Privacy Policy

1. The Two Halves of Qboqo

Qboqo comes in two parts, and they handle data very differently.

• The desktop applications — Qboqo Office Suite, Mail, Notes, Connect and PDF — run on your own computer. Your documents stay on your computer. The only thing they send us is what is needed to check your licence.
• Qboqo Online — the browser suite at cloud.qboqo.com, webmail at mail.qboqo.com, and Qboqo Connect on the web — is a hosted service. To work at all, it stores the files, calendars and contacts you put in it.

Qboqo Online is included only with certain licences. If you use only the desktop applications, sections 5 to 7 do not apply to you.

2. What the Desktop Applications Send

To activate and validate your licence, the software contacts our licensing server at api.qboqo.com and transmits:

• Device fingerprint — a non-reversible hash derived from stable hardware identifiers. It cannot be turned back into your hardware details and is used only to bind one licence to one device.
• Licence key — sent during activation and periodic validation.
• Your email address — when you link a licence to a Qboqo account.
• Basic request metadata — such as IP address and timestamp, as part of any normal internet request.

3. What We Never Do

• We do not read the contents of documents you store in Qboqo Online, except where you ask us to for support and give us permission at the time.
• We do not track your editing activity or collect usage analytics for marketing.
• We do not sell your data, and we do not share it with advertisers.
• We do not use your documents, mail or messages to develop, improve or train artificial intelligence or machine-learning models, whether our own or anyone else's.

Note that the desktop applications never send us your documents at all. Qboqo Online necessarily stores the files you put in it, which is a different thing from reading them; section 9 explains who can reach them.

4. Your Qboqo Account

A Qboqo account signs you in to Qboqo Online. We hold your email address, your name if you give one, the licence or organisation it belongs to, what that licence entitles you to, and when it ends. We record sign-ins and administrative actions. If your organisation bought your licence, its administrator can see that you are a member, add you and remove you, but cannot see your password, which we never hold in a readable form.

5. Qboqo Online: What We Store

6. Connecting a Microsoft or Google Mailbox

Qboqo does not host email. Qboqo Mail and Qboqo webmail connect to the mailbox you already have. Your messages stay with your existing provider; we do not copy them to our servers.

When you connect a Microsoft or Google mailbox to webmail, there is one thing you should know without having to ask. So that you are not sent back to your provider's sign-in screen every half hour, our server stores the long-lived token that lets it reconnect to your mailbox. It is encrypted, held on the encrypted volume described in section 10, kept as one record per person and mailbox, and deleted when your Qboqo account ends or when you disconnect the mailbox. While it exists, it means our server holds something that can reach your mailbox. You can withdraw that access at any time from your Microsoft or Google account security settings, and from within Qboqo.

The desktop Qboqo Mail application stores nothing on our servers. Its sign-in is kept in Windows Credential Manager on your own computer and never reaches us.

Access to your mailbox is used only to show you your mail and to send the messages you write. It is not used for any other purpose, not transferred to anyone else, not used for advertising, and not used to train artificial-intelligence or machine-learning models. No Qboqo employee reads your mail, except where you specifically ask us to for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and made anonymous.

Google API disclosure. Qboqo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Qboqo requests the https://mail.google.com/ scope because it connects to Gmail over IMAP and SMTP, which is the only scope Google provides for that purpose; it is used solely to read and send your own mail in Qboqo.

7. Where Your Data Is Kept

Stated plainly: the content you put into Qboqo Online is held in India. The record of who you are and what you bought is held in Singapore, and contains no file, calendar or mail content.

8. How Long We Keep Things

Backups still contain deleted data until they age out. That is normal, and pretending otherwise would be worse.

9. Who Can Reach Your Data

• You, through your Qboqo account. Two-factor authentication is available, and your organisation may require it.
• Your organisation's administrator, if your licence was bought by an organisation: retention settings, legal holds and data export, for their own organisation only.
• A small number of Dugong staff with server access, in the course of operating and supporting the service. Administrative actions taken through our admin console are recorded in an audit trail.
• Nobody at our hosting or infrastructure providers can read your files, calendars or mail settings: they are held on an encrypted volume and our backups are encrypted with a key we hold separately.

10. How It Is Protected

Files, calendars, contacts, accounts and webmail settings are held on an encrypted volume (LUKS2, AES-256). Its key is never stored whole: half is on the server and half elsewhere, and the server fetches its other half at start-up over a signed, address-restricted request. A stolen disk is useless, and a copy of the server running somewhere else cannot unlock it. Connections to every Qboqo service use TLS. Uploads and mail attachments are scanned for malware.

11. Ending Your Subscription, and Deletion

• Delete an item and it goes to the bin, then is removed according to your organisation's policy.
• When a subscription ends, the account becomes read-only for 30 days, is then suspended, and its data is then deleted. Warning emails are sent beforehand, and you can read and export your data throughout the read-only period.
• A legal hold placed by your organisation stops all of that: nothing is deleted while a hold is in place.
• You can ask us to delete your account and its data at any time by writing to the address in section 15.

12. This Website

If you submit the feedback form, the name, email and message you provide are emailed to our support address so we can respond. Standard web-server logs may record IP address and request details. This site does not use advertising or tracking cookies.

13. Who Processes Data on Our Behalf

We use third-party infrastructure providers for hosting, for delivering email we send you, and for serving this website. They process data on our behalf under contract and may not use it for their own purposes. We do not share your data with advertisers. A current list of these providers is available on request, and business customers receive it as part of their data processing agreement.

14. Your Rights

You may request access to, correction of, or deletion of your personal data, and a copy of it in a portable form, subject to legal and contractual limits. If your licence was bought by an organisation, some of these requests are handled by that organisation's administrator. Write to support@qboqo.com and we will respond within 30 days.

15. Contact