Privacy Policy
Last updated: 23 October 2026
This policy explains what QCode does with your data, who else sees it, and what rights you have. It covers the QCode iPadOS and iOS application and the services at qcodeapp.com and api.qcodeapp.com.
The short version. Your code lives on your device. We do not keep a copy. When you press Run, the one file you are running is sent to our servers, executed in an isolated container, and deleted. If you use the AI assistant, that file and your prompt are sent to OpenAI. If you connect GitHub, your code goes to GitHub. We have no accounts, and we never sell data.
Who is responsible
The data controller for the purposes of the EU General Data Protection Regulation (GDPR) is the individual developer who publishes QCode, reachable at matejkosc1@gmail.com. QCode is operated from the Slovak Republic.
What we process, and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| The file you run, plus any input you type | To execute it and return the output | Performance of a contract (Art. 6(1)(b)) | The duration of the run, then deleted |
| IP address, language, timestamp of a run | Rate limiting, abuse prevention, fault diagnosis | Legitimate interests (Art. 6(1)(f)) | Up to 30 days in server logs |
| Firebase installation identifier | Basic app initialisation | Legitimate interests (Art. 6(1)(f)) | Per Google's retention |
| Your prompt and the open file, if you use the AI assistant | To generate a response | Performance of a contract (Art. 6(1)(b)) | Not retained by us; see OpenAI below |
| Subscription status | To unlock Studio features | Performance of a contract (Art. 6(1)(b)) | Held by Apple; read on device |
What we do not process
- We do not ask for, and do not have, your name, email address or any account with us. QCode has no sign-up.
- We do not receive your payment details. Apple processes all purchases.
- We do not store your projects, files or project history on our servers.
- We do not sell, rent or share personal data with anyone for their own purposes, and we do not use it for advertising or profiling.
Code execution
iOS cannot compile and run arbitrary languages on device, so running code requires a server. When you press Run, QCode sends the contents of the file you are running, and any standard input you typed, to our execution service at api.qcodeapp.com.
Each run happens inside a single-use container with no network access, a memory limit, a process limit and a time limit. The file is written to a temporary directory, executed, and that directory is deleted as soon as the run finishes. We do not read your code, retain it after the run, or use it to train anything.
Our servers keep short-lived operational logs that may include your IP address, the language you ran and a timestamp. These exist to enforce rate limits and to diagnose faults, and are not linked to an identity because we hold none.
The servers are operated by us on infrastructure rented from Hetzner Online GmbH, located in the European Union.
The AI assistant
QCode Studio includes an assistant powered by OpenAI. If you use it, your prompt and the contents of the file you have open are sent to OpenAI's API at api.openai.com to produce a response. We do not store these exchanges on our servers.
OpenAI processes that data under its own terms and privacy policy, which govern how long it is kept and whether it may be used for model improvement. If your code is confidential, do not put it through the assistant. The rest of QCode works without it.
GitHub
If you connect GitHub, your personal access token is stored only in your device's Keychain and never sent to our servers. Requests to GitHub and to Codespaces go directly from your device to GitHub; they do not pass through our infrastructure. What GitHub does with that data is governed by GitHub's own privacy statement.
Who else receives data
| Recipient | What they get | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of our execution servers | EU (Germany) |
| OpenAI | Prompts and open file, only when you use the assistant | United States |
| GitHub, Inc. | Repository and Codespace data, only if you connect it | United States |
| Apple Inc. | Purchases and subscription status | Per Apple |
| Google (Firebase) | App initialisation data | United States |
Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to each provider.
Your rights
Under the GDPR you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Write to matejkosc1@gmail.com and we will respond within one month.
Because QCode has no accounts and keeps no profiles, the data we hold that could relate to you is limited to short-lived server logs. To act on a request about those, we may need the approximate time of use and the IP address concerned; without them we may be unable to locate any record, and we will say so rather than guess.
If you believe we have handled your data unlawfully, you may lodge a complaint with your local supervisory authority. In Slovakia this is the Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky).
Security
Traffic between the app and our servers uses TLS. Execution happens in containers with no network access and enforced memory, process and time limits. Credentials you supply, such as a GitHub token, are kept in the device Keychain.
No system is perfectly secure, and we do not promise that ours is. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the competent supervisory authority as the GDPR requires, and affected users where it requires that too.
Children
QCode is not directed to children under 13, and we do not knowingly process their personal data. In the European Economic Area, where consent is the basis for processing, QCode is not intended for anyone under 16. If you believe a child has provided personal data, contact us and we will delete what we can locate.
Changes
We may update this policy. The date at the top always reflects the current version, and significant changes will be signalled in the app. Continuing to use QCode after a change means the updated policy applies to you.