Privacy Policy

QbitSeed’s core API does not ingest, process, or store personal data belonging to your end users. When your application calls POST /random, we return a requested array of raw entropy — random bytes and a signed certificate. We have no visibility into, and no interest in, what you do with that output or who your own end users are. If your end users’ personal data never reaches QbitSeed’s API in the first place (it doesn’t need to — a random-number request carries no end-user identity), we have nothing of theirs to protect, retain, or disclose.

Everything described below is about you — the developer or organization with a QbitSeed account — not your end users.

• Account information: the email address you sign up with, and your password — which we never store in plain text. Passwords are hashed with scrypt before being saved; we can verify a login but cannot recover or view your original password.
• API keys: the raw key value is shown to you exactly once, at creation. After that, we retain only a one-way hash of the key and a short, non-secret display prefix — we cannot reconstruct or display the original key again.
• API call counts and usage metrics: the number of requests and amount of data delivered per key, per billing period — used to enforce your plan’s quota and calculate metered overage billing. This is metadata about your usage, not the content of your requests or responses.
• Technical/security logs: IP address and request timestamps, collected for security monitoring and abuse mitigation. Retained for 30 days, then deleted — a separate, shorter retention window from the certificate/audit records below, which serve a different purpose.
• Certificate and audit records: the certificate/job ID tied to each response you generate, so we can produce an auditable record of what we served and you can verify it independently.
• Webhook configuration: if you register a webhook endpoint, we store the URL and a signing secret you provide. Unlike passwords and API keys, this secret is stored in a form we can read back, because we need it to cryptographically sign each webhook payload we send you.
• Billing information: payment card details and billing address are collected and stored directly by Stripe, our payment processor — QbitSeed itself only stores a reference to your Stripe customer and subscription record, never your card details.
• Support correspondence: anything you send to hello@qbitseed.com.

The dashboard sets a single, strictly necessary httpOnly session cookie used to keep you logged in. We do not use advertising or analytics tracking cookies on the website or dashboard.

• To provide, operate, and secure the Service, including authenticating requests.
• To enforce rate limits and plan quotas, and to meter and bill usage (including overage) via Stripe.
• To generate and let you verify randomness certificates.
• To detect, investigate, and prevent abuse or fraud.
• To respond to support requests.
• To meet legal, tax, and audit-retention obligations.

We share information with the following service providers, only as needed for them to perform their function for us:

• Stripe — payment processing and subscription billing. Receives your payment and billing details directly; QbitSeed does not.
• Railway — hosts the API and its database (account, usage, certificate, and audit data).
• Vercel — hosts the website and dashboard.
• IBM Quantum Cloud — executes the quantum circuits that produce entropy. Receives circuit-execution job requests only, not your account or personal information.
• Google Workspace — operates our support inbox, hello@qbitseed.com.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Several of our service providers (Railway, Vercel, Stripe, Google Workspace, IBM Quantum Cloud) operate infrastructure outside Alberta, including in the United States. As a result, your information may be processed and stored outside the province and outside Canada, subject to that provider’s own security and confidentiality commitments.

You can request access to, correction of, or deletion of your personal information by emailing hello@qbitseed.com. Account deletion is currently handled by our team on request rather than as a self-service dashboard action. Note that we may need to retain certificate and audit-log records described in Section 5 even after an account is deleted, to preserve the compliance trail those records exist for.

If you are not satisfied with how we’ve handled your request, you may complain to the Office of the Information and Privacy Commissioner of Alberta or, where applicable, the federal Office of the Privacy Commissioner of Canada.

We use industry-standard practices including password hashing (scrypt), one-way API key hashing, encryption in transit (TLS), and httpOnly session cookies. No system is completely secure, and we can’t guarantee absolute security of information transmitted to or stored by the Service.

QbitSeed handles your personal information in accordance with Alberta’s Personal Information Protection Act (“PIPA”). Because QbitSeed’s customers are not limited to Alberta, and some of our service providers operate outside the province, some of our activity is interprovincial or international commercial activity, to which the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) — and its proposed successor, the Consumer Privacy Protection Act, once in force — may also apply alongside PIPA.

The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age.

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you by email or through the dashboard.

Questions about this Privacy Policy can be sent to hello@qbitseed.com.