Privacy
Last updated 17 October 2026
Privacy and cookies
qubbit's tools work without an account. This page says what is collected anyway, why, who else handles it, how long it is kept, and how to change your mind.
Who is responsible
qubbit.com is run by ALBOBA SRL, Romania, which decides how your data is used (the controller under the GDPR). For anything on this page, write through the contact form. There is no data protection officer; Bogdan answers.
What is collected, and why
Shopify changelog digest
- What
- Your email address, the sources you follow, how often and at what time (with your time zone), and when each digest went out and was first opened.
- Why
- Our agreement to send you the digest you asked for (Art. 6(1)(b) GDPR).
- How long
- While you are subscribed. After you unsubscribe, or if you never click the confirmation link, the address is deleted 30 days later.
- Who else
- Postmark sends the emails and records the first open of each digest. Pushover notifies me of a new sign-up, with the address.
qubbit news (the "keep me posted" cards and the box on the digest form)
- What
- Your email address, where you signed up, and when you gave or withdrew consent.
- Why
- Your consent (Art. 6(1)(a)), given by clicking the confirmation link.
- How long
- Until you withdraw it (the link in every email, or the manage page). Then, like the digest, deleted 30 days later.
- Who else
- Postmark (emails), Pushover (sign-up notification).
Contact, feedback and bug reports
- What
- What you write, your name and email if you give them, the page you were on and, for a bug, your browser version.
- Why
- Answering you, and fixing what you report (legitimate interest, Art. 6(1)(f)).
- How long
- In my mailbox for as long as the conversation needs it, and no longer than two years.
- Who else
- Postmark delivers it to my inbox; Pushover notifies me with the message.
Theme Check
- What
- The theme .zip you upload and the report made from it. No account, and no detail about who uploaded it.
- Why
- Running the check you asked for, and checking a report that looks wrong (Art. 6(1)(b) and (f)).
- How long
- The .zip: 30 days, in private storage. The report: until you ask me to delete it; it is unlisted, so only someone with its link can open it.
- Who else
- Nobody: storage is at Hetzner in Germany.
Ask AI (Shopify ecosystem)
- What
- Your questions and the answers, under a random id for the chat. With analytics allowed, also a random id your browser keeps, to count how many people use it.
- Why
- Answering your question, and seeing how the tool is used (legitimate interest, Art. 6(1)(f)).
- How long
- 12 months.
- Who else
- Anthropic, whose model writes the answer. Please don't put personal details in a question.
Counting what campaigns bring, and the cookie answers
- What
- The campaign tags of the link you came from (utm_source, utm_medium, utm_campaign), kept in the page's memory only and saved with a sign-up you make in that visit; and plain counts: a visit from a tagged link, each sign-up step and Theme Check, and how the cookie question was answered. The counts carry no id, address or IP.
- Why
- Knowing which campaigns work and how many people allow cookies (legitimate interest, Art. 6(1)(f)).
- How long
- The tags: with the sign-up, until it is deleted. The counts identify no one and are kept.
- Who else
- Nobody.
Analytics (only if you allow it)
- What
- Pages viewed, clicks, and a recording of the visit with form fields masked, under a random id in a cookie; your browser, device type and approximate location.
- Why
- Your consent (Art. 6(1)(a)).
- How long
- Up to 12 months, then deleted by PostHog.
- Who else
- PostHog, in its EU region (Frankfurt).
Advertising measurement (only if you allow it)
- What
- Whether you came from an ad in ChatGPT, the pages you view, and, when you sign up or run a Theme Check, that event with your IP address, browser and, for a sign-up, a SHA-256 hash of your email address (never the address).
- Why
- Your consent (Art. 6(1)(a)).
- How long
- As set by OpenAI's advertising terms.
- Who else
- OpenAI, in the United States.
Keeping the site safe and working
- What
- Your IP address and browser when you submit a form (to stop spam and abuse), and error reports with the page and browser, without who you are.
- Why
- Security and reliability (legitimate interest, Art. 6(1)(f)).
- How long
- Rate limits: up to an hour, in memory. Sign-up attempts: 14 days in the logs. Error reports: 90 days.
- Who else
- Cloudflare Turnstile checks the forms for bots; Sentry (EU) receives error reports; PostHog (EU) keeps the logs.
Nothing is sold, nobody is profiled, and no decision about you is made automatically.
Cookies and storage
Only the necessary ones are set until you answer the cookie question; analytics and advertising wait for your yes, and stop when you take it back.
Necessary: always on
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| qubbit_consent | Cookie | Remembers your answer to the cookie question. | 6 months |
| qubbit-theme | Local storage | Remembers light or dark mode. | Until you clear it |
| Cloudflare Turnstile | Cookies, set by Cloudflare | Tells people from bots on the sign-up forms; loaded only once you use one. | Session |
Analytics: with your consent
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| ph_<project>_posthog | Cookie | PostHog's random visitor and session id. | 1 year |
| qubbit.ask.visitor | Local storage | Counts how many people use Ask AI. | Until you clear it |
Advertising: with your consent
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| __oppref | Cookie, set by OpenAI's Pixel | The reference of the ad you came from. | Set by OpenAI |
| __obref | Cookie, set by OpenAI's Pixel | OpenAI's reference for this browser. | Set by OpenAI |
Who else handles your data
These companies process data for qubbit under data processing agreements, only for what is listed above.
| Company | What for | Where |
|---|---|---|
| Hetzner Online | Servers, databases and file storage | Germany |
| PostHog | Analytics and logs | EU (Germany) |
| Sentry | Error reports | EU (Germany) |
| Postmark (ActiveCampaign) | Sending emails | United States |
| Pushover | Notifications to me | United States |
| Cloudflare | Turnstile bot check on forms | United States, global network |
| Anthropic | Ask AI's answers | United States |
| OpenAI | Advertising measurement, with your consent | United States |
Transfers to the United States rely on the EU–US Data Privacy Framework where the company is certified, and on the European Commission's standard contractual clauses otherwise.
Shopify stores in the ecosystem report
The Shopify ecosystem report is built from public data about Shopify stores, apps and themes, bought from StoreLeads and read from the Shopify App and Theme Stores: a store's domain, country, apps, theme and public social profiles, and an app or theme developer's business name and address. The site and Ask AI show counts and business listings, never a store's contact details. This is in qubbit's legitimate interest in describing the Shopify market (Art. 6(1)(f)). If one of these stores is yours and you want it left out, write through the contact form.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and take it elsewhere. Where you gave consent, you can withdraw it at any time: the unsubscribe link in every email, or Cookie settings in the qubbit menu, without affecting what happened before. Write through the contact form; you get an answer within a month.
You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the one where you live.
Changes
When this page changes, its date above changes too. If a change needs your consent again, the cookie question comes back.