We collect the minimum.
We hold none of the content.

• Message content. Every message is encrypted in your browser before it leaves your device. The server stores only ciphertext, message length, and routing. It cannot read what you sent — there is no key on the server.
• Email addresses, phone numbers, or identity. Qubble Chat does not require an account. There is no name field, no signup, no profile.
• Permanent message history. Each room has a purge window (5 minutes to 7 days, configurable per room). Once a message is older than the window, it is deleted from the server. We do not back it up before deleting.
• IP addresses for usage analytics. The Cloudflare tunnel sees connecting IPs for anti-abuse rate limiting; those records are not retained beyond the 15-minute window required to compute the rate limit.
• Third-party analytics, ad networks, or behavioural trackers. The site loads no Google Analytics, no Facebook Pixel, no marketing-attribution scripts.

The notify line — only — collects:

• Email address, which you submit voluntarily to be notified about new releases.
• Platform preference (optional), so we know which native build matters to you.
• Signup timestamp and the source page you came from.

That's the entire list. Stored in a SQLite database on the Qubble Labs production server in Wilmington, Delaware. Sent through Resend (the email-delivery provider) when there is a release worth telling you about.

Unsubscribe is one click in the footer of any email we send, or by mailing hello@qubblelabs.com.

You can request — at any time, at no cost — any of the following by emailing hello@qubblelabs.com:

• Access: the full record we hold tied to your email.
• Deletion: permanent removal from the notify line.
• Correction: update an email or platform preference.
• Portability: an exported copy in JSON.
• Restriction: stop sending while we sort out a dispute.

Requests are processed within 30 days. There is no charge.

We will cooperate with valid US legal process. The architectural decision to keep no key material on our servers limits what we can be compelled to produce — what we can't decrypt, we can't hand over. Chat content is not stored beyond its per-room purge window.

What we can produce: notify-line email addresses (if subpoenaed for a specific address), Cloudflare-edge connection logs for a specific time window (Cloudflare's retention, not ours), and any cipher-text that happens to still be within its room's purge window at the moment of the request.