Privacy Policy

This Privacy Policy explains what personal data Quantic Heartz LLC ("Quantic Heartz", "we", "us") collects when you use our website at quanticheartz.io, our macOS application "Quantic Heartz", our Android application "Quantic Heartz", our browser extension "Quantic Heartz" for Google Chrome, and our API at api.quanticheartz.io (together, the "Service"), how we use that data, who we share it with, and what rights you have over it.

We try to collect only the data we need, and we do not sell your data. Most of what is described below is needed to provide the Service to you or to comply with the law. In addition, we measure how people find and use our website and which of our campaigns work (section 2, "Website statistics and campaign attribution", and section 3). Anything we store in your browser for this, and anything we send to an advertising or analytics company, happens only with your consent. Your audio never leaves your device.

1. Data controller

The data controller under the EU General Data Protection Regulation (GDPR) and equivalent laws is:

Quantic Heartz LLC
1621 Central Ave
Cheyenne, WY 82001
United States of America
EIN: 30-1473602
Email: support@quanticheartz.io

We have not designated a Data Protection Officer. Under Art. 37 GDPR a DPO is only mandatory where the controller is a public authority, carries out large-scale monitoring of individuals, or processes special categories of data on a large scale. None of these apply to Quantic Heartz.

2. What data we collect and why

Account and subscription data

When you create an account or purchase a subscription we process your email address, your name (if you provide one), your billing country, and a unique customer identifier issued by our payment processor Stripe. We need this data to create your account, deliver the Service, send you transactional emails (receipts, licence keys, password resets), and comply with tax and accounting obligations.

When you sign in to one of our apps, we also store an identifier of your device (on a Mac its hardware UUID, on Android a random ID that the app creates when it is installed), the name of the device, and your operating-system and app versions. We use this to limit how many devices can use one licence at the same time.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Payment data

Payments are processed by Stripe, Inc. (United States) on behalf of our US entity Quantic Heartz LLC. Your full card number, CVC, and expiry date are entered directly into Stripe's checkout and never reach our servers. We receive only the last four digits of the card, the card brand, the billing country, the transaction amount, and the Stripe customer and subscription identifiers. We use this data to match your payment to your account and to issue refunds.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Purchases in the Android app (Google Play)

Our Android app is distributed through Google Play. If you subscribe in the Android app, the purchase is made through Google Play Billing. Google processes your payment details under its own terms; we never see them. We receive from Google what we need to activate and manage your subscription: the order and purchase identifiers, the product you bought, and whether the subscription is active, renewed, cancelled, or refunded. Google Ireland Limited acts as an independent controller for its own processing in Google Play — see Google's privacy policy.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Sign-in with Apple or Google (optional)

If you choose to sign in with Apple or Google, we receive an opaque user identifier issued by Apple or Google and the email address you authorised to be shared. We do not receive your Apple or Google password, contacts, calendar, or any other data from your account there. Apple Inc. and Google Ireland Limited act as independent controllers for their own processing related to these sign-in services — see Apple's privacy policy and Google's privacy policy.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Using our apps

Our apps process audio only on your device. The macOS app converts the audio your Mac is playing from 440 Hz tuning to 432 Hz tuning in real time; the Android app does the same on your phone. The audio never leaves your device — we do not record, transmit, or store what you are listening to.

While tuning is active, our apps send a short signal ("heartbeat") to our server about once a minute. It is sent together with your sign-in token, so our server knows which account it comes from. It contains only the number of seconds the app has been tuning since the last signal — no audio, and no information about what you listen to or in which app. We use it to add to the global listening counter shown on our website (the counter itself contains no personal data), to keep a running total of the listening time of your account, and to count how many accounts are active right now and on a given day. The lists of active accounts are deleted automatically after at most 48 hours; the running total is kept for as long as your account exists.

Legal basis: our legitimate interest in operating the Service and understanding how much it is used (Art. 6(1)(f) GDPR).

Our Chrome extension

Our extension for Google Chrome retunes the audio of a browser tab from 440 Hz to 432 Hz. It does this only after you switch it on for that tab, and only until you switch it off or close the tab. The audio is processed on your computer and never leaves it. The extension does not read the content of the pages you visit, keeps no browsing history, and sends us no heartbeat.

To use the extension, you sign in with your Quantic Heartz account (email and password, or Google). To sign you in or create your account, the extension sends your email address and password, or the sign-in token from Google, to our API. It then keeps your email address and our sign-in token in the extension's storage in your browser until you sign out or remove the extension, and from time to time asks our API whether that sign-in token is still valid.

These requests carry the extension's version number. We store with your account when the extension last contacted our API, its version, and the country derived from the IP address of the request using a location database on our own server (the IP address itself is not stored). This lets us count how many people use the extension and in which countries.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for the usage count, our legitimate interest in knowing how our products are used (Art. 6(1)(f) GDPR). You can object to the usage count at any time by emailing us.

Bug reports (optional, user-initiated)

If you use the "Send Report" feature inside one of our apps, the app collects the most recent technical logs from your device (compressed and truncated) and sends them, together with any description you provide and your email address, to our support team. Logs may contain your macOS or Android version, the audio devices connected, your app version, and diagnostic messages from the application. They do not contain audio content.

Legal basis: your explicit request for support (Art. 6(1)(b) GDPR). We only receive this data when you actively submit a report. Bug-report logs are retained for up to 90 days and then deleted.

Server logs

Our web server automatically records technical information about each request to our website and API: IP address, time, the requested address including any parameters in it, response status, the referring page, and the browser's user-agent string. These raw logs are deleted automatically after 14 days. Before that, entries for visits to our website pages and for downloads of the Mac app are copied in reduced form into our statistics database (see the next section). We use the logs to operate the Service, detect abuse, and fix errors.

Legal basis: our legitimate interest in securing and operating the Service (Art. 6(1)(f) GDPR).

Website statistics and campaign attribution

We measure visits to our website with our own code and our own server, without third-party services. The usage analysis with Microsoft Clarity is separate and runs only with your consent (section 3). This works as follows:

• Without your consent, nothing is stored in your browser for this. For each page you view and each click on a download button, on the "Send to Mac" button or on the button to our Chrome extension in the Chrome Web Store, your browser sends our server the page address, the previous page, your browser language, a random number that exists only while the page is open, and, if the link that brought you to us contained them, its campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), a creator or referral code (ref or via), and the click identifier that ad platforms add to their links (fbclid from Meta, gclid from Google, ttclid from TikTok, msclkid from Microsoft).
• With your consent ("Accept" in our cookie banner), the website also keeps a random identifier (qh_cid) and two short records of the first and the most recent visit that brought you to us (qh_attr_first, qh_attr_last) in your browser's local storage, and a session identifier that is removed when you close the tab (qh_sid, session storage). The records contain the time, the page you landed on, the website you came from, and the link details listed above. They are sent along with each of the events described above, and the random identifier is added to the download link of the Mac app. This lets us see which campaign brought you, even if you come back days later. If you reject or withdraw your consent, the website deletes these entries from your browser.
• Our server stores these events with a shortened hash of your IP address (the first 12 characters of a SHA-256 hash; the IP address itself is not stored in this database), the type of device, browser, and operating system derived from the user-agent, and the country and city derived from your IP address using a location database that runs on our own server. Website visits taken from our server logs and each download of the Mac app are stored in the same way.
• When you create an account, we look for website visits from the same shortened IP hash in the preceding 72 hours and store with your account where you came from: campaign parameters, click identifier, referring website, landing page, country, and device type.
• In addition, when you create an account we store with it the country and, where our location database knows it, the city of the internet connection you signed up from (derived from your IP address on our own server; the IP address itself is not stored), whether you signed up in the Android app, the Mac app, the Chrome extension or on the website, the app version, on Android the phone model, the operating-system version, and your device language. This also applies if you did not visit our website beforehand, for example when you installed the Android app from Google Play.
• In our apps we also record, once per device, which setup and onboarding steps were reached (for example “setup finished”, “first time tuned”, “subscription page shown”), together with the app version and a random device identifier, and how many of the 60 free tuning minutes an account has used. No audio and nothing about what you listen to is recorded.

We use this to understand how people find Quantic Heartz, where new users get stuck in the app, which campaigns and creator partnerships bring customers, and how much to spend on them. This data stays on our own servers and is not passed to advertising platforms.

Legal basis: for keeping the identifier and the records in your browser, reading them, and linking your visits with them, your consent (Art. 6(1)(a) GDPR, together with § 25(1) TDDDG, § 165(3) TKG 2021, or the corresponding national rules implementing Art. 5(3) of the ePrivacy Directive). You can withdraw it at any time via Cookie settings. For everything else in this section (the events without these identifiers, the server logs, matching your account with website visits, and the sign-up details stored with your account), our legitimate interest in measuring and improving our marketing (Art. 6(1)(f) GDPR). You can object to this at any time by emailing us; we then delete the record of how you found us that is stored with your account.

We have not yet set a fixed deletion period for these statistics. We keep them for as long as we need them to evaluate our marketing, and we will state a fixed period here once we have set one. The record of how you found us that is stored with your account is deleted together with your account.

Creator program applications

If you apply to our creator program, we process the name, email address, Instagram handle, and preferred code you enter, in order to review your application and get back to you. Our server also stores the IP address from which you sent the application, and it is included in the notification email to our support team. We use the IP address to limit the number of applications from one address and to detect misuse. We keep the application, including the IP address, for as long as we need it to handle your application and any cooperation that follows.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for the IP address, our legitimate interest in protecting the form from misuse (Art. 6(1)(f) GDPR).

Creator partners

If you take part in our creator program, we store what we need to run the partnership and to pay you: your name, email address, Instagram handle, discount code, and commission rate; how you want to be paid (PayPal or bank transfer, or automatic payouts through Stripe Connect if you ask for them), with your PayPal email address or IBAN; and a record of the purchases made with your code, the commission they earn, and the payouts we have made. For a payout we pass the amount and your payout details to PayPal or to our bank. Automatic payouts run through your own Stripe account, which Stripe manages under its own terms.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c) GDPR). We keep this data for as long as the partnership lasts. Payout and commission records are then kept for as long as tax and accounting law requires (up to 10 years).

Email communications

We send emails through SendPulse (SendPulse Inc.), which processes your email address and the content of the message on our behalf.

• Transactional emails — account confirmation, receipts, licence and password-reset emails, and support replies. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Product emails — we also send account holders a small number of emails about Quantic Heartz itself: for example one reminder, possibly with a discount code, if you created an account but did not choose a plan; one message after your free trial ended without a subscription; and announcements of major app updates. Every one of these emails contains an unsubscribe link, and you can object at any time. After that, we only send you transactional emails. Legal basis: our legitimate interest in informing our users about our own product (Art. 6(1)(f) GDPR).

Cookies and local storage on our website

Our website sets no cookies of its own. It stores the following in your browser:

• qh-theme (local storage): remembers whether you see the dark or the light design. Kept until you delete your browser data.
• qh_consent (local storage): your choice in the cookie banner, with the date and the version of the banner. Kept until you delete your browser data. If we change what we ask for, we ask you again.
• qh_cid, qh_attr_first, qh_attr_last (local storage) and qh_sid (session storage): only with your consent, for the website statistics described above. qh_sid is removed when you close the tab; the others are kept until you withdraw your consent or delete your browser data.
• _fbp and _fbc (cookies set by Meta): only if you accept, see section 3. Meta sets them with a lifetime of 90 days. They are removed when you withdraw your consent.
• _clck and _clsk (cookies set by Microsoft Clarity): only if you accept, see section 3. _clck is kept for one year, _clsk for one day. They are removed when you withdraw your consent.

Storing your theme preference and your consent choice is necessary to provide functions you use and does not require consent (§ 25(2) No. 2 TDDDG in Germany, § 165(3) TKG 2021 in Austria, and the corresponding national rules implementing Art. 5(3) of the ePrivacy Directive). Everything else in this list is stored and read only with your consent.

3. Advertising and measurement

We advertise Quantic Heartz on Facebook and Instagram, services operated by Meta. To learn whether these ads work, we use the Meta Pixel on our website, as described below, and only after you have consented. Apart from Microsoft Clarity (see below), we do not currently use advertising or measurement tools from other companies; in particular, we do not use Google Ads tracking. If we start, we will update this policy first.

Meta Pixel on our website (only with your consent)

The Meta Pixel is a piece of code provided by Meta. We load it only after you click "Accept" in our cookie banner. Until then, our website makes no connection to Meta. We do not use it on pages whose address or forms can contain personal details: the unsubscribe page for our emails and the pages of our creator program.

Once loaded, the Pixel sends Meta the address of the page you are viewing and of the page you came from; the events we measure, namely page views and clicks on our download button and on the "Send to Mac" button; the time; technical information about your browser and device, such as the user-agent; your IP address; and the identifiers stored in two cookies set by the Pixel: _fbp, which recognises your browser, and _fbc, which contains the click identifier if you came to us through an ad on Facebook or Instagram. We have switched off the Pixel's automatic collection of further page content, and we do not pass your name, email address, or other contact details to it. If you are logged in to Facebook or Instagram in the same browser, Meta can link this data to your Meta account.

Purpose: to measure how many people see or click our ads and then visit our website or download our app, and to let Meta show our ads to people who are more likely to be interested.

Legal basis: your consent (Art. 6(1)(a) GDPR); for storing and reading cookies on your device, also § 25(1) TDDDG, § 165(3) TKG 2021, or the corresponding national rules implementing Art. 5(3) of the ePrivacy Directive.

You can withdraw your consent at any time with effect for the future, via "Cookie Settings" in the footer of our website or right here: Cookie settings. We then stop the Pixel from sending further data and delete the _fbp and _fbc cookies and the records described in section 2 from your browser. Withdrawal does not affect the lawfulness of processing carried out before it.

Our server and our apps

Our server does not currently send data about you to Meta (for example through Meta's Conversions API), and our apps contain no software from Meta or other advertising companies. If we start, we will update this policy first and ask for your consent where it is required.

Meta's role and transfers to the United States

For the collection of data through the Pixel on our website and its transmission to Meta, we and Meta Platforms Ireland Limited are jointly responsible (Art. 26 GDPR). We have agreed with Meta how these responsibilities are divided (Meta Controller Addendum). Meta answers requests about the data it stores; you can also contact us, and we will pass your request on. What Meta does with the data after receiving it, including using it to improve its own advertising systems, is Meta's own responsibility — see Meta's Privacy Policy. Meta may transfer data to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (see section 5).

Microsoft Clarity on our website (only with your consent)

To see how visitors use our website and where we can improve it, we use Microsoft Clarity, a service of Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA). We load it only after you click "Accept" in our cookie banner. Until then, our website makes no connection to Microsoft. We do not use it on the unsubscribe page for our emails and the pages of our creator program.

Once loaded, Clarity records how you interact with our pages: clicks and taps, scrolling, mouse movements, the pages you view and the page you came from, the time you spend on them, and technical information about your browser and device, such as browser, operating system, and screen size. Microsoft also receives your IP address and uses it to determine your approximate location. From this, Clarity creates heatmaps and recordings of individual visits that show us where visitors click, how far they scroll, and where they leave. Anything you type into form fields is masked by Clarity in your browser and is not transmitted. Clarity sets two cookies on our website: _clck, a random Clarity identifier kept for one year, and _clsk, which joins the pages of one visit and expires after one day. Microsoft may also set its own cookies on Microsoft domains, such as MUID.

Purpose: to understand how our website is used and to improve it.

Legal basis: your consent (Art. 6(1)(a) GDPR); for storing and reading cookies on your device, also § 25(1) TDDDG, § 165(3) TKG 2021, or the corresponding national rules implementing Art. 5(3) of the ePrivacy Directive.

Under Clarity's terms of use, we and Microsoft are each responsible for the data on our own (independent controllers). Besides providing Clarity to us, Microsoft may use the data for its own purposes as described in the Microsoft Privacy Statement, including to improve its products and to create user profiles for purposes that include advertising. Microsoft Ireland Operations Limited transfers data to Microsoft Corporation in the United States under Standard Contractual Clauses; Microsoft Corporation is also certified under the EU-U.S. Data Privacy Framework (see section 5).

According to Microsoft, recordings are available to us for 30 days; recordings we mark as favourites and a random sample of recordings are kept for up to 9 months. How long Microsoft keeps data for its own purposes is set out in the Microsoft Privacy Statement. Clarity offers us no way to delete the data of a single visitor. You can send requests about the data Microsoft holds directly to Microsoft; you can also contact us, and we will pass your request on.

You can withdraw your consent at any time with effect for the future, via "Cookie Settings" in the footer of our website or right here: Cookie settings. We then stop Clarity and delete the _clck and _clsk cookies from your browser. Withdrawal does not affect the lawfulness of processing carried out before it.

No audio, ever

No tool described in this policy receives audio. Our apps process your audio only on your device. We never record or transmit what you listen to, and we do not send any advertising company information about the music or apps you listen to or about your listening time.

How long advertising data is kept

• _fbp and _fbc cookies: 90 days, unless you delete them earlier or withdraw your consent.
• Your consent choice: stored only in your browser, until you delete it.
• Data Meta has received: kept by Meta for the periods set out in Meta's Privacy Policy. Our Data Deletion page explains how to ask Meta to delete it.

4. Who we share data with

Processors

These service providers process personal data on our behalf, only to the extent needed to operate the Service:

Other recipients

The following companies receive personal data in the cases described in section 2 and process it under their own responsibility (independent controllers):

Meta's role (joint controller) is described in section 3.

We do not sell, rent, or trade your personal data. The only data we pass to advertising or analytics companies is described in section 3, and only with your consent.

5. International transfers

Some of the companies named in this policy transfer personal data to the United States. Where this is the case, the transfer is protected either by the EU-U.S. Data Privacy Framework (Commission Adequacy Decision 2023/1795) where the receiving entity is certified under the Framework, or, as a fallback, by Standard Contractual Clauses adopted by the European Commission under Art. 46(2)(c) GDPR. The current DPF status of each US company is available on the US Department of Commerce's Data Privacy Framework list.

6. How long we keep your data

• Account data: for as long as your account is active. If you delete your account, we delete or anonymise the associated personal data within 30 days, except where we are required to retain it for legal reasons. This includes your devices, your listening-time total, and the record of how you found us.
• Invoices and payment records: retained for up to 10 years to comply with US and EU tax and accounting law.
• Raw web server logs: 14 days.
• Campaign records in your browser (only with your consent): until you withdraw your consent or delete your browser data.
• Website statistics and download records: no fixed period yet, see section 2.
• Lists of active accounts (heartbeat): at most 48 hours.
• Bug-report logs: up to 90 days, then deleted.
• Support email threads: up to 24 months after the ticket is closed.
• Advertising and analytics data: see section 3.

7. Your rights under GDPR

If you are located in the European Union, United Kingdom, or Switzerland, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• have processing restricted in certain situations (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on our legitimate interest (Art. 21(1) GDPR);
• object at any time to the use of your data for direct marketing, including our product emails (Art. 21(2) GDPR);
• withdraw any consent you have given us, at any time (Art. 7(3) GDPR); for measuring our ads and analysing how our website is used via Cookie settings;
• lodge a complaint with the supervisory authority of your country of residence, place of work, or place of the alleged infringement.

To exercise any of these rights, email us at support@quanticheartz.io. We will respond within one month. We will never charge you a fee for a reasonable request. How to delete your account and your advertising data is explained step by step on our Data Deletion page.

8. Automated decision-making and profiling

We do not use your personal data for automated decision-making that produces legal or similarly significant effects. If you consent to the Meta Pixel (section 3), Meta uses the data to decide to whom our ads are shown. This is profiling for advertising purposes; we do not consider it to have a legal or similarly significant effect on you. If you consent to Microsoft Clarity (section 3), Microsoft may, under its terms, also use the data to create user profiles for purposes that include advertising; we do not consider this to have a legal or similarly significant effect on you.

9. Security and breach notification

We protect your data with industry-standard technical and organisational measures: encryption in transit (HTTPS/TLS), encryption at rest for sensitive fields, access controls, principle of least privilege, regular backups, and logging of administrative actions. No system is perfectly secure, but we take every reasonable step to keep your data safe.

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Art. 33 GDPR and, where the breach is likely to result in a high risk to you personally, notify you without undue delay in accordance with Art. 34 GDPR.

10. Children

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page shows when the current version took effect. Material changes will be announced on our website and, where appropriate, by email.

12. Contact

Questions, requests, or complaints about this Policy or your personal data can be sent to support@quanticheartz.io. A German-language version of this Policy is available at /datenschutz.