Privacy Policy

Account data: your email, used for login and essential communication.

Profile data, which you choose to fill in: name, username, avatar photo, bio, website, social profiles (LinkedIn, X, Instagram, Dribbble), phone, WhatsApp, and address — each with its own toggle to make it public or not.

Saved content: the links, notes, tags, Collections, and Spaces you create.

Technical data: essential session cookies (needed to keep you logged in) and, approximately, the country your access comes from, used only to decide the interface's default language.

Most data comes directly from you, when you fill in your profile or save a link. Session cookies and approximate access country are collected automatically by the service's infrastructure.

Browser extension (Chrome and Edge), optional to install: it reads the address and title of the open tab only at the moment you ask it to save — by clicking the toolbar icon, choosing “Save to Quickrefs” from the right-click menu, or pressing the keyboard shortcut. Those two values fill in the save form and land in your account like any link saved from the website. The extension does not read page content, does not inject code into pages, and does not track your browsing.

Inside your browser, the extension stores only your session (so it does not ask you to sign in on every save) and the last Space and Collection you used (so the next save comes pre-filled). That lives in the extension's own storage area, is never sent to us or to third parties, and goes away when you uninstall it — links you already saved stay in your account.

If you sign in with Google, in the extension or on the website, all we receive from Google is your email and basic profile data (name and picture), used to identify your account. We request no other access to your Google account.

To provide the service (authentication, saving and displaying your content, showing your public profile if you opt into that), for essential communication (login codes, account notices), to prevent abuse, and to process payment when you subscribe to the Pro plan.

We may produce reports and analyses about how the platform is used, and publish or sell them. They use aggregate figures only — totals, averages and proportions across all accounts, such as how many links get saved per week or which subjects come up most in public collections. This is not a disguised version of your data: nothing in them identifies you, on its own or combined with anything else, and no data of yours, identifiable or not, is ever sold, licensed or passed to a third party — not your profile, not your links, not your notes and tags.

We don't sell your data. We use the following processors to run the service, each receiving only what it needs to do its job:

Supabase (database, authentication, and file storage such as avatars); Vercel (application hosting); Resend (sending transactional emails, such as login codes); Stripe (Pro plan payment processing, once available); Google Analytics (site usage metrics, once enabled).

These providers may process data outside Brazil; in those cases, we require them to offer protections consistent with Brazil's LGPD.

We use one essential session cookie to keep you authenticated — without it, login doesn't work. Once Google Analytics is active, it may use its own cookies for aggregate usage metrics; you can block those in your browser settings without affecting login.

We keep your data for as long as your account exists. After a deletion request, we remove identifiable personal data, subject to the technical time needed to purge backups.

Under applicable data protection law (including Brazil's LGPD), you can request at any time: confirmation that we process your data, access to it, correction of incomplete or outdated data, anonymization or deletion of unnecessary data, portability, information about who we share your data with, and withdrawal of consent.

To exercise any of these rights, write to hello@quickrefs.com. You can also delete your own account directly from My Profile, in the "Danger zone" section, by typing your registered email to confirm.

We use reasonable technical measures to protect your data (passwordless authentication via one-time codes, row-level access control in the database). No system is 100% secure, and we can't guarantee absolute protection.

Quickrefs isn't directed at anyone under 18 and doesn't knowingly collect data from children.

We may update this policy as the service evolves. Material changes will be communicated by email or an in-product notice before they take effect.

For any question or request about your data: hello@quickrefs.com. Given the company's size, there's no separately designated data protection officer — that inbox is handled directly by the people running Quickrefs.