Privacy Policy

Sebhat, Inc. ("the company") runs Quorax ("the platform"). This describes what the platform holds about you, where it goes, and how to get it back or get rid of it.

1. What the platform holds about you

Your account record is small: the identifier Auth0 gives you, your email address, your name if you gave one, an avatar if you uploaded one, and your saved preferences. There is no password field, no phone number, and no postal address.

2. What you put in your workspace

Your ventures, plans, steps, milestones, funding items, notes, pages, comments and uploaded files. This is the bulk of what the platform holds, and all of it is yours.

3. Files

Uploaded files go to object storage. Reaching one is by a short-lived signed link, issued for that request. The platform reads text out of documents at upload time so the AI can work from them, and keeps that text with the file.

4. The AI

Text you give the AI, and text pulled from documents you upload for it, is sent to the model provider: Alibaba Cloud Model Studio (Singapore region) runs the model; when it fails to answer, DeepSeek is tried in its place. Those are the only outside services that receive what you wrote.

Nothing you write is used to train a model.

5. Analytics, and the wall around them

The platform counts what happens so it can tell whether the product works. Those counts live in a separate database namespace with no link to your venture data, and a check sits in front of every write: a value gets through only if it is a number, a true or false, or a short token with no spaces and no sentence punctuation. A venture title, a step, or anything you typed cannot pass that shape. Anything that tries is dropped and logged.

A signed-out visit carries one random identifier in a cookie so a sequence of page views reads as one visit. It is not built from you, your device, or anything about you.

6. Cookies

Two. The Auth0 session cookie that keeps you signed in, and the random visit identifier above. There is no advertising code and no cross-site tracking code in the product.

7. Error reports

When something breaks, the platform can report the error to Sentry. Those reports carry the error type, the stack, and the route. Text inside quotation marks is removed before sending, because that is where anything you typed would sit, and messages are cut off at 500 characters.

No error-reporting credential is configured today, so nothing is sent at all. This clause describes what happens when one is.

8. Email

Donation receipts, the written acknowledgment for a gift of $250 or more, and feedback messages go out by email when a sending provider is configured. None is configured today, so no email leaves the platform.

9. Donations

If you give to a venture through the platform, the card details go to Stripe and never to the platform. The charge is made on the venture's own Stripe account, so the venture is the merchant of record. What the platform records is the amount, the currency, the Stripe session and payment identifiers, and your email address and name if you gave them.

10. Who else receives data

Receiving data today:

• Auth0 — sign-in and identity.
• Alibaba Cloud Model Studio — the text you give the AI.
• DeepSeek — the same text, only when Model Studio fails to answer.
• The host's Postgres and Redis — the database and the job queue.
• Cloudflare R2 — uploaded files.
• Cloudflare Web Analytics — page views, counted without a cookie or an identifier.

Receiving data once a credential is set, and not before: Stripe for donations, Resend for email, Sentry for scrubbed error reports.

Nothing is sold, and nothing is shared for advertising.

11. Getting a copy of everything

Ask and you get one file holding your account record, every venture with its whole tree, your giving pages and the gifts on them, your notifications, and the analytics rows carrying your id. The Auth0 identifier is left out of the copy on purpose.

Download it yourself, any time, from Settings → Security; the file is built when you ask.

12. Deleting everything

Ask and it goes. The analytics rows are deleted first, because the wall in clause 5 means nothing cascades across it, and then the account and everything hanging off it.

Ask from Settings → Security: the request is recorded with a confirmation step, and the operator carries it out by hand. You keep access until it is done and can cancel the request before then.

13. Children

The platform is for people aged 13 and over, and everyone confirms this when they accept the terms at sign-in. An account found to belong to someone younger is deleted, with its data.

14. Changes to this policy

Changes are posted here with a new date. A change that matters to you is announced by email.