Who we are
QCR MTÜ, a non-profit association in Estonia, decides what happens to the data described here.
QCanvas is developed and maintained by QCR MTÜ, a non-profit association registered in Estonia under registry code 80651332, at Järvevana tee 9, 11314 Tallinn, Estonia. QCR MTÜ is the controller of the personal data this policy describes, and hello@qcrepository.org reaches the people responsible for it.
The short version
No account, most of your work never leaves this browser, and the rest is listed below.
You need no account to use QCanvas. Your projects and files live in this browser and, when you choose, in your own Google Drive or OneDrive account. No QCanvas server stores your projects, your files or your drive credentials. Running a simulation sends the circuit to our simulation service, which answers and keeps no copy of it. If you write to us with the feedback form in QCanvas, that message goes to our team. If you subscribe to our newsletter, your email address goes to MailerLite, which sends it. Usage is counted without cookies or persistent identifiers. Like every web service, our servers keep brief technical logs.
| What | Why | Legal basis | Who else receives it | How long |
|---|---|---|---|---|
| Data kept in the browser Your projects, the images and files you place on the canvas, the record of a linked drive file, and your theme and editor preferences | So your work and your settings are there when you come back | None applies. This is on your own device and never reaches us | Nobody | Until you clear the browser's site data |
| Simulation inputs The circuit's structure, the number of shots and the backend name | To compute the answer you asked for | Performing the service you asked for, Article 6(1)(b) GDPR | Our simulation service, which runs on Microsoft Azure in Sweden | Not kept once the answer has been sent. What a request leaves in the technical logs, a refused one included, is described under Technical connection data |
| Runs through qBraid If you connect a qBraid account, your qBraid key, and the circuits run on qBraid's machines for you with their number of shots and the machine chosen | To check your key, show you qBraid's machines and their prices, and run your circuits | Performing the service you asked for, Article 6(1)(b) GDPR | qBraid, which receives the circuits and, in transit through our simulation service, your key | Your key stays in this browser tab until you reload or close it, press Disconnect, or leave it unused for two hours. qBraid keeps a record of each run in your qBraid account under its own terms |
| Drive files The project file you link, its name and its revisions, in your own account | To keep a copy of your project in the account you chose | Performing the service you asked for, Article 6(1)(b) GDPR | Google or Microsoft, whose account holds it. Nothing reaches a QCanvas server | Until you remove the file in your own account |
| Feedback Your message, your email address if you type one, and the address the submission came from | To hear from the people who use QCanvas and answer them, and to rate limit the form | Our legitimate interest in hearing from you, replying, and keeping the form usable, Article 6(1)(f) GDPR | Discord, which hosts the private channel our team reads. Your address is not sent to Discord | Your message stays while it is useful for improving QCanvas, nothing in that channel is deleted on a schedule, and we remove your message on request. Your address stays in the service's own memory until the service restarts |
| Newsletter Your email address, once you confirm it | To send you news about QCanvas and the other apps of QCR MTÜ | Your consent, Article 6(1)(a) GDPR | MailerLite, which keeps the list in the EU and sends the emails | Until you unsubscribe. An unsubscribed address stays marked as such so it is not written to again, and we erase it on request |
| Usage statistics The page, where you came from, your browser, operating system, device type and country, and a few feature uses | To understand which features are used | Our legitimate interest in understanding how QCanvas is used, Article 6(1)(f) GDPR | Plausible, our statistics service in the EU | The daily hash Plausible derives from your address and browser is discarded with its salt each day, and no raw address is stored |
| Technical connection data The address your browser connects from, what it asked for and whether it succeeded, the kind of a delivered feedback submission, and any error the request produced, including one that quotes part of a refused circuit, all in standard server logs | To run and protect the service | Our legitimate interest in running and protecting QCanvas, Article 6(1)(f) GDPR | Microsoft Azure, which hosts QCanvas in Sweden | Kept briefly and rotated automatically |
What stays in your browser
Your work and your settings stay on this device, and we cannot see them.
Your projects, the images and files you place on the canvas, the record of a linked drive file, and your theme and editor preferences stay in this browser. Nothing on this path reaches a QCanvas server, and QCR MTÜ cannot see it. Clearing the browser's site data erases it. Export a file or link a drive to keep a copy elsewhere.
This site may also set a cookie naming the last project you had open in QCanvas at this address, so that QCanvas can offer it to you once, and it is removed once that project has been moved or none is left here.
Running a simulation
The circuit goes to our service, the answer comes back, and nothing stays behind with us.
When you run a simulation or export code, the circuit's structure, the number of shots and the backend name are sent to our simulation service, which computes the answer and sends it back. It stores no circuit and no result once it has answered. What QCanvas sends it carries no account and no other identifier of you, and the address your browser connects from is handled as described under usage statistics and technical data.
If you connect a qBraid account, QCanvas can also run your circuits on qBraid's hosted simulators and quantum computers. The circuit's structure, the number of shots and the machine chosen then go through our simulation service to qBraid, which runs the circuit and keeps a record of each run in your qBraid account under its own terms. Your qBraid key travels with every request QCanvas makes to qBraid for you, through our simulation service, which passes it on to qBraid and keeps nothing of it. To limit how often one key can send runs, and to reuse a list of machines briefly, the service keeps a one-way salted hash of the key in its own memory, which means nothing outside the running service and is gone when it restarts.
In QCanvas your key stays in this browser tab's memory only. It is forgotten when you reload or close the tab, press Disconnect, or leave it unused for two hours, and it is never saved in your project, in your browser's storage or on our servers.
Linking a Google Drive or OneDrive account
Your browser talks to your own drive provider, and the file never reaches our servers.
Whichever provider you link, you sign in with them in their own window, and your browser talks to them directly from then on. The access token stays in this browser tab's memory, is never written to storage and never sent to a QCanvas server, and is gone when you close the tab. Nothing from your drive reaches a QCanvas server. You can revoke QCanvas's access at any time in your account with the provider, and what they do with that account is covered by their own policy, Google's or Microsoft's.
With Google Drive, QCanvas reaches only the files it creates and the files you pick in Google's picker, nothing else in your drive. It reads and writes the linked project file, its name and its revisions in your own account, and remembers which file is linked in this browser. You revoke it in your Google account's permissions. QCanvas's use of Google user data is limited to what this section describes, and the use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
With OneDrive, QCanvas reaches the files in your own account. To let you choose a folder and a file, it reads the names of the folders and QCanvas projects you browse, and it reads the content of no file except the linked project, which it writes and reads in your own account. You revoke it in your Microsoft account's privacy settings.
Sending feedback
Your message reaches a private channel our team reads, and we delete it if you ask.
A message you send with the feedback form in QCanvas, and your email address if you type one, is delivered to a private Discord channel our team reads. It stays there while it is useful for improving QCanvas, and nothing in that channel is deleted on a schedule. Ask us and we remove your message. The email field is optional, and we use an address you give us only to reply.
Discord is a company in the United States. For personal data leaving the EU it publishes standard contractual clauses and its certification under the EU-U.S. Data Privacy Framework, both described in Discord's privacy policy.
The service rate limits feedback submissions. To do that it keeps in its own memory the address a submission came from and the times of the recent submissions from that address. It uses them for nothing else. The times drop away as they age, the address itself stays for as long as the service keeps running, and everything is gone when it restarts.
Videos from YouTube
A video on the canvas reaches YouTube before you press play.
A video element on the canvas fetches its thumbnail from YouTube's image server as soon as it is placed, and loads YouTube's player, from youtube-nocookie.com, when you press play. From that moment YouTube's own privacy policy applies to what it receives.
Usage statistics and technical data
We count visits without cookies, and our servers keep the usual technical logs.
We count page views and a few feature uses (opening a project, running a simulation, exporting or importing a file, starting a presentation) with Plausible, a service based in the EU. It sets no cookie, keeps no persistent identifier, stores no raw address, and processes the data in the EU. What it records is the page, where you came from, your browser, operating system, device type and country. The daily hash it derives from your address and browser is discarded with its salt each day, so nothing it holds identifies you.
QCanvas runs on Microsoft Azure in Sweden. Like every web service, its servers keep standard technical logs. They record the address your browser connects from, what it asked for and whether the request succeeded, and a delivered feedback submission also records which of the three kinds it was. Beyond that they hold nothing of your circuit and no value from your results, except that when something goes wrong the log carries the error, whether the request failed or went through despite it, and the reason a circuit was refused can name a gate type or a position in the circuit. These logs are used only to run and protect the service, they are kept briefly and rotated automatically, and we do not use them to identify you.
What we do not do
No advertising, no profiles, no selling, and no tracking cookie.
- No QCanvas server stores your projects, the files you place on the canvas, or your drive credentials.
- Our simulation service keeps no circuit and no result once it has answered.
- QCanvas sets no cookie of its own except the project note described under what stays in your browser, and shows no advertising.
- We do not sell your data, and we do not share it for anyone else's purposes.
- We build no profiles and we make no automated decisions about you.
Fonts and formula rendering are served from qcanvas.org itself rather than from anyone else.
Why we may process this data
Every purpose here rests on a reason the law recognises, and every one can be stopped.
- Running a simulation, and linking, saving to and opening from a drive. We process what those features need in order to give you the service you asked for under our terms, which is Article 6(1)(b) GDPR. Stop it by not using the feature. For a drive, unlink it in QCanvas and revoke QCanvas's access in your Google or Microsoft account.
- Feedback. Our legitimate interest in hearing from the people who use QCanvas, answering them, and keeping the form usable, which is Article 6(1)(f) GDPR. The email address you give us is used only to reply, the address your submission came from is used for nothing but rate limiting the form, the copy of it in our server logs is covered under Usage statistics and technical data, and the message is deleted on request.
- Newsletter. Your consent, which you give by confirming your address, which is Article 6(1)(a) GDPR.
- Usage statistics. Our legitimate interest in understanding which features are used, which is Article 6(1)(f) GDPR.
- Technical connection data. Our legitimate interest in running and protecting the service, which is Article 6(1)(f) GDPR.
- What stays in your browser. It is on your own device and never reaches QCR MTÜ, so no basis applies to it. It is described here so you know where your work lives.
The newsletter is the only purpose here that rests on your consent. You withdraw it at any time with the unsubscribe link in every email, or by writing to us. You can object to any of the processing we do on a legitimate interest. What objecting changes differs per purpose: our statistics hold nothing that identifies a person, the technical logs hold the address briefly and rotate on their own, the rate limiter's copy of an address goes when the service restarts, and a feedback message is deleted on request.
Nothing on this page is data you are required to give us. You are free to skip any feature that sends something, and the only consequence is that the feature does not run.
Your rights
You can see, correct or erase what we hold, and complain if we get it wrong.
Under the GDPR you can ask us for access to the personal data we hold about you, ask us to correct it, ask us to erase it, ask us to restrict what we do with it, ask for a copy of it in a portable form, and object to processing we do on a legitimate interest. Most of what QCanvas keeps is already in your hands, because it is in this browser, where you can read it, change it and erase it without asking anyone.
To use any of these rights, write to hello@qcrepository.org. If you think we handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, aki.ee, or to the supervisory authority of the country you live in.
Children and students
We never ask your age, and only the newsletter asks for consent.
QCanvas is built for learning, and classrooms are one of the places it is used. We ask for no account and no age. If you are below the age at which you can decide about your own data in your country, use QCanvas with a parent, guardian or teacher alongside you. The newsletter is the only thing here that rests on consent, so if you are below that age, ask a parent or guardian before you subscribe.
Changes to this policy
The date at the top of this page is how you tell that something changed.
QCanvas changes, and this page changes with it. When we change what we do with your data, we update this page and the last-updated date at the top moves.
Contact
One address reaches the people responsible for this policy.
QCR MTÜ, registry code 80651332, Järvevana tee 9, 11314 Tallinn, Estonia. Email hello@qcrepository.org.
Our Terms of Service cover the rest.