Privacy Policy

This Privacy Policy explains what information the QDev browser extension and the QDev website (www.qdev.app) collect, how it is used and shared, how long it is kept, and the rights you have over it. For a plain-language summary, see our privacy overview. Where the two differ, this document controls.

01Who we are

QDev (“QDev”, “we”, “us”) is a product operated by Ben Watson as an individual sole operator; there is no separate legal entity. Ben Watson is the data controller for the personal data described in this policy. You can reach us about privacy at privacy@qdev.app.

02What QDev never collects

The extension's core purpose is local. Opening a file, browsing the tree, inferring a schema, viewing the graph, searching, and running jq all happen inside your browser tab and touch no network. Accordingly, we do not collect, transmit, store, or have any access to:

• The JSON, YAML, or TOON documents you open, at any size;
• The actual values inside them — strings, numbers, nested objects and arrays;
• The jq queries you run locally, or their results;
• Your browsing history or the content of pages unrelated to viewing a document.

03Information we collect and process

a. Local use of the extension.None. No account is required and nothing is sent to us. The optional on-device AI modes (WebLLM/WebGPU, Chrome's built-in model, or a local Ollama instance) also send nothing off your machine — not even the schema.

b. Hosted AI queries (optional, Pro tier). If you choose the hosted AI mode, then each time you ask a question we transmit a bounded payload to our proxy, which forwards it to our model provider so it can write a jq query:

• The inferred schema (field names and value types — not values);
• Your natural-language question;
• Value-masked structural metadata the agent uses to refine the query — counts, value types, object keys, and masked samples. Real values are redacted before they leave your tab (for example, a number is masked to 0).

The generated jq then runs locally against your full document. The model helps write the query; it never receives the answer. This is text-to-query, not read-and-answer.

c. Account information. A QDev account is required only for the hosted tier. Authentication is handled by Clerk, which holds your email address and account identifiers. When you connect the extension, it stores an opaque, revocable entitlement token scoped to your subscription; it is not a session key and grants no access to your data.

d. Billing information. Payments are processed by Stripe through Clerk Billing. Your card details are handled by Stripe; QDev never receives or stores full card numbers. We receive your subscription status.

e. Website analytics and logs. The QDev website uses Google Analytics, which sets cookies and collects your IP address, pages viewed, and similar usage data to help us understand aggregate traffic. Our hosting provider also keeps short-term operational server logs. The browser extension does not run analytics.

f. Abuse prevention. The proxy keeps transient counters tied to your account and entitlement to enforce rate limits and prevent abuse. These hold identifiers and tokens, not your content.

g. Support. If you email us or open a GitHub issue, we receive whatever you choose to include.

04How we use information

• To provide the hosted AI feature you invoke (generate and return a jq query);
• To create and manage your account and subscription;
• To process payments and prevent fraud (via Stripe/Clerk);
• To enforce rate limits and protect the service from abuse;
• To understand aggregate website usage and improve the product;
• To respond to your support requests and comply with legal obligations.

We do not sell or share your personal information, and we do not use your data to train AI models.

05Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract to provide the hosted AI feature, accounts, and billing; legitimate interests to secure the service and prevent abuse; consent for website analytics cookies, which you may withdraw; and legal obligation for tax and record-keeping.

06Who we share data with

We share data only with the service providers (sub-processors) below, each acting on our behalf for the stated purpose, and only as needed. We may also disclose information if required by law or to protect our rights and users.

07Data retention

• Hosted AI prompts and results:the proxy is zero-retention — it does not log or store your prompts or the model's responses. They exist only for the duration of the request.
• Account and billing records: kept while your account is active and as long as needed for legal, tax, and accounting requirements, then deleted or anonymized.
• Abuse-prevention counters: short-lived; expire automatically.
• Website analytics: retained according to our Google Analytics configuration.

08Data security

Data in transit is encrypted with TLS. Access to account and billing systems is limited and handled by our processors (Clerk, Stripe). No method of transmission or storage is perfectly secure, but the extension's local-first design means the most sensitive data — your documents and their values — never leaves your device in the first place.

09International transfers

Our providers may process data in the United States and other countries. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to restrict or object to processing, and to withdraw consent. Under the GDPR/UK GDPR you may also lodge a complaint with your supervisory authority.

If you are a California resident, you have the right to know, delete, and correct your personal information, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any right, email privacy@qdev.app. You can also delete your account at any time, which removes your associated account data.

11Cookies

Analytics cookies (Google Analytics) are opt-in: they load only after you accept them in the cookie banner, and you can withdraw consent at any time via the “Cookie preferences” link in the site footer. Strictly-necessary authentication cookies are set by Clerk only when you sign in. The browser extension itself uses no tracking cookies. You can also control cookies through your browser settings.

12Children

QDev is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13Changes to this policy

We may update this policy from time to time. Material changes will be reflected by a new “last updated” date above and, where appropriate, additional notice.

14Contact

Questions or requests? Email privacy@qdev.app.