quantakrypto
Loading…
Loading…
Last reviewed
The short version
We collect as little as possible. Our scanners and MCP tools process the code and inputs you give them to produce a result, then discard them — we do not store your source code, and we never use it to train anything. The only personal data we keep is the minimum needed to run the service: the email and profile from your sign-in, the access token issued to you, and anything you send through a contact or booking form so we can reply. Analytics run only if you accept the cookie banner. All of our code is open source and auditable (links below).
This Privacy Policy explains what personal data quantakrypto ("we", "us", "our") collects when you use our website (quantakrypto.com), our hosted Model Context Protocol service (mcp.quantakrypto.com), and our open-source tools — and how we handle it. It applies to all of those together. If you have any question, email [email protected].
quantakrypto is a post-quantum cryptography practice — keeping data we do not need would be at odds with everything we advise. We design our systems to hold the least personal data possible, and because our tooling is open source you can verify that for yourself: see the pqc-tools and mcp-gateway repositories.
The hosted MCP uses OAuth 2.1 for sign-in. When you choose "Continue with Google" or "Continue with GitHub", you authenticate on that provider's own page — we never see your password. The provider returns only the profile scope we request (email, name, avatar). Your use of those providers is also governed by their policies: Google Privacy Policy and the GitHub Privacy Statement. You can revoke quantakrypto's access from your Google or GitHub account settings at any time.
We use only essential cookies plus, with your consent, Google Analytics. Nothing analytical loads until you click "Accept" on the banner; choosing "Decline" keeps it off. You can change your mind at any time by clearing the site's cookies, which resets the banner. We do not use advertising cookies. Google Analytics and reCAPTCHA are provided by Google — see how Google uses data.
We keep the third parties involved to a short, deliberate list. Each only receives what it needs to perform its function:
Enquiry and booking emails are kept only as long as needed to handle your request and for reasonable business records. MCP accounts are kept until you delete them; issued access tokens expire after 30 days. Analytics data follows Google Analytics' retention settings. Operational logs are short-lived.
Some of our processors (Google, GitHub, Resend, Cloudflare) are based in the United States and may process data there. Where personal data leaves the EEA/UK, it is covered by the safeguards those providers offer, such as Standard Contractual Clauses.
Depending on where you live, you have rights to access, correct, delete, port, or object to the processing of your personal data, and to withdraw consent. For the MCP you can revoke your token or delete your account directly; for anything else, email [email protected] and we will action it. You may also complain to your local data-protection authority.
We serve everything over TLS, store access tokens as hashes rather than in the clear, and keep our attack surface small. Because our code is open source, you can audit exactly how authentication and data handling work in the mcp-gateway and pqc-tools repositories.
Our services are intended for professional use and are not directed at children under 16. We do not knowingly collect their data.
We may update this policy as our services evolve. Material changes will be reflected here with a new review date; the current version is always the one on this page.