# Privacy policy What we collect when you use Quova, why we collect it and who else sees it. This covers quova.io, the dashboard at app.quova.io, the API and the MCP server. Last updated 28 October 2026 ## Your account When you sign up we collect your name, your email address and a password. The password is stored as a salted hash, so nobody at Quova can read it. If you sign in with Google instead, Google shares your name, email address and profile picture with us. We only ask Google for that basic profile, so we can't see your email, files or anything else in your Google account. If you turn on two-factor authentication we store its secret and your backup codes, both encrypted. Each time you sign in we record the IP address and browser of that session, so you can see where you're signed in and sign out other devices from your security settings. ## Organisations and teams Everything in Quova belongs to an organisation. We store its name, its members and their roles, and the invitations sent from it, meaning the address invited, who sent it and the role offered. Other members of your organisation can see your name, your email address and whether you use two-factor authentication. For each API key we store its name, who created it, its limits and any IP allowlist. We only keep a hash of the key itself, which is why we can't show it to you again after it's created. When you connect an AI client over MCP, we store what the client tells us about itself (its name, website, logo and redirect addresses) and the connection you approve. The approval page loads the client's logo from the client's own website. ## API and MCP requests Every request made with one of your keys or MCP connections is logged. The log records the time, the key, the endpoint, the path and query string, the first 4 KB of the request body, the status, how long it took and the credits it cost, along with the IP address and user agent it came from. We don't log responses. Before a request is stored we strip anything that looks like a Quova key or token. Everyone in your organisation can see its request logs in the dashboard, IP addresses included. ## Billing Payments go through Stripe. Stripe collects your card details, billing address and any tax ID directly, and card numbers never reach our servers. We give Stripe your organisation's name and the email address of whoever sets up billing. On our side we keep the Stripe customer and subscription IDs, your plan, and how many credits you've used so we can bill overage. ## Free tools on quova.io The free tools on quova.io send what you look up, such as symbols, dates and currencies, to our API. Those requests aren't logged or tied to anyone. We count them per IP address for about a minute to stop abuse, and then the count is gone. Amounts you paste into the tax exchange rate tool are converted in your browser and never sent to us. ## How we use it We use this information to run Quova. That means signing you in, answering your API requests, enforcing your plan's limits, billing you and helping when you get in touch. We also use it to keep the service secure, for example by limiting sign-in attempts and looking into abuse, and to find and fix problems. The only emails we send are ones the service needs: confirming your email address, password resets, invitations, changes to your email address, and notes to an organisation's owners and admins about its plan, like a trial ending, credits running low or a payment that didn't go through. Stripe may email you receipts and invoices. We don't send marketing email, we don't run advertising trackers, and we don't sell your information. We use PostHog to see how people find and use our sites, like which pages they visit and where they get stuck, so we can improve them. On the dashboard it's tied to your account and also records sessions, with everything you type hidden and API keys, two-factor secrets and backup codes left out of the recording entirely. ## Who else sees it We use a few other companies to run Quova, and they handle personal information on our behalf: - Hosting and network providers run our servers and databases, and all traffic to Quova passes through their networks. - Stripe handles payments, invoices and sales tax. - PostHog runs our product analytics and session recordings. - Google is involved if you sign in with it. These providers may process information in countries other than yours. When we fetch market data from our sources, the request only describes the data, like a symbol or a date range, and never who asked for it. A small number of Quova staff can see account and organisation details, including sessions and their IP addresses, so they can support you and run the service. Every change staff make to a customer's account is recorded. We'll also disclose information when the law requires it, and if Quova is ever sold or merged, the new owner would take it over under this policy. ## Cookies and browser storage Both sites set one PostHog cookie, named after our project and starting with `ph_`, which holds a random ID so visits can be counted and, once you sign in, tied to your account. It lasts a year. The dashboard at app.quova.io also sets a few cookies needed to sign you in, none of them readable by scripts on the page. | Cookie | What it's for | How long | | --------------------------------- | ---------------------------------------------------------------------------------- | --------------------------- | | \_\_Secure-quova.session\_token | Keeps you signed in | 7 days | | \_\_Secure-quova.two\_factor | Holds your sign-in while you enter a two-factor code | 10 minutes | | \_\_Secure-quova.trust\_device | Skips the two-factor code on a device you chose to trust | 30 days | | \_\_Secure-quova.password\_holder | Remembers which browser chose the password for an account that isn't confirmed yet | 1 day | | \_\_Secure-quova.state | Protects Google sign-in from forgery | 5 minutes | | \_\_Secure-quova.dont\_remember | Signs you out when you close the browser, if you untick remember me | Until you close the browser | Both sites also keep some settings in your browser's local storage, which isn't sent to us: your theme, the language you picked for code examples, the organisation you last opened, your dashboard layout, a flag saying you're signed in, and your last 20 playground requests. Your dashboard layout is saved on our servers too, so it follows you between devices. The billing page loads Stripe's checkout, which sets its own cookies to prevent fraud. Our network provider may also set cookies to protect our sites from bots and attacks. ## How long we keep it | What | How long we keep it | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------- | | Your account | Until you delete it | | Organisation data | Until the organisation is deleted. This covers members, invitations, keys, usage totals and billing records | | Request logs | 30 days | | Hourly request summaries | 90 days. These are counts only, with no IP addresses or query details | | Sessions | 7 days, or until you sign out or revoke them | | Password reset links | 30 minutes | | Rate limit records | A day after the last attempt. Some of these include an email or IP address | | Records of staff actions on accounts | Indefinitely | | Analytics events | 7 years, or until you ask us to delete them | | Session recordings | 30 days | Deleting an organisation deletes its data straight away, request logs included. Stripe keeps the billing records it's legally required to. ## Security Traffic to Quova is encrypted with TLS. Passwords and API keys are only stored as hashes, and two-factor secrets and Google sign-in tokens are encrypted. You can require two-factor authentication for everyone in your organisation. Staff need a password and a two-factor code to reach our admin tools, and they can't sign in as you. If a breach ever affects your information, we'll tell you and the relevant regulators as the law requires. ## Your rights You can change your name and email address in your account settings, delete an organisation you own from its settings, and delete your account from your account settings. If you're the only owner of an organisation, you'll need to delete it or make someone else an owner first. You can also ask for a copy of the personal information we hold about you, ask us to correct it, or object to how we use it. Email [support@quova.io](mailto:support@quova.io) from the address on your account and we'll reply within 30 days. If you're not happy with our answer, you can complain to the data protection regulator where you live. ## Changes to this policy When we change this policy we'll update the date at the top. If a change affects how we use information you've already given us, we'll email organisation owners before it takes effect. ## Contact Questions about privacy go to [support@quova.io](mailto:support@quova.io).