Privacy Policy

1. Scope

This policy describes how Quorum’s public website and private external beta handle information. Quorum is operated by Luke Ryktarsyk and Zoltan Nahoczki. It applies to beta access requests, website feedback, the invited-reader app, support and moderation, notifications, and the limited diagnostics described below. The private beta is not a public App Store release.

Quorum is only for people in the United States who are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact support@lukerykta.io and we will delete it.

2. Information Quorum handles

• Account and profile data. Quorum handles the internal account identifier, authentication provider and provider subject, session state, and the email claim a provider supplies to the authentication service. Google sign-in may also supply a profile image URL that Supabase Auth retains as provider metadata. Quorum does not use that email as an app password or copy it into the product profile. It does not display the provider image as the in-app avatar or accept photo or video uploads. The stored product profile contains the display name, selected avatar key, and optional bio. When no avatar is selected, Quorum derives initials from the display name instead of storing initials as a profile field. Quorum separately keeps the signed-in reader’s current-club preference in device-local storage. Other eligible members of your private club can see your display name, avatar, and bio, subject to current membership, blocking, and moderation. Those profile fields are not public listings.
• Club, invitation, book, and read data. Quorum handles a club’s name; membership role, join order, and active, suspended, or departed state; invitation code state and recipient eligibility; and the selected club. A read records the book title and author, physical edition identifier and page total, reading target, lifecycle state, and predecessor or successor relationships needed for rollover.
• Progress data. Each accepted progress event records the read, exact page, durable ordering and request references, and accepted time. Quorum derives current progress and spoiler eligibility from that append-only history. Eligible members of the same club can see your current reading page and progress in the shared book, subject to current access and blocking. Progress is not published as a public score.
• Notes, replies, revisions, and deletion state. A published note or reply records its author, read, exact page, kind, text, publication time, current revision, edit history, and deletion or moderation state. Before another reader reaches the note’s page, the server returns safe locked metadata but no note text, kind, reaction field, current-content length, revision, or edited state. Replies are linked to their parent and root note and use the root note’s page boundary. Readers who can access the root may see its replies, subject to current membership, blocking, and moderation. Note and reply text that remains after account deletion can still identify its writer.
• Hearts and attention state. Quorum keeps one private heart slot per eligible note or reply and reader, the reader’s own current selection, replay and reconciliation state, and a monotonic spoiler-gate high water. Eligible club members can see heart counts, their own selection, and the display names and avatars of members who liked a readable note or reply, subject to current access and blocking. A heart can therefore identify you to other eligible members. Simply reading does not create an author-facing read receipt. Private attention records identify still-unseen, already-readable notes for the eligible reader and are acknowledged only after authorized rendering.
• Safety reports and blocks. A report records the reporter, selected club, target, reason, submission and review state, and, for a note report, the exact text, kind, and revision the reporter observed. Review events and action state are retained separately. Private blocking records apply within the selected club.
• Beta access requests. The website handles the submitted email, optional first name, phone choice, reading situation, usual formats, reading frequency, willingness to share feedback, optional written answer, contact permission, request time, and bounded delivery state. A beta request does not create an app account.
• Website feedback. The website handles the message, optional reply email, random submission identifier, submission time, and bounded delivery state. Feedback is stored separately from beta requests and safety reports. It does not create an app account or add the sender to a mailing list.
• Support messages. The support channel handles the sender address, subject, message, and information needed to route and answer the request. Support correspondence is not imported into the moderation queue.

3. Notifications

Quorum offers seven notification categories: New notes for you, Notes just ahead, Reading check-ins, New club members, Likes on your notes, Book finish date, and New book starting. Quorum stores the global on/off choice and each category choice. A new All notifications selection enables all seven categories. Only essentials enables Notes just ahead, Reading check-ins, Book finish date, and New book starting. Previously saved choices are preserved; the two book categories initially default to on. Notifications also require device permission. Replies use the New notes for you choice; they are not a separate eighth category.

To deliver notifications, Quorum stores the account identifier, a cryptographically random installation UUID, platform, FCM registration token, and last registration time. Notification jobs record recipient, club and source references, scheduling and expiry times, attempts, delivery status, and bounded error information. Current preferences and access are checked when Quorum prepares delivery.

Notifications may show club and member names, book titles, and finish dates outside Quorum. If you enable New notes for you, eligible alerts may show the current author display name, club name, and a whitespace-normalized note or reply excerpt of at most 96 grapheme clusters (displayed characters). These previews can appear on your lock screen or other notification surfaces outside the app. Notes just ahead uses a generic message without locked note text; Reading check-ins uses a generic reminder. Quorum sends the visible alert and its category, version, club identifier, and applicable read or note identifiers through Google's Firebase Cloud Messaging and, on iOS, Apple's notification service. These identifiers do not authorize access; Quorum checks current access when opening the destination.

On the device, pending notification taps are held temporarily in memory. Quorum saves a limited history of handled provider message identifiers and timestamps to prevent duplicate handling. Ordinary entries stop being used after seven days; stored history is refreshed as notifications are handled. One latest native message identifier remains without an age-based expiry. These identifiers prevent repeated handling; they do not grant access to a club or note.

You can change each category, pause all Quorum notifications, or use iOS or Android Settings. Pausing preserves your preferences and registration. On supported devices, sign-out requests dismissal of presented readable New notes for you alerts, removes this account's registration for the installation, clears its locally saved account/token association, and abandons an unfinished notification introduction. The random installation identifier and limited duplicate-prevention history can remain.

Account deletion removes notification preferences, registrations, and jobs addressed to that account. Other devices may retain local data until they reconcile or their app data is removed. Completed jobs are eligible for server cleanup seven days after their last claim, or creation when unclaimed; registrations not refreshed for 60 days are also eligible. Push permission is not required to use Quorum.

Firebase messaging also uses installation identifiers and technical app and device information to operate its service. Notification permission and Quorum's notification choices control registration and delivery to your account; they do not necessarily stop all technical processing by the installed messaging SDK. Removing Quorum's registration does not itself delete Firebase-held installation identifiers or provider delivery data.

4. Diagnostics and in-app feedback

Supported builds can send diagnostics to Sentry when remote diagnostics are enabled for that build. Staging and production use separate projects. Diagnostics help Quorum investigate failures and understand the reliability of sign-in, saving progress, opening notes, and other supported operations. They can include error messages and stack traces, native crash reports, technical breadcrumbs, device and operating-system context, app and SDK versions, build and source identifiers, timestamps, and support references.

Operation logs can include club, read, edition, and note identifiers; current or attempted page numbers and page totals; operation and attempt identifiers; and failure, timing, and recovery information. Selected operations also produce sampled traces and outcome and duration metrics. These records can be related to an account through the app's records or a support request. They are not anonymous merely because Quorum does not set a Sentry user profile.

The SDK has default personal-information sending off. Quorum disables automatic session tracking, screen recordings, screenshots, view-hierarchy capture, and automatic console logging. Its operation logs use selected fields rather than copying note bodies or credentials. Technical error context and crash stacks are still collected, so these settings are not a promise that every diagnostic record is free of identifying information. Sentry also processes connection information when receiving requests.

If you submit in-app feedback, Quorum sends the message you enter, your optional reply email, and any attached diagnostic reference to Sentry. This is separate from automatic diagnostics and from website feedback. Do not include passwords, tokens, invitation links, private note text, or another reader's personal information. An email or diagnostic reference you choose to supply can connect the feedback to you or to an earlier diagnostic record.

5. How information is used

Quorum uses information only to:

• review access requests and contact consenting beta applicants;
• review website feedback, improve Quorum, and reply about that feedback when an email is provided;
• authenticate invited readers and maintain their sessions and profiles;
• provide private clubs, books, progress, notes, replies, spoiler gates, hearts, and notifications;
• protect club boundaries and investigate security or reliability failures;
• review safety reports and apply the Community Standards;
• answer support, privacy, correction, withdrawal, and deletion requests; and
• meet legal obligations that apply to the service.

Quorum does not sell reading data, use note content for advertising, run targeted advertising, or use notification content for marketing.

6. Providers and disclosure

• Supabase provides authentication, the application backend, database, and protected server functions.
• Apple provides Sign in with Apple, APNs notification delivery, and TestFlight and App Store Connect beta distribution and review. Those beta services process tester contact, device, usage, crash, and feedback information.
• Google provides Google sign-in, FCM notification delivery, Google Play testing and distribution, and the Gmail mailbox used to receive and send beta-request, website-feedback, and Support messages.
• Expo/EAS provides app build, submission, and compatible app-update delivery. Production builds contact Expo to check for and download updates, using information such as the app platform, update channel, runtime version, and update identifiers, together with ordinary connection information.
• Sentry processes diagnostics and submitted in-app feedback as described above when those features are enabled in the build.
• Cloudflare hosts and protects the public site, runs Turnstile, stores beta requests and website feedback separately in private D1 storage, sends their notification emails, and routes Support mail to Gmail.

Quorum limits each provider to the information needed for its stated role. After reviewing the providers’ applicable terms, processing roles, subprocessors and transfer safeguards, security measures, and retention and deletion controls, Quorum confirms that each provider receiving user data will provide the same or equal protection of that data as stated in this policy and required by the App Review Guidelines. Some providers also process limited account, device, service, security, or de-identified information as independent controllers under their own privacy notices.

Information may also be disclosed when required by law, to protect a person’s safety or the service, or as part of a future service transfer where this policy continues to apply. Quorum is not a data broker and does not disclose club content for marketing.

7. Report-review access

Authorized operators use an audited review path for the exact reported target. For a note report, this exposes only the reporter-observed copy of that note’s text, kind, and revision, together with current target and action state. For a member report, it exposes the current profile and selected-club membership and action state. This review can bypass the operator’s reading-progress boundary, but grants no general club browsing or access to unrelated notes. Reports are not published to other members.

8. The public website

This website uses no advertising pixel, analytics service, or remote font. The beta and feedback forms use Cloudflare Turnstile to prevent spam. Turnstile and the hosting layer process ordinary security and delivery signals such as IP address, user agent, requested path, time, browser, and device information; Quorum does not use those signals for advertising. The website does not receive in-app club, progress, note, reaction, or notification data.

Beta answers and feedback messages are stored privately in Cloudflare and sent to support@lukerykta.io for review. They are available only to operators and providers who need them, and are not published or added to a club profile. See Cloudflare’s Turnstile Privacy Addendum.

9. Retention and deletion

Beta-request and website-feedback records are automatically removed from the active database after 180 days. Notification emails, operator exports, and related support messages are reviewed separately and removed when no longer needed. Provider backups may retain copies for their normal recovery period. To correct or withdraw a request, stop beta email, or request deletion of the request and its operator copies, email support@lukerykta.io from the submitted address. Quorum may need to verify control of that address.

To correct or request deletion of website feedback and its operator copies, contact Support with enough information to identify the message. When no reply email was supplied, Quorum may be unable to verify who sent a message or identify it reliably.

Sentry keeps error events, logs, traces, metrics, feedback, and source maps according to the retention settings for each service and the active plan. Removing an error issue does not necessarily remove related logs, metrics, feedback, or provider backups. Signing out or deleting a Quorum account does not immediately erase previously sent diagnostics or the SDK's local recovery queue. For a diagnostic or feedback deletion request, contact Support with the support reference or feedback details you have; Quorum may need additional information to locate and verify the records.

Removing Quorum's notification token record stops its use for that account. Firebase installation identifiers and provider-held delivery information have a separate lifecycle; removing the database record is not the same as deleting those records at Google. Offline installations and provider backups are not erased immediately by in-app deletion.

Quorum keeps account, club, reading, note, reaction, notification, and safety data while needed to operate the beta, maintain surviving shared records and spoiler integrity, secure the service, or meet legal duties. The report-retention rule makes resolved-report metadata, review events, submission receipts, and detached reported-note evidence eligible for removal 90 days after resolution unless an explicit legal or child-safety hold applies. Unresolved reports remain available for review. Releasing a hold does not restart the original period. A minimal action and reversal audit may remain so enforcement can be corrected. Account deletion severs the report’s link to the reporter’s account; it does not automatically erase held evidence or make retained note text anonymous. The minimal audit contains no reporter identity, note content, or content-derived evidence.

Deleting an individual note or reply while you have access to do so replaces its text with a deleted placeholder and removes its saved text revisions and hearts from the active app database. A reported copy can remain separately under the safety-retention rules above. This differs from account deletion, which retains published writing in surviving clubs as described below. Neither action immediately erases provider backups or copies another reader has already saved outside Quorum.

The authenticated deletion path removes the requesting person’s identifying profile, club access, authentication account, and disposable private account and notification state. On the normal path, the installation completing deletion also clears its drafts, keys, session, and saved local state. If local storage fails after server acceptance, saved session data and up to one inert invite-reconciliation record per affected club may remain until storage recovers or the app’s data is removed. The server deletion remains authoritative, but clean account replacement on that installation cannot be guaranteed until cleanup completes. Another offline installation retains local app data until it safely reconciles or its app data is removed.

You can also request account deletion without the app by emailing support@lukerykta.io from the email address linked to your Quorum account. We confirm the request by reply and complete the same deletion within 30 days.

In a club with other active members, published notes and replies remain under Deleted user with no portrait, bio, or profile link; your hearts are removed. Note text is not rewritten and may still identify its writer. Before deleting your account, you can remove your notes and replies from an active read if you are still an active club member. After account deletion, you can no longer manage that writing from that account. If the deleted person held an owner role, including while suspended, and no other valid active owner remained, ownership passes to the earliest-joined eligible member. An existing valid active co-owner remains without another promotion, and non-owner deletion transfers nothing. If no active member remains, the club and all of its data are deleted. Limited opaque internal ancestry and content-free history may remain where a surviving shared artifact requires it for integrity or spoiler gates, or where needed to prevent abuse or meet a legal obligation. See Account deletion for the current path.

10. Security and choices

Quorum uses access controls, separate environments, least-privilege credentials, encrypted transport, and server-side spoiler boundaries. No system can promise perfect security. If an account or invitation may be exposed, contact Support promptly without including a password, token, invitation link, note text, or another member’s private information.

For questions or corrections, email support@lukerykta.io. You can delete your account in the app or request deletion by email; the Account deletion page explains both. Apple and Google account information can also be managed through those providers.

You can contact us to request access to, correction of, or deletion of your personal information, including writing you can no longer manage in the app. Identify the request without sending private note text or sign-in credentials. We may need to verify your identity and will review the request under applicable law.

11. Changes and contact

Material changes will be posted here with a new effective date. Questions about this policy can be sent to support@lukerykta.io.