Privacy policy

• We store your email, the API credentials you connect (encrypted), and the balance readings we fetch with them.
• We never read your contacts, leads, messages, or campaigns. We call read-only balance endpoints and nothing else.
• We don't sell data, run ads, or use tracking cookies. We use Plausible for aggregate page analytics.
• Email us and we'll delete everything we hold about you.

Account. Your email address and a password. The password is hashed by Supabase Auth; we never see or store it in plain text.

Connections. The API credentials you paste when connecting a tool. They are encrypted with AES-256 before they touch the database, and the encryption key is stored separately from the data. We also store the tool name, any tags you add, and your alert threshold settings.

Balance readings. The numbers your tools report (credits remaining, usage) and when we read them. We keep the history so we can compute burn rates and tell you when something will run dry.

Alert delivery. Where you asked to be notified: your email address and any webhook URLs you configure, plus a log of the alerts we sent.

Usage analytics. Basic aggregate page analytics from Plausible, such as page paths and referrers. We do not send account emails, API keys, balance values, or connected-tool data to analytics.

Your contacts, leads, prospect lists, email content, message bodies, campaign data, or anything else inside the tools you connect. We call each vendor's balance or usage endpoint, read the number, and leave. QuotaCanary never modifies anything in your accounts and never spends your credits.

We do not use ad trackers, tracking cookies, or analytics that record emails, API keys, balance values, contact lists, message bodies, or campaign data.

Your account and connection data has one purpose: monitoring. We poll your balances roughly every 15 minutes, compute how fast they are draining, and alert you before one runs out. Plausible analytics is only used to understand aggregate page traffic and product usage. We don't sell data, share it with advertisers, or use it to train anything.

QuotaCanary runs on a small number of infrastructure providers, each processing data on our behalf:

• Supabase - database and authentication (where your account and encrypted credentials are stored).
• Railway - application hosting.
• Postmark - delivers alert and account emails.
• Cloudflare - DNS and traffic proxying.
• Plausible - privacy-friendly aggregate analytics, served from plausible.reechee.io.

We set the cookies required to keep you signed in, and that's it. No ad cookies, no cross-site tracking.

Remove a connection and its credentials and balance history are deleted with it. To delete your whole account and everything tied to it, email [email protected] and we'll do it within 30 days, usually much faster. Self-serve account deletion is on the roadmap; until then, a human handles it.

You can ask us what we hold about you, ask for a copy of it, ask us to correct it, or ask us to delete it. Same address: [email protected]. If you're covered by GDPR or a similar law, these are your legal rights; we honor them for everyone regardless.

Credentials are encrypted at rest (AES-256), all traffic runs over HTTPS, and we recommend using read-only or scoped API keys wherever your tools support them. If you find a security problem, please email [email protected] before posting it anywhere public, and we'll take it seriously and fix it fast.

If this policy changes in any way that matters, we'll update the date at the top and email you about material changes before they take effect.

[email protected]. A human reads it.