Sign-in & bridge privacy
Qoopia uses your email address and, when you choose Google or Sign in with Apple, that provider's account identifier to confirm sign-in. It does not request access to your inbox, files, contacts, or calendar.
Sign in with Apple in the iPhone app asks Apple only for your email address, not your name. If you choose Hide My Email, Apple gives Qoopia a private relay address that forwards to you, and Qoopia uses that address as your account email. Qoopia verifies Apple's signed sign-in token and keeps Apple's account identifier; it stores no Apple tokens. You can stop using Sign in with Apple for Qoopia in your Apple Account settings.
Pending sign-in requests are removed after ten minutes. Temporary abuse-prevention counters expire within one day. Resend delivers confirmation emails; Google handles Google account selection; Apple handles Apple Account authentication. Those providers process information under their own policies.
Your notes, tasks, conversations, and model credentials remain in your Qoopia installation. Signing in does not upload or synchronise that workspace.
Service statistics
Qoopia keeps aggregate operational counts and timestamped sign-in events (step, language, success or error, and duration) in a separate analytics store. Analytics events do not include email addresses, passwords, tokens, confirmation links or memory content. Installer downloads through qoopia.ai/download are counted by this service as they are redirected to GitHub: platform, version and referral type only (direct, qoopia.ai or other), with no cookies, stored identifier or IP; known crawlers are not counted. Other website analytics is optional, uses no persistent visitor identifier, and respects the choice in website privacy settings. Do Not Track and Global Privacy Control turn both off.
Website profile
After you sign in, your profile stores your account identity and an optional dashboard address you choose to save. Profile sessions last one year and renew when you visit; pending website sign-ins expire after ten minutes. You can remove the saved address or sign out in your profile. A saved address is a navigation shortcut, not permission to access a workspace. Your notes and model credentials remain in your installation.
Delete your account
You can delete your Qoopia account at any time in the iPhone app (sign-in screen, Delete account) or in your profile. Deletion removes your account email and Google or Apple identifier, profile sessions, saved dashboard address, news preference and consent records, and pending sign-ins, and revokes your external connections. Qoopia holds no Apple tokens, so nothing remains with Apple to revoke. Memory in your Qoopia installation stays on your computer or server and is not affected.
Optional Qoopia news
News, release announcements and guides are sent only if you opt in. The checkbox is off by default. You can change your choice in your profile or unsubscribe using the link in any newsletter, without signing in. Sign-in messages are separate and continue when you unsubscribe from news.
The private account store records your subscription email, language, choice, time, source and consent-text version. It also records new account creation dates and successful sign-in times and counts. Historical registration dates are not reconstructed. Only the designated service owner can view account-level records. Consent history is kept while needed to honour your choice and demonstrate consent; deleting your account removes these records. News delivery records contain the campaign, outcome and provider message identifier; no email-open tracking is added.
Optional external connections
When you enable external access, this service links your confirmed account to independent installation identifiers, workspace identifiers, device public keys, labels and routing addresses. It stores provisioning and revocation state, and hashes of short-lived enrollment grants. Revoked device identifiers remain as tombstones so a revoked key cannot silently regain access. It does not receive your memory database or private device keys.
Cloudflare Tunnel carries authorized MCP requests and results. Cloudflare terminates HTTPS and can process transit content, IP addresses, timing and traffic volume. This path is not end-to-end encrypted. The local installation enforces each client permission; the account service does not execute memory tools. Disabling external access stops the connection without deleting local memory.
Optional bridges
When you create or join a bridge, the Qoopia pilot relay stores the group name, display names, installation public keys, membership decisions and invitation hashes. These are independent of your sign-in email. Membership records remain while the group exists and are removed within thirty days after its creator closes it. Expired invitation records are removed after one additional day.
Catalogues and selected files are signed by their sender and encrypted for their intended recipient. The relay has no private decryption keys. It temporarily buffers encrypted packets in memory for up to two minutes; the sender retains its own delivery queue. The relay observes network addresses, participant routing, timing and traffic volume. Membership freshness and delivery availability rely on the relay. Leaving or removal ends new access but cannot erase copies already received.
The pilot uses existing Qoopia hosting, with limits of 32 installations per bridge, 100 published entries per catalogue and 1 MiB per material. No payment is requested by this flow. Local memory remains available when the relay is offline.