Privacy Policy
Last updated:
The short version
- The public pages on quico.site (the landing page, QUI CO Cafe, the dice roller) don’t collect personal data, set cookies, or use analytics or ads.
- RAPly is a work tool for invited team members. It stores your username, a hashed password, your saved settings, and a log of which scripts you copy.
- Your data isn’t sold, and it’s used only to run RAPly.
- To see, correct, or delete your data, email .
1. Who we are
quico.site and RAPly are operated by , based in (“we”, “us”). We are responsible for the personal data described here. You can reach us about anything in this policy at .
2. What this policy covers
This policy covers the website at quico.site and RAPly (app.raply.space), including its login and the server that stores RAPly accounts and settings.
The public pages don’t ask you for any information. Anything you enter there, such as a mock coffee order or dice rolls, stays in your browser and isn’t sent to us.
3. What we collect in RAPly and why
| Data | Why | Kept for |
|---|---|---|
| Account: username, password (stored only as a one-way bcrypt hash, never in plain text), when the account was created, and which version of the Terms and this policy you agreed to (and when). If you turn on two-factor login: its secret key (stored encrypted) and your backup codes (stored only as one-way hashes). | To let you log in, keep your account secure, and keep a record that you agreed to the Terms | Until your account is removed (see section 6) |
| Settings: favorites, custom titles, “sign script as” name, theme, date format | So your settings follow you across devices | Until your account is removed |
| Activity log: each time you use a script’s Copy button, we record your username, the script’s ID, title and category, its first 200 characters, and the time | To see which scripts the team uses, so we can improve and prune the script library | Linked to your username for months. After that your username is removed automatically, and the anonymous entry (script and date only) is kept for long-term usage statistics. |
| Flowchart edits: the username of whoever last saved the shared flowchart, and when | To prevent conflicting edits and show who last updated it | Until the next save replaces it |
| Technical data: IP address, browser type, and request times | Our hosting providers need these to deliver pages and requests. We also use your IP address for a short time to limit login attempts (10 per 15 minutes) against password guessing. | Login-limit counters: 15 minutes, in memory only. Hosting logs: per the provider’s retention (section 5). |
Activity monitoring. The activity log above is the only monitoring RAPly does. We don’t record keystrokes, screen activity, what you type into a script, or time spent on the page. The log shows which scripts were copied and by whom, and only we can see it. It isn’t shown to other users.
We don’t collect your email address, phone number, or any sensitive personal information. Please don’t put personal data about customers or other people into titles, names, or the flowchart.
4. Legal basis
We process this data because it’s necessary to give you the RAPly account you were invited to use, and because of our legitimate interest in keeping the tool secure and useful for the team. This is lawful processing under the EU/UK GDPR (Art. 6(1)(b) and 6(1)(f)) and the Philippine Data Privacy Act of 2012 (Sec. 12).
5. Who can see it
- Us, as administrator: to create and remove accounts, reset passwords, and review the activity log.
- Other RAPly users can see only the username of whoever last edited the shared flowchart. They can’t see your favorites, settings, or activity.
- Service providers that host the site for us and handle data only on our instructions:
- GitHub Pages (GitHub, Inc.): hosts the website files
- Render (Render Services, Inc.): runs the RAPly server
- Turso (ChiselStrike, Inc.): stores the RAPly database
RAPly loads its script library (Fetchbox) from a Google Sheet, but that happens on our server. Your browser and your personal data are never sent to Google. All fonts and code libraries are served from quico.site itself, so visiting the site doesn’t contact Google Fonts or other outside content networks.
These providers may process data outside your country, including in the United States. Where the law requires it, we rely on their standard data processing terms and safeguards, such as the EU Standard Contractual Clauses. We don’t sell or rent personal data, and we don’t share it for advertising.
We may disclose data if the law or a valid legal order requires it.
6. How long we keep it
- Accounts are invite-only. When someone leaves the team, we remove their account within days. Removing an account deletes its password hash and saved settings immediately.
- Activity log entries are linked to your username for months. After that, the username is removed automatically. The anonymous entry (which script was copied, and when) is kept indefinitely for usage statistics, since it can no longer identify you. If your account is removed, the username is stripped from all your entries right away.
- Login sessions expire after 7 days, and the stored login token is deleted when you log out. Changing your password ends all your other sessions.
- Backups, if any, are overwritten on the provider’s normal backup cycle.
7. Cookies and browser storage
We don’t use cookies, analytics, advertising, or tracking pixels.
RAPly uses your browser’s local storage for things that are strictly necessary for the tool to work. It holds your login token, plus a local copy of your settings (theme, sidebar state, favorites, titles, sort order, name, date format, tally counters, dismissed banners) and a cache of the script library, so the page loads quickly. This data stays on your device. It’s used only to provide the service you asked for, which is why we don’t ask for consent.
You can clear it anytime by logging out or clearing your browser’s site data. If we ever add optional analytics or third-party embeds, we’ll ask for consent first.
8. How we protect it
- All traffic is encrypted with HTTPS.
- Passwords are hashed with bcrypt. We can’t see your password.
- There’s no public sign-up. Accounts are created by an administrator. New accounts, and accounts whose password an administrator resets, can’t access anything until the user sets their own password.
- Optional two-factor login with an authenticator app.
- Login attempts are rate-limited, and changing your password or two-factor settings ends your other sessions.
- Data access is limited to what each person needs. For example, only designated editors can change the flowchart.
No system is perfectly secure. If a breach affects your personal data, we’ll notify the Philippine National Privacy Commission and, where GDPR applies, the relevant supervisory authority within 72 hours of becoming aware of it. We’ll also tell affected users without undue delay.
9. Your rights
Depending on where you live, you have the right to:
- be informed about how your data is used (this policy)
- get a copy of your data
- have inaccurate data corrected
- have your data deleted, or your account removed
- object to or restrict certain processing, including the activity log
- receive your data in a portable format
- complain to a data protection authority. In the Philippines this is the National Privacy Commission. In the EU/UK, it’s your local supervisory authority.
To use any of these rights, email from a channel we can verify, or ask your team lead to forward the request. We’ll respond within 30 days.
10. Children
RAPly is a work tool and isn’t intended for anyone under 18.
11. Changes
If we change this policy, we’ll update the date at the top. If we make a significant change, such as collecting a new kind of data, we’ll let RAPly users know before it takes effect.