Privacy Policy

1. Who runs QubitLab

QubitLab is built and run in Cambodia by a solo AI engineer and quantum researcher. For any privacy question, use Feedback (signed in) or “Contact support” on the Forgot password page.

2. What we store

• Account: email, username, password (only as a bcrypt hash, never the password itself), and whether your email is verified.
• Profile, only what you add: name, picture, bio, website, blog, social links, country, organisation, date of birth.
• Google or GitHub sign-in: the verified email and name they send us. We never receive your Google or GitHub password.
• Passkeys: only the public key and a name for the device. Your fingerprint or face never leaves your device.
• What you do here: saved circuits, jobs and their results, lesson progress, quiz answers, points and credit history.
• Signed-in devices: browser name, IP address and times, so you can see and end sessions in Dashboard → Security.
• IBM Quantum and IQM tokens you save: encrypted at rest, used only for jobs you start, never sent back to the browser.
• Feedback and support requests you send, with the optional screenshot and contact email.
• Guests: a random key kept in your browser (stored only as a hash on the server) that brings back your guest account.
• Searches in the site search are logged without any account, to improve results.

3. Why we use it

• To run QubitLab for you: sign-in, saving work, running circuits, credits and lessons.
• To keep accounts safe: rate limits, locking after wrong passwords, and spotting abuse.
• To answer you: password resets, email confirmation, replies to feedback and support.
• To improve lessons from totals (for example how many finish a lesson), never to profile you for ads.

4. Who else sees it

• IBM Quantum or IQM, only when you send a job to their hardware: the circuit and your own token go to them, under their own privacy terms.
• Google or GitHub, when you choose to sign in with them.
• Our email service (Gmail), to deliver reset, confirmation and support emails.
• Our cloud server, where the site and database run.
• Everyone, only for what you make public: if you choose “Public name” on the Ranks page, your name, picture, rank, bio and links show on the Community page and your profile.
• We never sell or rent your data, and we share it with authorities only when the law requires it.

5. Cookies and browser storage

QubitLab uses no advertising or analytics cookies, and fonts are served from our own server. We use one short cookie during Google / GitHub sign-in and your browser’s local storage for things that make the site work. All of it is strictly necessary or a setting you chose, so there is no consent banner.

You can clear them any time in your browser settings (Site data). Clearing them signs you out and resets your settings on that browser.

• ql_oauth_stateCookie

  Checks that the Google / GitHub sign-in that comes back is the one you started (security).

  How long: 10 minutes

• ql-tokenLocal storage

  Keeps you signed in.

  How long: Until you sign out (the session itself ends after 7 days or 12 hours)

• ql-guest-keyLocal storage

  Brings back your guest account on this browser.

  How long: Until cleared

• ql-last-loginLocal storage

  Shows “Welcome back” and the sign-in option you used last (username and picture only, never the email).

  How long: Until you press “Not you?”

• ql-lang, ql-themeLocal storage

  Your language and light / dark choice.

  How long: Until cleared

• ql-layout, ql-editor-prefs, qubitlab:reader:v1Local storage

  IDE panel sizes, editor and reading settings.

  How long: Until cleared

• IDE autosave, history, custom gatesLocal storage

  Your unsaved circuit and recent work, so nothing is lost on reload.

  How long: Until cleared

• ql-login-pendingSession storage

  Remembers which sign-in button you pressed while you are away at Google / GitHub.

  How long: Until the tab closes

6. How long we keep it

• Your account and work: until you or an administrator delete the account.
• Guest accounts nobody has used for 90 days are deleted automatically.
• Password reset links: 60 minutes. Email confirmation links: 24 hours (1 hour for a change of email). Each works once.
• Run credits expire 365 days after they are given (see Dashboard → Credits).
• Database backups are kept on the server for a limited time so we can recover from mistakes.

7. How we protect it

HTTPS everywhere, bcrypt passwords, encrypted provider tokens, single-use hashed links, rate limits, optional passkeys, and a sandbox that runs your Python with no network and no secrets. No system is perfect: tell us at once if you think your account was misused.

8. Your choices

• See and edit your profile, email and username in the Dashboard (a new email and username need your password; a new email must be confirmed).
• Hide your name from the Community page and ranks board at any time (Ranks → visibility), or make your whole profile page private (Dashboard → Profile → Who can see it).
• Remove passkeys, saved tokens and signed-in devices yourself in Dashboard → Security.
• Download everything we keep about you, or delete your account yourself, in Dashboard → Security → Your data. Deleting removes your circuits, jobs and credits at once; copies in backups disappear as backups rotate.
• Need help with any of this? Use Help & feedback; we answer within 30 days.

9. Young learners

QubitLab is made for students. If you are under 13, use a guest account or ask a parent or teacher before creating an account.

10. Changes to this policy

When this page changes we update the date at the top and note it in the Changelog.