Privacy
This is how qequals handles data on www.qequals.com and api.qequals.com. Short version: we meter API calls, we remember accounts that sign in, we remember payments that pay, and we answer mail you send. We run no advertising pixel and we sell nothing. Questions: [email protected].
The whole page in four lines
- Every API call logs what metering needs: IP address, hashed key, endpoint, the query
q, and the time. - Accounts keep a user id and an email. Pro adds a PayPal subscription id and its status. No card numbers, ever.
- Three kinds of outsiders see pieces of this: Google, Supabase, and PayPal — plus the machines that host www and api. Nobody gets your account for their marketing.
- Want out? Write to [email protected] from the Gmail on the account and we close it and retire the key.
Who we are
qequals runs those two hosts. The API mints keys and returns Google autocomplete suggestions and live search results. The site is the catalog, the account pages, and this file. Email is the contact — there is no contact form, so nothing you type into a form goes anywhere except the page it belongs to.
When this page says “we”, that is who it means: the people operating www.qequals.com and api.qequals.com, reachable at [email protected].
What we collect
Four buckets. Nothing else is ours to keep: no advertising profiles, no cross-site tracking, no purchased lists.
| API calls, account or not | IP address (rate and mint limits), a hashed form of the key, the endpoint called, the query string q, and the timestamp. Successful suggestion and search payloads are cached briefly so a repeat call does not hit Google again. |
|---|---|
| Accounts (Google sign-in) | Sign in on /account goes through Google and Supabase, so both see the sign-in itself. We keep the Supabase user id and the email on that account, attach a registered key to it, and show you the page. Session cookies stay on www for that sign-in and nothing else. |
| Pro ($9 / month) | PayPal handles checkout and the money. We store the PayPal subscription id and whether the plan is active, so quota can follow the payment. We never see or store a card number — that lives with PayPal. |
| Mail you send us | Whatever you put in the email, plus the usual headers. We use it to answer you and to debug what you report. Agents that hit a problem should use the same address — llms.txt says what to include. |
What we do not collect:
- No advertising identifiers, no pixels, no third-party analytics.
- No card numbers, no bank details.
- No catalog browsing profile — the catalog is a public shelf we crawl and publish. Reading it is reading; those pages are not your account data.
Why we use it
Each bucket has one job:
- Run the API. Quota, cache, rate limits, and abuse prevention. The query string goes to our fetch infrastructure so we can retrieve Google autocomplete or search results for that call. If Google does not return a usable response, the call fails — we do not invent a list.
- Run your account. Give you a key after Google sign-in, show quota on
/account, and keep anonymous, registered, and Pro apart. - Take $9 when you ask us to. Match the PayPal subscription to the account so Pro quota lands in the right place.
- Answer mail. Reply to what you sent and fix what you report.
In the language regulators use: we process this because it is needed to provide the service you asked for, and because we have a legitimate interest in keeping that service metered, cached, and not abused. Payments are processed because you started Pro. Where consent matters — signing in with Google, starting checkout — you give it by doing the thing.
Who else sees it
Four parties, each with a defined slice. We do not hand your account to anyone else, and nobody on this list gets it for their own marketing.
- Google. Handles sign-in, and is the source of the suggestion and search data we retrieve for a call. Their handling of sign-in data is under their own policies.
- Supabase. Holds the sign-in session behind
/account. - PayPal. Runs checkout and sends subscription webhooks. They see the payment; we see the subscription id and status.
- Hosting. The machines and networks serving www and api necessarily carry the traffic — the same usage lines described above, in transit and at rest.
If the law compels disclosure — a valid court order, for example — we comply and disclose the minimum the order requires. We have had no such requests to date.
How long we keep it
| Keys and usage lines | While the key is usable, plus as long as needed after that to enforce quota and abuse limits. Quota counts every call from the first one, including cache hits; unused quota dies at the period end. |
|---|---|
| Suggestion and search cache | Suggestions about a day, search results minutes. Cache is shared infrastructure, keyed by the query — not a per-account archive. |
| Accounts | The user id and email last while the account exists. Ask [email protected] to close an account — write from the Gmail on it so we know it is yours — and we close it and retire its keys. |
| Billing records | PayPal subscription ids and status while billing needs them, including disputes, refunds, and tax records we are obliged to keep. |
| Support mail | As long as the thread is live, plus a reasonable tail for follow-ups and debugging the thing you reported. |
| Catalog snapshots | Kept. The catalog is a public record we recrawl — snapshots are the point, not your data. |
Security
Traffic to www and api travels over TLS. Keys travel as Bearer tokens, never as cookies, and we store a hashed form rather than the raw secret. Access to account and billing data is limited to what operating the service requires. No system is impregnable — if you think a key leaked, check /account first and retire or replace it there if the page offers that. If it does not, write to [email protected] from the Gmail on the account so we can.
Your choices and rights
- Use it anonymously. Mint a key and call the API without an account, within anonymous limits.
- Register or pay when you want more. Sign in upgrades quota; Pro ($9 / month) upgrades it further. Cancel with PayPal and quota follows the subscription status.
- See, fix, export, or delete. Write to [email protected] from the Gmail on the account and say which — we will confirm what we hold, correct what is wrong, send you a copy, or close the account and retire its keys.
- Object or restrict. If you believe a use described here should not apply to you, say so in the same mail and we will consider it and reply.
California and EU/UK readers: we do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. Whatever rights your jurisdiction grants — access, deletion, correction, portability, restriction — write to [email protected] and we honor them.
Cookies
www sets session cookies when you sign in with Google, to keep you signed in on /account. The API does not use cookies at all — agents send a Bearer key per call. There are no advertising or cross-site tracking cookies anywhere on www or api.
Children
The product is for operators and agents building with search data, not for children. Do not create an account if you are under 13, or under the minimum age for online services where you live. If we learn an account belongs to a child below that age, we close it and delete its account data.
International transfers
We and our providers operate infrastructure in more than one country, including the United States. Your data is processed where that infrastructure runs. By using www.qequals.com or api.qequals.com you understand that transfer happens, under the protections described on this page and in our providers' own terms.
Changes to this page
If handling changes, this page changes first and the date at the top moves with it. Material changes get a note here describing what moved. The page you are reading is the current one.
Contact
[email protected] — that is the whole support desk. Write from the Gmail on the account for anything account-shaped (closure, export, correction) so we can verify you.
This page, www.qequals.com/privacy, is the privacy policy URL for Google sign-in.