Privacy
What this site stores.
The operator and seller for this Cue website is Nandor Sperl, who is the controller of the account data below. A postal address is not published on this page; people can ask for it through the contact form.
Account
When you sign up we store your name, email address, and a password hash. We do not store the password itself. Argon2id is used where PHP supports it, otherwise bcrypt.
License and payment
We store whether the license is unpaid or active, a license key after payment, and the Stripe Checkout session and payment intent identifiers. Card numbers stay with Stripe. We never see the full card.
Device
The app can register one device. We store the name you send and a SHA-256 hash of the device id, plus when it was activated or released. We do not need the raw device id again to recognize that same device.
Sessions and API tokens
The website uses a session cookie named in the server configuration. It is HttpOnly and SameSite=Lax, and marked Secure when the site is served over HTTPS. The future app uses a bearer token. We store only a hash of that token. Tokens expire after 90 days or when you log out of the app. Resetting a password revokes app tokens.
Messages and security logs
The contact form stores your name, email, message, the IP address, and the time. Repeated contact posts are counted for about an hour by IP address and by a hash of the email, so automated sending can be slowed. Those counts are deleted with the other attempt rows after two days. Failed logins store the email, IP address, and time for about two days so we can slow guessing. Password reset links are stored as hashes and expire after one hour.
Contact messages are stored in the database and emailed to info@koalitydev.com. Signup, password reset, and license emails are sent from info@koalitydev.com.
How long
Account, license, and device rows stay until you ask for them to be deleted. Login attempts are deleted after two days. Reset tokens are single use. You can ask for access, correction, or deletion through the contact form. If you are in the EEA or the UK, you can also complain to your data protection authority.
Advertising
This website does not use advertising pixels or sell personal data.