Privacy Policy

Account data: your email, used for login and essential communication.

Profile data, which you choose to fill in: name, username, avatar photo, bio, website, social profiles (LinkedIn, X, Instagram, Dribbble), phone, WhatsApp, and address — each with its own toggle to make it public or not.

Saved content: the links, notes, tags, Collections, and Spaces you create.

Technical data: essential session cookies (needed to keep you logged in) and, approximately, the country your access comes from, used only to decide the interface's default language.

Most data comes directly from you, when you fill in your profile or save a link. Session cookies and approximate access country are collected automatically by the service's infrastructure.

To provide the service (authentication, saving and displaying your content, showing your public profile if you opt into that), for essential communication (login codes, account notices), to prevent abuse, and to process payment when you subscribe to the Pro plan.

We don't sell your data. We use the following processors to run the service, each receiving only what it needs to do its job:

Supabase (database, authentication, and file storage such as avatars); Vercel (application hosting); SendPulse (sending transactional emails, such as login codes); Stripe (Pro plan payment processing, once available); Google Analytics (site usage metrics, once enabled).

These providers may process data outside Brazil; in those cases, we require them to offer protections consistent with Brazil's LGPD.

We use one essential session cookie to keep you authenticated — without it, login doesn't work. Once Google Analytics is active, it may use its own cookies for aggregate usage metrics; you can block those in your browser settings without affecting login.

We keep your data for as long as your account exists. After a deletion request, we remove identifiable personal data, subject to the technical time needed to purge backups.

Under applicable data protection law (including Brazil's LGPD), you can request at any time: confirmation that we process your data, access to it, correction of incomplete or outdated data, anonymization or deletion of unnecessary data, portability, information about who we share your data with, and withdrawal of consent.

To exercise any of these rights, write to hello@quickrefs.com. Self-service account deletion doesn't exist in the product yet — requests are handled manually by us, after confirming your identity via the registered email.

We use reasonable technical measures to protect your data (passwordless authentication via one-time codes, row-level access control in the database). No system is 100% secure, and we can't guarantee absolute protection.

Quickrefs isn't directed at anyone under 18 and doesn't knowingly collect data from children.

We may update this policy as the service evolves. Material changes will be communicated by email or an in-product notice before they take effect.

For any question or request about your data: hello@quickrefs.com. Given the company's size, there's no separately designated data protection officer — that inbox is handled directly by the people running Quickrefs.