Privacy policy.

1 · Who we are

Quad is a product of Quad ("we", "us"). For privacy questions, write to [email protected].

2 · What we collect

Three categories of data: information you give us directly (name, email, role, institution); information your institution provides to identify you (student number, programme, Moodle user ID, ERPNext customer ID); and technical data your device sends automatically (IP address, device model, OS version, app version, crash reports).

3 · How we use it

To authenticate you, fetch your data from Moodle and other systems on your behalf, render it in the app, contact you about service issues, debug crashes, and meet our security and audit obligations to your institution.

4 · How we protect it

Passwords are hashed with Argon2id. Personal access tokens are encrypted at rest. All communication uses TLS 1.3. Administrative actions are recorded in an immutable audit log. Access to production systems is restricted to a small, audited group of engineers.

5 · Who we share with

Your institution (who is the data controller). The cloud provider hosting Quad on your institution's behalf. Email delivery providers (transactional email only). We do not sell your data. We do not run advertising.

6 · Your rights

You can ask us to access, correct, or delete your data; export it in a portable format; or restrict its processing. Email [email protected] and we'll respond within 30 days.

7 · Retention

We keep your data for as long as your institution uses Quad. When the relationship ends, we delete or anonymise your data within 90 days, except where law requires longer retention (for example, audit records).

8 · Changes to this policy

If we make material changes, we'll email your institution administrator and update the date at the top of this page. Continued use after that date constitutes acceptance.

9 · Contact

Privacy questions: [email protected]. Security disclosures: [email protected]. Anything else: [email protected].