guests.”) can come back within 10 minutes after disconnecting without being asked again. “Allow help” ends when you turn it off or when a guest has disconnected and no guest has been connected for 10 minutes since; after the 60 minutes it also ends as soon as nobody is connected through remote help any more and no guest can come back. A device on the “Allowed devices” list is not a guest here: if it disconnects during the 60 minutes, “Allow help” does not end any earlier because of that. The app on your computer shows how much longer it accepts new connections, and after that “in progress · no new connections”. If no help is running at the time, it shows a notice there 5 minutes before this time is up (“Remote help accepts new connections for 5 more min.”). If someone connects just then, their device may show the notice too; for this, your computer sends it only the remaining time in minutes. You can restart or extend it only at your computer, once nobody from outside is connected any more.
• “Always on”: only with a fixed password, and with no time limit until you turn it off.

Both modes also end if your password changes while someone is connected through remote help. On Windows with the QuadChroma service, “Always on” also ends when you sign out of Windows, switch users or the computer restarts; if only the service restarts, for example during an update, while you are signed in and the app is running, “Always on” usually keeps running. The app stores whether remote help is on, and until when it accepts new connections, in its settings on your computer (on Windows with the QuadChroma service in those of the service), so that this limit also holds after a restart. A restart of your computer or of QuadChroma therefore does not end “Allow help” during the 60 minutes, and on a Mac and on Windows without the service it does not end “Always on” either. Anyone who knows your password can come back in after a restart while remote help accepts new connections – as soon as QuadChroma is running on your computer again, and on Windows with the QuadChroma service only once you have signed in again. After a restart, the 10 minutes after a guest disconnects only count from the next time a guest disconnects; if no guest comes, “Allow help” ends after the 60 minutes. After the 60 minutes, “Allow help” ends when your computer restarts, and on a Mac and on Windows without the service also when QuadChroma restarts.

Anyone who comes in through remote help needs your password or a click on “Allow” at your computer, including a device that is already on your computer’s “Allowed devices” list but does not belong to your network, if it comes through our connection server (the connecting device then shows “Over remote help – there it takes the password or ‘Allow’.”). While remote help is off or no longer accepts new connections, such a device does not get in through our connection server at all. Without our connection server, for example on your local network, a device on this list comes in without being asked again, whether remote help is on or not. The devices of your network also come in without being asked, from anywhere (paragraph “Joining a network.”), and so does a remote help guest for as long as they count as a guest (paragraph “Remote help guests.”).

When remote help ends, your computer disconnects every connection that came about only through it, including that of a device on the “Allowed devices” list that came through our connection server and does not belong to your network. While remote help is on, your computer signs in to the connection server even if it belongs to no network (paragraph “Signing in to the connection server.”). Anyone who knows your computer’s internet code or public key, for example a device that has connected to it before, can see that it is reachable and accepts remote help. The server sets up the connection as described in the paragraph “Setting up a connection.”; it knows the public addresses of both sides for two minutes at most. Even with remote help, picture, sound, input, clipboard and files do not pass through our servers but go directly between the two devices.

Remote help guests. Anyone who came in over the internet through remote help is a guest, unless their device is already on the “Allowed devices” list. Your computer keeps a guest only on a guest list in memory (on Windows with the QuadChroma service in the service, otherwise in the app), and only with their device’s public key, the time they were let in or last disconnected and the number of their open connections. Your computer’s log records the guest’s connection like any other (paragraph “Data only on your devices.”). Anyone who comes in on your local network, also over a VPN, with your password or with “Allow” while “Allow help” is on is likewise only a guest, unless their device is already on the “Allowed devices” list. This lets a guest reconnect after a short break without being asked again, also after the 60 minutes of “Allow help”; from then on, nobody new gets in on your local network either. A guest counts only while remote help is on, and for 10 minutes at most after they last disconnected. The guest list is emptied at once when remote help ends, when the password changes, when you renew the network, when you sign out of Windows or macOS, on a Mac and on Windows with the QuadChroma service also when you switch users, and on restart. QuadChroma never adds guests to the “Allowed devices” list.

When a device stays allowed. Anyone who comes in on your local network, also over a VPN, with “Allow” or with your password while “Allow help” is not on, so also with “Always on”, is not a guest. Your computer adds their device to the “Allowed devices” list like any other. Over a tunnel on your computer itself, for example via SSH, it always does so after the password or “Allow”, even while “Allow help” is on. When a device added this way does not come through our connection server, for example on your local network, it then comes back in without being asked again until you remove it there. If your computer is to join the other device’s network through the tick box and that device then picks “No code shown” or a wrong code after the “Allow”, your computer removes the entry it has just added. It can only do so if the other device’s app tells it. If that message does not arrive, for example because the connection has already ended, the entry stays; remove it yourself then. A device that was on the list before stays on it in any case.

Taking back access. To take back someone’s access through QuadChroma, turn remote help off, remove from the “Allowed devices” list (in the menu of the QuadChroma icon) their devices and any device you cannot clearly identify, and change a fixed password. Also check under “Remote & network” which network the app shows there and, where it shows them, which devices are in it; if it is not your network, leave it there. On Windows with the QuadChroma service, the app shows devices from its older “Allowed devices” list that are not also on the service’s list on the “This PC” page under “Access before sign-in”, without a tick; do not tick any device there that you cannot clearly identify. If this older list applies again because the service was removed, check it in the menu in the same way (item “Removing and setting up the service again.”). Also proceed as described in section 20 (“Lost or copied keys.”).

When remote help ends, the app replaces a random password with a new one. A fixed password stays, unless it changed while someone was connected through remote help; then the app replaces it with a random password too.

What someone sees or does on your screen during remote help travels end-to-end encrypted directly between the two devices. We receive none of it. Only let people you trust onto your computer. We never ask for access to your computer unprompted. If you use QuadChroma to help others, for example at work, you do not do so on our behalf; you or your company are responsible for the data you see while doing so.

Ticket. So that the connection server only accepts computers with a licence or a running trial, the app gets a ticket from the licence server as soon as the computer belongs to a QuadChroma network or remote help is on at it, and renews it in good time, even while sharing is off. On Windows with the QuadChroma service, the service does this too while sharing is on. With a licence, it sends the same details as when it confirms the licence, but without the device name. In the trial, it sends the hashed device ID, the app version and the major version. In both cases the computer’s public device key is added. The licence server checks this and signs the ticket. It does not store the ticket. Of the public key, it stores a check value, together with the hashed device ID, the major version and the time of the first and of the last ticket. This way, tickets for a trial are only issued for the keys of that trial and not for a key for which it has already recorded a ticket with a licence covering this major version (a subscription covers all). For a trial, it deletes these details with the trial, at the latest 24 months after the first ticket; with a licence, 24 months after the last ticket. The legal basis for this is our legitimate interest in preventing misuse of the free trial (Art. 6(1)(f) GDPR). Like every other request, the request appears in the licence service log only with the licence number, a shortened device ID and the result (paragraph “Logs.”). The ticket contains the public key, whether it is a licence or a trial, its validity (at most 30 days, in the trial until the trial ends) and a slot mark. The licence server forms the slot mark from the hashed device ID with a secret key, so the connection server can read neither device nor licence from it. The ticket is kept on your computer.

Older versions. This policy describes QuadChroma from version 1.1.0 on. Earlier versions do not use our connection server, do not get a ticket and do not send a hardware check value.

Counters. After a connection attempt over the internet, the app reports, without any identifier, which path worked and roughly how long it took. We use this only to detect and fix problems with setting up connections. The server only counts totals, such as how many computers were signed in and how many connections were made on which path, and sums them up for us once a week. The totals cannot be traced back to you or your device.

Logs of the connection service. The connection server writes no addresses and no keys to its log, only types of error and the counter totals. Like lizenz.quadchroma.tech, the access log of relay.quadchroma.tech contains no IP address. Only rare serious error messages of the web server may contain an address. Both logs are deleted after 5 weeks at the latest.

Data only on your devices. Some data QuadChroma keeps only on your devices. We do not receive it unless you send us some of it yourself, for example for a block (paragraph “Connection server block list.”). Where some of it is also needed for the connection service, your trial or your licence, such as a computer’s name and key or your licence number, our servers know it only as described in this section.

• Member list. Every device of your network keeps a list of its members with device name, public device key, system, since when the device has been in the network, where the entry came from, whether the device shares its screen and whether it may also control other computers of the network, whether it was added with the tick box, where applicable a short identifier of a second key of the same computer, and technical details for keeping the list in sync. The device name is the name the device has in QuadChroma; it may contain your name or someone else’s, such as “Anna’s laptop”. The devices bring the list up to date among themselves when they are connected to each other, end-to-end encrypted and never through our server. If a device leaves the network or undoes its addition while it is connected to another device of the network, the other device deletes its entry; the remaining devices keep it. If a device is removed, the devices of the network no longer show it once they know about it, with one exception (item “Removed devices.”). They keep its entry stored; the device that removed it deletes it when the network is renewed. A removed device keeps its list. There is no fixed period for these entries. A device’s list is only reliably deleted on that device once it joins another network or you delete QuadChroma’s folders there; this also applies if your device itself leaves the network (see below).
• Devices added with a code. If you add another device to your network with a join code on your device, the new device only gets onto the member lists once it has been connected to a device of your network. Until then, your device remembers its device name, the time it was added and technical details for matching it, and shows it to you under “Remote & network” as not connected yet. These details stay on your device only. It deletes them when you remove the entry and otherwise usually as soon as the new device is on your device’s member list; if the new device has been renamed in the meantime or its name is ambiguous there, they stay until you remove the entry. If you leave the network, it deletes all of them. If you renew the network, or your device joins another network or leaves this one by itself, they no longer apply; your device then deletes them the next time QuadChroma’s window is open. Your device remembers at most 16 such devices; beyond that, the oldest is dropped. Such a device is only fully removed from your network if you also renew the network when removing it (section 20).
• Addition record. On a computer that someone added with the tick box, the member list also records which device added it (name and key), when and how, and for “Allow” also the comparison code of that connection, which the notification about the addition shows you. The comparison code is a number that is new for every connection set-up and that the app shows for comparison, on both devices when you use “Allow”; it is valid only for that one connection set-up. This record, including the comparison code, stays stored even after you have confirmed the addition.
• Leaving by itself. A removed computer leaves the network by itself as soon as the device that removed it connects to it again. This happens only if the removing device is on the removed computer’s “Allowed devices” list, may control other computers in the network and was not itself added with the tick box, and if the network has not been renewed since. The removed computer then deletes the network’s key (its list stays, as when leaving the network), takes the removing device off its “Allowed devices” list, so that this device needs the password or “Allow” again afterwards, and shows “‘X’ removed ‘Y’ from your network.” On Windows with the QuadChroma service, at first only the service does this; it keeps a note of the exit in a small file (identifier and name of the network, names and public keys of both devices, time) until the app picks it up. If the app has its own copy of this network’s key, it deletes that copy only then, i.e. when you are signed in to Windows at this computer and the app is running; until then the copy is still there.
• Removed devices. So that a removed device cannot come back in, the device on which you remove it immediately remembers its public key and when it was removed. The other devices of the network remember this, together with the device that removed it, only once they next connect to that device, and then show “‘X’ removed ‘Y’ from your network.” There is no fixed period for this: what your device removed itself, it remembers permanently, also after the network is renewed. Removals reported by other devices it remembers for 64 devices at most; when the network is renewed, it keeps only those of the device that renewed it. If the device that removed another is later removed itself, its entries are usually dropped. A removed computer is still shown as long as it has the network’s key and is signed in to the connection server: the devices of the network then show it as online until they have the renewed network (paragraph “Presence.”).
• Notices and log. A computer logs when a device from your network connects, when a new device joins the network, when a device is removed, and which device added or removed the computer itself, and how; it also shows you some of these events as notices. The log of a computer that shares its screen records, for every connection, including a remote help guest, the other side’s device name and, where applicable, how it came in, for example with the password, with “Allow”, as a remote help guest or as a device of your network. On Windows it also records the other side’s full address, so for a connection over the internet its public address; on a Mac likewise, except for connections through our connection server (then the address appears at most in a line without a device name, when very many connections arrive at once). On a Mac it also records, for every connection, the other side’s device ID, a check value of its key and the comparison code of the connection; on Windows likewise, but with the QuadChroma service not for every connection.
• Refused attempts. A computer that shares its screen also logs access attempts that are refused or broken off. For them it records at most the other side’s device name and device ID and, under the rules above, its address. If it removes an entry after “No code shown” or a wrong code, that is logged too, with the other side’s device ID, on a Mac also with its device name. The computer’s log from this item and the previous one is limited to two times 8 MB; when it is full, the oldest entries are dropped. On a Mac it therefore reaches back over several starts; on Windows it starts afresh each time, but a full older part may remain.
• The app’s other log. The app’s other log starts afresh each time the app starts; only the one from the previous start is kept. Among other things, it records the name and device ID of the computers your device connects to, for connections on your local network or to an address you entered also the address, for a paired computer also its remembered address on the local network, even if the connection goes through our connection server, and for a connection that needs a password or “Allow”, the comparison code. The app writes an internet code there only as the device ID without its check part, and never a join code.
• Allowed devices. A computer that shares its screen keeps the “Allowed devices” list (in the menu of the QuadChroma icon): for each device its public key, the device name it had when it was added, and the date since which it has been allowed. A device gets onto it when it comes in on your local network, over a VPN or over a tunnel, without being a guest (paragraph “When a device stays allowed.”). After that it comes back in without being asked again, as far as the paragraphs from “Remote help.” on provide. There is no fixed period. An entry is removed when you remove it there (one by one or with “Remove all devices …”), when you undo an addition to a network (the device that added it, paragraph “Joining a network.”) and when your computer leaves the network by itself (the removing device, item “Leaving by itself.”). Your computer takes a device that was removed from the network off the list when you remove it at this computer, or when a device on this list on which you removed it then connects to the computer. After “No code shown” or a wrong code, the entry just added is removed if the other device’s app reports it (paragraph “When a device stays allowed.”). Other computers do not take a device that was removed from the network off their list in every case (section 20). Otherwise the list stays until you delete QuadChroma’s folders.
• Allowed devices with the Windows service. On Windows, the setup installs the QuadChroma service. It keeps its own “Allowed devices” list and, when first set up, takes over no device from the app’s list. If you used QuadChroma without the service before, this older list of the app stays in its folder with all its entries. The app shows its entries that are not also on the service’s list on the “This PC” page under “Access before sign-in”, without a tick; only what you tick there and save is taken over by the service. Removing, in the menu as well as there, only affects the service’s list, and so do the ways listed above in which an entry is removed. A status file in the service’s folder contains the computer’s device ID and the identifier of your Windows account. Since version 1.1.0, QuadChroma no longer writes device IDs of allowed devices there; an older status file with such device IDs stays until the service is set up again.
• Removing and setting up the service again. If you remove the service or uninstall QuadChroma, its list, its status file and its other data, including a copy of your network’s key, stay in its folder in the program data. If the service is removed while QuadChroma stays installed (this needs administrator rights), the app’s older list applies again. Every device on it then comes back in without being asked again when it does not come through our connection server. Check it then in the menu of the QuadChroma icon. If you set up the service again later, its earlier data applies again, including a network it belonged to, even if you have left that network in the meantime. Its list depends on how you do it: after a reinstall it takes over its earlier list; if you set it up again in the app under “Access before sign-in”, what you tick there applies. Afterwards check the list in the menu. To be sure that no earlier data of the service still applies, including an earlier network, delete QuadChroma’s folders as described in section 20 (“Lost or copied keys.”). Otherwise both lists and the status file stay until you delete QuadChroma’s folders.
• Paired computers. Your devices remember which computers they have connected to (name, device ID, public key and address; after a connection through our connection server, at most an address on the computer’s local network), how and when they got to know them and whether those could be reached over the internet at the time. A computer they reached only through remote help is taken off the list for the online status when the connection ends (if the app ends unexpectedly, at the next start); its name, device ID and key stay like those of other paired computers.
• “Continue with”. For “Continue with”, the app also remembers the computer you last connected to, with its name, device ID, for a connection without our connection server also its address, and the time of the session. The next session with another computer replaces this entry.
• Removing paired computers. A computer of your network is taken off by a device when you remove it from the network on that device, or when the device later connects to one of its paired computers on which you removed it from the network. Your other devices keep it (section 20). Any other computer is taken off a device when you remove it there in the app with “Remove …” in the ⋯ menu of its card, which also clears it from “Continue with”; your other devices keep it. This works only for a computer that the app shows as a card with its device ID, because it can be seen on your local network right now, because it is on the list for the online status or because it is under “Continue with”, and not during a session with it. For other paired computers there is no such way, for example for one you reached only through remote help, once you have connected to another one afterwards, or for one you used only on your local network that is switched off or gone. They stay until you delete QuadChroma’s folders. Your device also takes a computer off if, while adding it with the tick box, you pick “No code shown” or a wrong code after the “Allow”.
• Settings per computer. Settings the app has saved for a computer (such as frame rate, bitrate or sound) and its measured frame rates (item “Measured frame rates.”) are deleted on this device when you use “Remove …” in the ⋯ menu of its card. If it is only removed from the network, both stay stored under a check value of its key, even if you then remove it from “Continue with”; the settings then stay until you delete QuadChroma’s folders.
• Measured frame rates. For every computer your device connects to, the app remembers under a check value of its key which frame rate it measured with which codec and resolution, and the date of the session or of the benchmark. After a benchmark it also remembers the time the computer needed per frame. It uses this for a later display and for troubleshooting. At most 400 entries are kept; beyond that, the oldest are dropped. Otherwise only “Remove …” (item “Removing paired computers.”) or deleting QuadChroma’s folders deletes them; if the computer was removed from the network, they stay even after “Remove …” (item “Settings per computer.”). The app also stores the result of the last benchmark with the computer’s address; it stays until the next benchmark. After a connection through our connection server, it holds the computer’s device ID instead, or the internet code you typed, including its check part.
• Computers of your network. If your device has connected to a computer of your network as a device of that network, it remembers that computer separately from the paired computers, with its name, public key and the network’s identifier. This way your device recognises it as a computer of your network next time and does not ask again. It deletes the entry when you remove the computer from the network on this device, and all entries as soon as it gets the renewed network or leaves the network; otherwise they stay until you delete QuadChroma’s folders.
• Password and keys: section 20.

If your device leaves the network, it deletes the network’s key; the other data above stay, except the entries under “Computers of your network”. You delete all of it on the device only by deleting QuadChroma’s folders. Uninstalling alone does not delete it: on Windows, the QuadChroma folder in the app data of every user account that has used QuadChroma remains, and, if the QuadChroma service was ever set up there (the setup always does this), also the service’s folder in the computer’s program data and a small log in the program folder. On a Mac, the QuadChroma folder under “Application Support” in your Library remains when you delete the app. Where these folders are and how to delete them is explained in the manual. A Mac that shares its screen also writes a few lines about the clipboard and sound to a log in macOS’s temporary folder. It mostly contains technical details only, and for a file it cannot place as a file reference also its path; macOS usually clears this folder when the Mac restarts. Storing this data on your device is strictly necessary for the features you use (Section 25(2) No. 2 TDDDG).

Legal bases. Signing in, setting up a connection, remote help, online status, the network list with live status and presence, the meeting point and the ticket serve the connection service that comes with your licence or trial and that you use free of charge as a client (sections 3 and 10 of the terms). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). In three cases the same processing is based on legitimate interests (Art. 6(1)(f) GDPR). In the first, someone uses one of these devices without having accepted our terms themselves, for example in a family, at work or on one side of remote help. In the second, someone else added your computer to their network with the password or “Allow”. In these two cases it is our interest, and that of our customers, in setting up the connection they asked for and seeing the computers of their network. In the third, for the online status towards devices that do not belong to your network, it is the interest of the people using those devices in seeing whether your computer can be reached right now, for example to connect to it or during remote help. That a removed device which still has the network’s key keeps seeing entries and presence (paragraph “Presence.”) is not something we want; it follows from the key being what proves access. You can end it by renewing the network as described in section 20, for computers that do not have the renewed network yet only once they have it.

The quickest way to object to this processing on our server is to do it yourself: turning sharing off ends the sign-in at once; undoing the addition or “Leave network” ends it if remote help is off, and turning remote help off does so if your computer belongs to no network. The app keeps getting the ticket, though, while your computer belongs to a network or remote help is on (paragraph “Ticket.”). You can also object to us at any time under section 17. For the path reports and logs it is our legitimate interest in running the service reliably and detecting faults (Art. 6(1)(f) GDPR), and the same applies to protection against misuse (section 14). The totals themselves are not personal data. For the data that is kept only on your devices, the same legal bases as above apply, insofar as we are responsible for it.

Self-check reports. At start-up and from time to time, QuadChroma checks whether the app is unchanged and its licence data are consistent, for example the signature of the app, the licence data on the computer and the time. If the app finds an irregularity and there is a licence or a running trial on the computer, it sends to the licence server, at most once a day per finding: the type of finding, the licence number (if there is one), the hashed device ID, the platform, the build and version number of the app and the time of the finding according to your computer’s clock. With a licence it also sends the device secret so that the server can check that the report really comes from this computer; the secret is only compared, not stored. The app does not send content, files, screen content, device names or e-mail addresses. The server stores these details without the platform, together with the time of receipt and the result of that check, for 12 months; the IP address the report came from appears in the log of the licence service (paragraph “Logs”). We use the reports to detect changes to QuadChroma and use without a valid licence. A report on its own does not trigger any measure. Only after we have reviewed it can we block a device: it is then signed out of the licence and can neither activate nor try QuadChroma. A damaged update or an antivirus program can trigger a report without anything on your part; if your device has been blocked, write to us, we will check and lift the block if it was a false alarm. For blocked devices we keep only the device hash and the start and reason of the block, until the block is lifted and for at most 24 months. The legal basis is our legitimate interest in protecting QuadChroma and our licences against tampering and misuse (Art. 6(1)(f) GDPR).

Storage. We store licence data for the term of the licence or subscription and for 3 years after that (the regular limitation period). The legal basis for these 3 years is our legitimate interest in being able to prove, enforce or defend claims under the contract (Art. 6(1)(f) GDPR). Shorter periods for individual data, for example for signed-out devices, are listed in the table in section 16.

Logs. The licence service logs events only with the licence number, a shortened device ID and the result, for a trial on Windows in some cases also with the beginning of the HMAC of the hardware check value (paragraph “Trial.”), without IP addresses, e-mail addresses, keys or device names. The only exception is self-check reports: for these it also logs the IP address the report came from, to detect clustered or forged reports. The web server in front of lizenz.quadchroma.tech logs the time, the request without parameters, status code, amount of data and duration, likewise without IP address, referrer and browser details. Both logs are deleted after 5 weeks at the latest (Art. 6(1)(f) GDPR).

8. Updates

Once a day the app asks our own update server at quadchroma.tech whether there is a new version; the list of versions is signed. The web server processes your IP address, the time and the app version and platform contained in the request, and logs them as described in section 4; the logs are deleted after 5 weeks at the latest. The app installs an update automatically only if you have switched that on in the app. You switch the daily check off in the app with “Check for updates automatically”. The legal basis is our legitimate interest in providing you with bug fixes and security updates (Art. 6(1)(f) GDPR).

9. Customer account

In the customer account at lizenz.quadchroma.tech/portal you see your licences, devices and declarations, sign devices out and request a new key. There is no password: you enter your e-mail address, and if a licence or a transfer to you (section 10) belongs to it, we send you a six-digit one-time code. We store the code only as a hash; it is valid for 10 minutes and allows at most 5 attempts.

Two-factor sign-in. You can additionally protect your customer account with an authenticator app. For this our server creates a random secret and shows it to you once as a QR code and as text; the QR code is created on our server without any third-party service. We store the secret encrypted. We also store when you set up and switched on two-factor sign-in and when it was last used, which code was last accepted (so that each code works only once), how many wrong codes were entered in a row and until when the account is locked because of this. We store your eight recovery codes only as a hash formed with a secret key and note when a code was used. The authenticator app runs only on your device; we receive nothing from it except the codes you enter. We send you notices about these events by e-mail (switched on, switched off, reset, new codes, code used, several wrong codes). The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR) and our legitimate interest in the security of customer accounts (Art. 6(1)(f) GDPR). We delete this data from your customer account as soon as you switch two-factor sign-in off, we reset it at your request, or there is no licence and no running transfer for your e-mail address any more; a set-up you do not complete, at the latest one hour after it expires (it is valid for 10 minutes).

The customer account sets two cookies, both only for lizenz.quadchroma.tech: __Host-qc_anfrage links the code request to your browser (10 minutes), __Host-qc_portal keeps you signed in (session cookie, at most 2 hours, ending after 30 minutes without activity). Both are strictly necessary for the sign-in you asked for (§ 25(2) no. 2 TDDDG). The customer account stores your language choice in your browser’s local storage (localStorage); it never leaves your browser.

The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR). Invoices and payment details are managed by our reseller Paddle; you’ll find your orders on paddle.net.

10. Transferring a licence

If you transfer a licence in the customer account (section 7 of the terms), we process the reference number and the licence number, your e-mail address and language, the e-mail address of the new holder (recipient) and a hash of this address, the recipient’s language once they sign in to the customer account, and the times of start, acceptance, completion, cancellation or expiry, the reason for a cancellation, the version of your declaration and of the terms the recipient accepted, and the number of devices we signed out in the process. To confirm, we send you a six-digit code that we store only as a hash; it is valid for 10 minutes and allows at most 5 attempts. The same applies if we switch a licence over at your request by e-mail (section 7.1 of the terms), just without the code and acceptance.

On completion we delete the names of your devices on this licence; we delete the remaining details about them (device hash, platform, app version, times) 90 days after sign-out, as for every signed-out device. We disclose them and the details of your purchase at Paddle (customer and transaction number, which stay with the licence so that a chargeback reaches it) only to you, never to the recipient.

You give us the recipient’s address. We send them an invitation with details of the licence (major version, number of devices) and the procedure, and use the address only for this transfer; with the hash we count invitations to the same address (section 7.3 c of the terms). The recipient does not learn your e-mail address from us, and the licence number and purchase date only after completion, with their new licence key and in their customer account. You see the address you entered in your customer account and in our e-mails to you. After completion we change the licence’s e-mail address to the recipient’s.

The purpose is carrying out the transfer, proving that a licence was transferred lawfully and protecting against fraud. The legal basis is the performance of the licence agreement with you and with the recipient (Art. 6(1)(b) GDPR); before acceptance we process the recipient’s address on the basis of our legitimate interest and your interest in carrying out the transfer you requested, and its hash on the basis of our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).

We keep completed transfers for 3 years after completion (proof, regular limitation period), and cancelled or expired ones for 6 months after they end. We keep counting how many transfers there were per month without any reference to persons.

11. Cancellation and withdrawal declarations

When you submit a declaration through “Cancel contracts here” or “Withdraw from contract here”, your browser sends what you enter to our licence server. Every field is optional: name, e-mail address for the confirmation, e-mail address used for the purchase, licence key, licence or subscription number, type of cancellation, the reason where applicable and the desired date. The server adds the time of receipt and a reference number.

We match the declaration to your licences using the e-mail address of the purchase, a licence or subscription number, or your licence key. We only compare the key with the stored hashes and don’t store it. The confirmation goes to the address you enter; if you don’t enter one, to the address of the purchase your details belong to. We never tell the sender whether an e-mail address has a purchase.

If a declaration doesn’t come from the e-mail address of the purchase, we send that address a message with a “This wasn’t me” link and, if a refund is due and no licence key was entered, a confirmation link. With a licence key, we then carry out the declaration after three days unless someone objects. Without one, we carry it out after a click; a promised refund is made without a click after ten days, only to the payment method used for the purchase. If the declaration names the licence key or the licence or subscription number and gives the address of the purchase for the confirmation, we carry it out right away; the message to that address still carries the “This wasn’t me” link. A subscription cancellation, on the other hand, we register with Paddle without an objection period and without a click; with “This wasn’t me” we undo it until shortly before the end of the paid period. We store the links only as a hash; they work once and until 14 days after receipt, and “This wasn’t me” for a subscription cancellation also longer, until the end of the paid period. We record when a link was used. Our licence server passes cancellations and refunds to Paddle. Nothing is turned down automatically; anything unclear, we check ourselves. You can always reach a person at hello@quadchroma.tech.

The legal basis is compliance with our legal obligations under §§ 312k and 356a of the German Civil Code (Art. 6(1)(c) GDPR) and our legitimate interest in being able to prove receipt and in protecting our customers from declarations by third parties (Art. 6(1)(f) GDPR). We delete declarations 3 years after the end of the year in which they were received.

12. Requests and e-mails to us

Through our forms you can request test access, a test licence for your studio or newsroom, register interest in QuadChroma Enterprise or write to us. We process what you enter: name, e-mail address and, depending on the form, company or publication, website, platforms, use, number of workstations, interests, topic and message. You receive a short confirmation of receipt with the type and number of your request. If you e-mail us, for example at hello@quadchroma.tech or at social@quadchroma.tech (the address of our social projects such as QC-Phone), we process your address and the content in order to reply.

For requests about purchases, licences and trials the legal basis is the performance of pre-contractual measures or of the contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). We delete requests from the forms in our database 6 months after they have been dealt with, at the latest 12 months after receipt. We keep e-mails and enquiries to us in our mailbox for 3 years after they are closed (the regular limitation period). We keep e-mails from customers for as long as the contract runs and after that for up to 10 years, where tax or commercial law requires it or where we need them to trace what happened. The legal basis for this is Art. 6(1)(b) GDPR while the contract runs, otherwise our legitimate interest in tracing what happened (point (f)), and point (c) where a statutory retention obligation applies. If we issue you a test licence, section 7 applies to it.

For individual transactions the licence server itself sends us notices by e-mail, for example about refunds, transfers, self-check reports and trial numbers. They can contain licence, reference, payment and subscription numbers, the beginning of the hashed device ID or of the HMAC from the hardware check value, the build and version number of the app and counts, but no e-mail address. The legal basis is our legitimate interest in dealing with and tracing these transactions and detecting faults and misuse (Art. 6(1)(f) GDPR). The licence service deletes the text once it is sent, after three days at the latest; in our mailbox we keep these e-mails like enquiries for 3 years after the case is closed.

13. Sending e-mail

We send e-mail through our own mail server on our server at STRATO in Germany; the sender is hello@quadchroma.tech. We only send e-mails about a specific transaction: licence keys, sign-in codes, confirmation codes and notices about transferring a licence, notices about two-factor sign-in, confirmations of cancellations and withdrawals, and confirmations of receipt for requests. We send no newsletter and no advertising; our e-mails contain no tracking pixels and no trackable links. Subject lines never contain keys or codes. The mail server logs sender, recipient, time and delivery status; these logs are deleted after 5 weeks at the latest. The legal basis is the performance of the contract or of our legal obligations (Art. 6(1)(b) and (c) GDPR), and for the logs our legitimate interest in reliable delivery (point (f)). The hello@quadchroma.tech and social@quadchroma.tech mailboxes are on the same server.

14. Protection against misuse

So that forms, sign-in and the licence server cannot be misused on a large scale, the licence server counts requests per IP address and per e-mail address. It does so only in memory, with shortened hashes formed with a short-lived key (for IPv6 per /64 and per /48 range; for sign-in codes also per pair of e-mail address and network, per /24 range for IPv4 and per /48 range for IPv6), and only for the respective time window, at most 24 hours. We do not store IP addresses in the database. The licence server also counts ticket requests for the connection service per hashed device ID, likewise in memory only. It also counts new trials per network, for IPv4 per address and per /24 range, for IPv6 per /56 and per /48 range, likewise in memory only, with shortened hashes and only until the end of the day (UTC). The connection server limits requests and simultaneous connections per IPv4 address and per IPv6 network (/64 and /48), and open lists also per QuadChroma network. It counts requests only through shortened hashes formed with a key that changes daily, in memory and for one hour at most; it counts simultaneous connections only while they last. We count wrong codes for two-factor sign-in per customer account in the database; after several wrong codes in a row we lock sign-in for 15 minutes, 1 hour or 24 hours. A correct code resets the counter. The system logs login attempts at the server with the IP address to fend off attacks: attempts via SSH and at the mailbox, and the resulting blocks, are deleted after 5 weeks at the latest; logins to and requests for the server’s administration interface and the webmail access after 13 months at the latest. The forms also contain a hidden field that people leave empty, and they measure how long filling in took (only as a number). Self-check reports and device blocks (section 7) also serve to protect our licences. The legal basis is our legitimate interest in protecting our services (Art. 6(1)(f) GDPR). At your request, the connection server block list also protects your access; what we store for it and on what legal basis is set out in section 7 (“Connection server block list.”).

15. Recipients

Recipients of your data include:

• STRATO GmbH as a processor for hosting our server (section 3);
• Paddle as an independent controller for checkout, payment, taxes, receipts and refunds (section 5);
• for the online status, devices that know your computer’s public key, for example devices that have connected to it before, including earlier remote help helpers, and only whether your computer is signed in to our server at the moment (section 7);
• for a connection over the internet, the other side, i.e. the computer you connect to or the device that connects to your computer. Once the computer agrees, each side learns the public address of the other, and your device also learns the computer’s addresses on the local network. Before that, the computer only gets a short value derived from the address that changes daily, so that it can slow down repeated requests;
• with “My QuadChroma network”, the devices of that network. Through our server they receive the encrypted entries of the network’s computers with name, system and version, and they see when each computer of the network is online. Among themselves, never through our server, they keep the member list up to date (section 7, “Data only on your devices.”). If computers of several people belong to one network, for example across several licences, these include those people’s devices. A removed device that still has the network’s key can read the entries and see presence until the network has been renewed as described in section 20, and for computers that do not have the renewed network yet, even after that. When joining with a code, the other device learns your device name and, if you share the network, its name;
• with remote help, the person you let in. Like with any connection over the internet, they learn your computer’s public address; they see what is on your screen, receive what is transferred, such as sound, clipboard and files, and, if they control it, can do anything in your user account that you can do there (section 7, “Taking back access.”). Anyone who knows your computer’s internet code or public key can also see whether remote help is on at the moment;
• when you transfer a licence, its new holder, and only the details of the licence named in section 10, not your e-mail address.

If the other side, a helper using remote help, or another of these devices is outside the European Economic Area, the details listed above go to that country. For some countries the European Commission has adopted an adequacy decision (Art. 45 GDPR; the Commission’s list). Where no such decision applies, the transfer is based on its being necessary for the connection, list or online status you asked for (Art. 49(1)(b) GDPR, or point (c) if you are not our contract partner yourself).

We also pass on data if we are legally obliged to.

16. Retention periods

Only on your devices (we do not receive this data unless you send it to us; what our servers know of it for the connection service, your trial or your licence is stated in the row concerned and in section 7)

If you ask us to delete your e-mail address, we immediately delete it from your licences and make sure that a later notification from Paddle does not add it again. The licence then remains without an e-mail address; keys by e-mail and the customer account no longer work after that. A running transfer then ends; completed transfers remain stored as proof until their period ends. After a period ends or data is deleted, it may for technical reasons remain for some time until it drops out in the normal course.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Write to us at hello@quadchroma.tech or through the contact form.

18. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte). You can also contact the authority where you live or work or where the alleged infringement took place.

19. Obligation to provide data and automated decisions

You are under no legal or contractual obligation to provide us with data. Without the details for a purchase, an activation or a form we cannot carry out the respective step, for example issue a licence or confirm a cancellation. Without the data for the connection service (section 7), no connection through our connection server is possible, so no remote help through it either and no display of which computers of your network are online. On your local network and over a VPN you connect without it, and devices that already know each other can also connect through port forwarding. There is no automated decision-making, including profiling (Art. 22 GDPR).

20. Security

All connections to quadchroma.tech and lizenz.quadchroma.tech are encrypted with TLS; the servers enforce this permanently through HSTS. Signing in and setting up connections at relay.quadchroma.tech are encrypted with TLS and additionally secured with our server’s key, which the app knows in advance. The app also sends short check requests. They contain a random number and nothing else about you; as with every request, the server sees your public address. Our server cannot make use of what your devices send each other over these connections: it is end-to-end encrypted or, when joining with a code, worthless without the code. A Content Security Policy limits what a page may load. Connections between your computers are always end-to-end encrypted.

Password and keys on your computer. The app stores your QuadChroma password, your device’s private key and your QuadChroma network’s key on the device itself (section 7, “Data only on your devices.”). Protect your devices.

If your computer shows “A newer sign-in of this computer has taken over.” under “Remote & network”, it only signs in again when you turn sharing off and on again on Windows, quit and reopen QuadChroma on a Mac, or restart the computer. If you don’t know why, proceed as in the next paragraph.

Lost or copied keys. If a device is lost, someone may have copied your keys, or you are taking someone’s access back (section 7, “Taking back access.”), proceed as follows. An affected device is any device that is lost or whose keys someone may have, and any device of the person whose access you are taking back; if that person controlled your computer, your computer too. If you want to keep using an affected computer and would like us to block its old key on our connection server (see below), write to us from your licence’s e-mail address before you start the following steps. For this we need a file from that computer or, if it is missing, details about it from another of your devices (section 7, “Connection server block list.”). If you still have the file, you don’t need to wait for our reply before taking the steps: it is only lost when you delete QuadChroma’s folders on that computer (see below), and you only do that once we have it. If it is missing, send us the details before you remove the computer on that other device, under “Remote & network” or with “Remove …” on its card. We’ll tell you where to find the details. For the other steps, you don’t need to wait for our reply here either. For a computer you no longer use, for example because it was stolen, we don’t block its old key on our connection server (section 7, “Connection server block list.”); in that case, start with the steps right away.

If someone can also get into your mailbox, for example because it is set up on the device, secure it first, also before you write to us: change its password and sign the device out there. Then remove every affected computer that is on your licence, including a lost or stolen one: if you still have it, in the app under “Licence” with “Remove this computer”, otherwise in your customer account with “Remove” (in the app via “Manage devices (web)”). If that does not work, write to us from your licence’s e-mail address and we’ll remove it for you (section 7, “Connection server block list.”).

If your licence key was also on the device, for example in the purchase confirmation in your mail app, or if someone can get into your mailbox, also choose “New key by e-mail” in your customer account. After that, check in your customer account which computers are listed there. Remove every one that is still listed although you removed it, and every one you no longer use or don’t clearly recognise as yours. Also remove any computer whose date under “Activated” doesn’t fit.

Then remove the affected device – if that person controlled your computer, that includes your computer itself – from the “Allowed devices” list on all computers (in the menu of the QuadChroma icon). If one of them later runs on Windows without the QuadChroma service, then also remove it there from the app’s older list. If the service is later set up again on one of them, check its list there again afterwards. If it belongs to your network, then remove it under “Remote & network” on another of your devices that you use to control your computers. If you control your computers with several devices and the affected device is a computer, read the next paragraph first. Choose “Remove” for the affected device, tick “Lost or stolen – renew network” and confirm with “Remove for good”. If the device has never connected, remove it on the device on which you added it with a join code; the box is already ticked there. This removes the device and renews the network in one step, but at first only on the device on which you do this (see below).

If the affected device is a computer and you control computers with several devices, first remove it in the same way on all the other ones of these devices, but without the box, and tick it only on the last one. The order matters.

If “Remote & network” does not show the affected device, or you have already removed it without this box, choose “Renew network” under “Remote & network” on a device you use to control your computers and confirm the question.

If you no longer have another device you use to control your computers, choose “Leave network” under “Remote & network” on each of your computers and click it again to confirm. Then change your password on each of them too. After that, add the computers to a network again from a new device.

Whether you tick the box or choose “Renew network”: at first only the device on which you do this has the renewed network. Every other computer of your network only gets it once a device that already has it and is on its “Allowed devices” list connects to it, for example on its local network. Through our connection server this only works while remote help at it accepts new connections. Afterwards, connect once on site to each of your computers from a device that has the renewed network. Then change your password. After remote help, also check under “Remote & network” on your computer which network the app shows there. If it is not your network, or you have just removed the computer from your network, leave it there unless you delete QuadChroma’s folders on it anyway (see below).

On your other devices, also remove the old entry of every affected computer where this has not already happened when removing it from the network (section 7, “Removing paired computers.”). Don’t give out its old internet code any more.

If you want to keep using the affected device, it needs a new key. It only gets one if you delete QuadChroma’s folders on it. This also deletes its password, its settings and its paired computers, and on a computer also the files of its licence or trial. So remove a computer from the licence first, as described above. If you want a block and still have the ticket file, only delete the folders once we have it. After that, quit QuadChroma and delete the folders, on Windows as described in the next paragraph. Finally, on a computer, activate your licence again and add the device to your network again. Afterwards, don’t restore QuadChroma’s folders from your own backup.

On Windows you proceed differently if QuadChroma has ever been installed there with the setup, even if you have since uninstalled it or removed the service. If you’re not sure, follow these steps anyway. If you have only used a portable copy and set up “Access before sign-in” in it, or are not sure about that, write to us first and we’ll tell you the steps. First quit QuadChroma and uninstall it if it is still installed. Then delete the QuadChroma folder in your app data and the service’s folder in the program data, which needs administrator rights, and install QuadChroma again. Reinstalling, or deleting only one of these folders, is not enough. After reinstalling, sharing under “This PC” may be switched on; if you don’t need it, switch it off there. If uninstalling or the setup fails, write to us.

A computer also gets a new internet code this way. If the app then shows “This computer is already reachable under another user.” under “Remote & network”, write to us.

Once the old computer has been removed from your licence and your computer has a new key, we’ll block the old key on our connection server at your request (see above; section 7, “Connection server block list.”). While the block is in place, the server does not accept this key. It applies only there, so the steps above are still needed. You can also ask for the block later, as long as you still have the file or the details from another of your devices.

Windows service. If QuadChroma runs as a service on Windows, the app does not give the service your password, only a key derived from it. The service does not store this key; it keeps it in memory only. It expires when you sign out of Windows, switch users or the service restarts; a locked screen changes nothing. So after a restart your password only works again once you have signed in. Anyone who comes in without a password, such as the devices of your network, can still come in until then.

21. Version and changes

This policy was last updated on 7 November 2026. If our processing changes, we update it; the version on this page applies.