Privacy
Privacy policy
This policy describes this version of Qavuqo. Have counsel review it for the countries you serve before launch. It does not say that nobody ever stores anything: hosting and model providers can keep their own logs.
What this application does
Qavuqo offers free tools for video prompts, prompt conversion, storyboards, price estimates, and error notes. There is no account, no checkout, and no application database of prompts.
Data
- Prompt and error text is read in memory to answer the request. It is not written to an application database, and it is not used to create a public page.
- Generated text is returned to your browser. This app does not keep a copy.
- The cost calculator runs in the browser and does not send the duration or token count to an API.
- A first-party cookie named qv_sid stores a random id and per-tool request counts for about one day. It does not contain prompt text. A second cookie, qv_consent, stores your analytics choice for about 180 days. A third cookie, qv_locale, stores a language you choose for about one year.
- For abuse control, a salted hash of the platform client address (Cloudflare CF-Connecting-IP, or x-real-ip in local development) and the request time may be stored in Supabase for up to two hours. The raw address is not stored. If Supabase is not configured, that hash stays in process memory instead.
- No payment data and no email address is collected from visitors.
Processors
- Cloudflare Workers: hosting, TLS, and platform logs.
- Supabase: salted network hashes, request times for abuse limits, and a daily estimated spend total. Prompt text is not stored.
- Resend: may email the privacy contact when the daily AI budget is exhausted. The message contains no prompt text and no visitor address.
- The model provider you configure with a server-side API key: it receives the prompt text only when an AI tool actually runs. Which company that is depends on your environment, not on a fixed vendor built into the page.
- Google Analytics 4, only if a measurement id is configured and the visitor chooses Allow analytics. Google may set its own cookies and process usage data (including outside your country) under Google's terms. Prompt text is not sent in analytics events from this app.
- Plausible, only if a domain is configured and the visitor chooses Allow analytics. Events are limited to the tool name, a latency bucket, a public error code, a copy action, or a call-to-action placement. Prompt text is not included.
- Google AdSense may show ads after the publisher account is approved. This site publishes an AdSense account meta tag and an ads.txt file for verification. Display ad units are enabled separately; until then, this app does not load the AdSense advertising script.
Supabase stores abuse-control counters and a daily spend total only. Do not store prompts there.
Analytics and cookies
The tools work if you choose Essential only, and they work if you dismiss nothing and simply never allow analytics. Analytics is non-essential. There is no session replay from this app. When you allow analytics, Google Analytics 4 (and Plausible if configured) may load. AdSense, when enabled, may set cookies or local storage under Google's advertising terms.
Retention and transfers
Application storage of prompts is not part of this build. Platform and provider logs follow those companies' own retention rules and may be processed outside your country. Security logs from this app are limited to event names, tool names, and public error codes.
Children
Qavuqo is not directed at children under 16. Do not submit information about a child.
Requests
Because prompts are not stored, this app cannot retrieve or delete a past prompt. If you believe some other identifier exists, write to the privacy contact. Set that mailbox in PRIVACY_CONTACT_EMAIL before launch.