Privacy policy: short version
Last updated: 7 November 2026
This is the short version. Only the full privacy policy is binding. It covers the website, the QuadChroma app (described from version 1.1.0), purchases, the licence server and the customer account; QC-Phone has its own policy.
Who is responsible
Robert Brandt, trading as QuadChroma, Schenkenberger Str. 3a, 04509 Delitzsch, Germany, hello@quadchroma.tech.
What the website and the app do and don’t do
- The website sets no cookies, has no tracking and no analytics services. Only after you click “Continue to checkout” does it load the Paddle checkout, where Paddle can set cookies. The customer account sets two strictly necessary cookies.
- From our server logs we work out simple statistics as totals and build no profiles from them. We make no automated decisions under Art. 22 GDPR.
- The app sends us no usage data, with one exception: after a connection attempt over the internet it reports, without any identifier, which path worked. Once a day it asks for updates; you can switch that off. It contacts the licence server only for the trial, the licence, self-check reports and the connection ticket; a client never does.
- Picture, sound, input, clipboard and files do not pass through our servers; they go directly between your devices, end-to-end encrypted. Over the internet our connection server only helps them find each other. A computer in no QuadChroma network with remote help off, as it is out of the box, does not sign in there. As a client the app uses the server, for example, when you connect over the internet or when the “Computers” page checks the status.
Which data, and what for (legal basis: Art. 6(1) GDPR)
| Area | Data and purpose | Legal basis | Deletion |
|---|---|---|---|
| Purchase and licence | E-mail address, language, Paddle numbers, subscription status; per device the hashed device ID, platform, device name, app version. For your licence and device slots. No payment details. Self-check reports if something looks unusual. | (b); after the term and for the reports (f) | Term plus 3 years; e-mail address on the licence at once on request. Licence key kept ready for about 24 hours, after that in the database only as a hash. Signed-out devices after 90 days, devices without contact and self-check reports after 12 months. |
| Trial | Hashed device ID, platform, major version, trial period, on Windows a hardware check value as a hash; no name or e-mail address. One trial per computer and major version. | (f) | 24 months after the trial started. |
| Connection service | While a computer is signed in: public address, public device key, internet code, ticket (shows a licence or running trial), app version; in a QuadChroma network also a random identifier and an encrypted entry. For a connection request: the public addresses of both sides. Online status query: only check values of public keys, not stored. Open “Computers” page and joining with a code: the devices’ addresses. So that computers find each other and you see which are online. | (b); in the cases in section 7 of the full policy (f) | In memory only: sign-in and network list until 2 minutes after signing out, connection requests up to 2 minutes, open pages per connection and joining with a code up to 10 minutes. A check value of the key at the licence server (f): up to 24 months after the last ticket. |
| Remote help | Off out of the box. Data as for the connection service; our server can tell that remote help is on. Your computer keeps a guest list, so that a guest can return after an interruption. | (b); in the cases in section 7 (f) | Server as for the connection service. Guest list only in your computer’s memory, up to 10 minutes after disconnecting. |
| Logs | Website, also update checks: IP address, time, address, referrer, browser. Licence and connection servers: no IP address, except self-check reports and rare serious errors. Mail server: sender, recipient, time, status. For operation, security, troubleshooting, statistics. | (f) | After 5 weeks at the latest; we keep the totals. IP addresses at the administration interface and webmail: after 13 months at the latest. |
| E-mail and requests | E-mail address, message and what you enter in a request form. To answer you and to trace what happened. | (b) for purchase, licence, trial, otherwise (f); (c) where we must keep them by law | Form requests in the database 6 months after they are settled, at most 12 months after receipt; e-mails and enquiries in our mailbox for 3 years after they are closed; e-mails from customers for as long as the contract runs and after that for up to 10 years where needed. |
More, such as the customer account, licence transfers, cancellations, the block list, device blocks, devices removed from a network and what stays only on your devices, is in the full policy (section 7, 9 to 11), periods mainly in section 16. After a period ends or data is deleted, it may for technical reasons remain for some time until it drops out in the normal course.
Who receives data
Recipients of your data include:
- STRATO GmbH as a processor for hosting our server in Germany.
- Paddle as an independent controller for checkout, payment, taxes, receipts and refunds; according to Paddle, it also processes data outside the EU, for example in the United Kingdom and the United States (Art. 45, 46 GDPR).
- For a connection over the internet, the other side (public address; your device also learns the computer’s addresses on the local network). In a QuadChroma network, its devices (name, system, version, when a computer is online); they can reach, see and control your computer from anywhere without a password whenever sharing is on. Anyone who knows your computer’s password, or for whom you click “Allow” on it, can add it to their network. With remote help, the person you let in: they see your screen, receive what is transferred and, if they control your computer, can do anything in your user account that you can do there. Devices that know your computer’s public key, including earlier helpers, see whether it is signed in; anyone who knows that key or its internet code, also whether remote help is on. When you transfer a licence, its new holder (licence details only).
If one of these devices is outside the European Economic Area, these details go to that country (Art. 45, otherwise Art. 49(1)(b) or (c) GDPR). We also pass on data if we are legally obliged to.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–18, 20 GDPR) and can withdraw consent at any time with effect for the future. Write to hello@quadchroma.tech or use the contact form.
Right to object (Art. 21 GDPR): Where we rely on our legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation. An informal note to us is enough.
You can complain to the Saxon Data Protection and Transparency Commissioner, who is responsible for us, or to the supervisory authority where you live or work or where the alleged infringement took place.
This is the short version. Only the full privacy policy is binding.