Privacy Policy

1. Who is responsible for your data

The controller of your personal data, within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR", known in Poland as RODO), is:

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. For any privacy matter, write to the address above.

2. What the app does on your computer

This is the part most people came here for, so we will be specific.

• Local credentials. Quotzy reads the authentication data that the Claude Code and Codex command line tools have already stored in your user directory. It uses that data solely to call the relevant provider's usage endpoint on your behalf. It does not copy, upload, transmit or store those credentials anywhere else.
• Usage figures. The percentages, reset times and detected model shown in the menu bar and in the widget are received directly from the provider by your own computer and are kept in memory and in local application settings on your device.
• No telemetry. The app does not send usage statistics, crash reports, device identifiers, behavioural data or any other information about you to us or to third parties.
• Third-party providers. When Quotzy queries your usage, your computer communicates directly with the provider you use (for example Anthropic or OpenAI). That communication is governed by your existing agreement and their privacy policy, not by ours.
• Updates. To check for a new version, the app may request a version file from our update host. Such a request necessarily reveals your IP address and app version to that host, as is technically unavoidable for any internet request. We do not use this data to build profiles.

Because this processing happens entirely on your own device and under your control, in most cases we are not a controller of it at all: we never receive the data.

3. When we do process your data, and why

We process personal data in the following situations, each with its legal basis under Article 6(1) GDPR.

a) Downloading the app

Data: none that identifies you. The App is free, there is no account, no registration and no form. Downloading a file leaves an entry in ordinary server logs, described in point d).

b) Voluntary support through Buy Me a Coffee

Data: whatever you give Buy Me a Coffee when you contribute, typically a name or nickname, an email address and payment details. That data is collected by them, on their platform, under their privacy policy. We see only what their creator dashboard shows: the amount, the date, and the name or message you chose to leave.
Purpose: receiving the contribution, thanking you, and keeping the accounting records required of us.
Legal basis: Article 6(1)(b) GDPR where you enter into that transaction, Article 6(1)(c) GDPR for accounting and tax duties under Polish law, and Article 6(1)(f) GDPR for our legitimate interest in replying to supporters.

c) Support and correspondence

Data: your email address and whatever you choose to write to us.
Purpose: answering you.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in replying to people who contact us, or Article 6(1)(b) where the message concerns a purchase.

d) Website

Our website does not use advertising cookies, analytics cookies or tracking pixels. Our hosting provider keeps standard server logs (IP address, time, requested resource, user agent) for security and diagnostics, on the basis of Article 6(1)(f) GDPR. Where any non-essential cookie were ever introduced, we would ask for your consent first, as required by Article 173 of the Polish Telecommunications Law.

4. Who else sees your data

We keep the list short. Depending on what you do, your data may be processed by:

• Buy Me a Coffee, if and only if you choose to contribute. They receive your details directly and act as their own controller for that transaction;
• our hosting and email providers, which store the website and our correspondence;
• our accounting office, for issued invoices;
• public authorities, where we are legally obliged to disclose data.

Each of these acts either as our processor under a data processing agreement compliant with Article 28 GDPR, or as an independent controller where the law makes them one.

5. Transfers outside the European Economic Area

Some of the providers above may process data outside the EEA, typically in the United States. Where that happens, the transfer is secured by an adequacy decision of the European Commission or by Standard Contractual Clauses adopted under Article 46(2)(c) GDPR, together with supplementary measures where required. You may ask us for details of the safeguards applied.

6. How long we keep it

• Accounting records: 5 years counted from the end of the calendar year in which the tax became due, as required by Polish tax law.
• Records of contributions: kept for as long as accounting law requires, and no longer.
• Email correspondence: normally up to 12 months after the matter is closed, unless it forms part of a purchase record.
• Server logs: short retention periods set by our hosting provider, typically measured in weeks.

7. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased, the so-called right to be forgotten (Article 17);
• restrict processing (Article 18);
• data portability (Article 20);
• object to processing carried out on the basis of legitimate interest (Article 21);
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these, write to hi@quotzy.xyz. We answer within one month, and will tell you if we need longer, as Article 12(3) GDPR permits.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). If you live elsewhere in the EEA, you may complain to your local authority instead.

8. Is providing data required?

Providing data is voluntary. You need to give us nothing at all to download and use the App. An email address is only needed if you want an answer from us, and payment details only if you choose to contribute, in which case you give them to Buy Me a Coffee rather than to us.

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects or similarly significantly affects you, within the meaning of Article 22 GDPR.

10. Children

Quotzy is a professional tool and is not directed at children. We do not knowingly process the data of persons under 16. If you believe a child has provided us with personal data, write to us and we will delete it.

11. If you are outside the European Union

We apply the standard described above to everyone, wherever they live, because it is simpler and stricter than most alternatives. In addition:

• United Kingdom: the UK GDPR and the Data Protection Act 2018 give you materially the same rights as those listed in section 7.
• California: we do not sell or share personal information as those terms are defined in the CCPA as amended by the CPRA, and we do not use it for cross-context behavioural advertising. You may exercise your rights of access, deletion and correction through the same address.
• Switzerland, Brazil and other jurisdictions: equivalent requests under the revised FADP, the LGPD or comparable laws are handled in the same way.

12. Changes to this policy

If we change this policy, we will publish the new version at this address with a new date. Where a change materially affects your rights, we will make a clear announcement in the app or by email before it takes effect.

13. Contact

All privacy matters: hi@quotzy.xyz.