Privacy Policy

1. Controller and scope

This Privacy Policy applies to the website at qrealmstudios.com, the Intervals product pages, beta application forms, purchase and licensing workflows, and related customer support interactions.

The service is operated under the commercial name QRealm Studios. For privacy requests, contact qrealmstudios@qrealmstudios.com.

2. Data we collect

We collect only the categories of information reasonably needed to operate the service, process purchases, issue licenses, prevent abuse, and support customers.

• Website interaction data, such as standard technical request information and limited browser storage preferences used for language selection and site experience.
• Beta application data, including name, email address, operating system, role, musical experience, DAW information, application reason, and consent confirmation.
• Purchase and licensing data, including customer email, customer name, country, product and variant purchased, order and customer identifiers, purchase date, refund status, and related license status information.
• Intervals account data, including your username, email address, whether the email is confirmed, the licenses registered to the account, the Terms version you accepted and when, and whether (and since when) you agreed to receive product news. We never store your password: we keep only a salted Argon2id hash of it, from which the password cannot be recovered. The password itself travels only over encrypted connections and is held in memory just long enough to be checked or hashed; it is never logged.
• Computers signed in to your account, including a random identifier created by the app, a one-way hash of your operating system's machine identifier (used to recognise the same computer, never the identifier itself), the computer name, platform, operating system and app version, edition, when it was first and last used, and sign-in session records.
• Sign-in security records: to limit repeated attempts we record IP addresses and the usernames, emails or keys used, stored only as keyed hashes (HMAC with a secret key; the IP hash also changes every day), so they cannot be turned back into the original values; and audit events such as sign-ins, sign-outs, password and email changes, and computers replaced when the five-computer limit is reached.
• License activation data for older app versions that activate a license key per device, including device identifier, device name or instance name, platform, app version, activation events, entitlement tokens, and license validation records.
• Support and operational records, including webhook logs, anti-fraud records, and service event history needed for diagnostics and auditability.

3. Data stored locally in the desktop app

When you choose "Keep me signed in", the desktop app stores an account session on your computer, readable only by your user: a session token that is replaced on every refresh, a short-lived signed entitlement token, your username and email, your edition and features, your product-news choice, and the licenses and number of computers shown in the Account window. Without "Keep me signed in", nothing is written to disk and the session ends when you quit. Older app versions stored the license key you entered instead; the current version removes that file once your key is registered to an account.

On our backend, we generally store a hashed representation of the license key plus limited reference data, not the plaintext key as part of normal server-side license records.

4. How we use the data

• Operate the public website and customer flows.
• Review and respond to beta applications.
• Send accepted beta testers updates about the beta program. Every update includes a link to unsubscribe from them; unsubscribing does not affect emails about your own feedback or reward.
• Process purchases and refunds.
• Create and secure your Intervals account, sign computers in and out, and send account emails (email confirmation, password reset, security notices when your password or email changes, and a notice to the buyer when a key is registered to an account with a different email).
• Check new passwords against known data breaches (see "Sharing with third parties").
• Send product news and offers, only if you asked for them when registering or in Help ▸ Account….
• Issue, refresh, deactivate, and validate licenses.
• Prevent fraud, abuse, duplicate activations, and unauthorized access.
• Maintain accounting, tax, legal, and security records where required.

5. Legal bases

Depending on where you are located, we generally rely on one or more of the following bases:

• Performance of a contract, where data is needed to process your purchase, provide the software, activate your license, or respond to product support tied to the purchase.
• Legitimate interests, where data is needed for service reliability, abuse prevention, diagnostics, operational security, and product administration.
• Consent, where you voluntarily submit a beta application, choose to receive product news and offers, or otherwise provide information for a clearly optional purpose. You can withdraw consent at any time — for product news, by unticking "Email me about Intervals updates and offers" in Help ▸ Account…, with the unsubscribe link in any such email, or by writing to us — without affecting processing done before.
• Legal obligations, where we must retain or disclose information for accounting, tax, fraud, or regulatory reasons.

6. Sharing with third parties

We do not sell your personal data. We may share limited data with service providers only where reasonably needed to operate the product or comply with law.

• Lemon Squeezy, for checkout, payment processing, tax handling, merchant-of-record operations, and certain refund or anti-fraud actions.
• Supabase, which hosts our database (in the European Union, Ireland region) and the server functions that run Intervals accounts, license activation, entitlement management, webhook handling and beta form submissions.
• Resend, which sends account emails such as email confirmation, password reset and security notices.
• Have I Been Pwned (Pwned Passwords): when you choose a password, we send only the first 5 characters of its SHA-1 hash to check whether it appears in known data breaches. Neither your password, its full hash, nor anything that identifies you is sent.
• Email delivery providers, such as transactional mail providers used to send beta communications or operational messages.
• Infrastructure and hosting providers that support the website, application delivery, and technical operations.
• Authorities, advisers, or counterparties where required by law, regulation, formal request, or to protect rights, safety, or security.

7. International transfers

Our account and licensing database is hosted in the European Union. Some providers are based outside the European Economic Area and may access or process data there: Supabase (Singapore, with its group in the United States; hosting and support), Resend (United States; email delivery) and Lemon Squeezy (United States; payments, as merchant of record). These transfers rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement and, for providers certified under it (such as Resend), on the EU–U.S. Data Privacy Framework adequacy decision. You can ask us for a copy of the relevant safeguards at the contact address below.

8. Cookies, browser storage, and analytics

The public site currently uses limited browser storage primarily for language preference and certain presentation settings. As of the effective date of this policy, we do not intentionally run third-party advertising cookies or public-site behavioral analytics scripts.

Demo videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com), so YouTube does not set tracking cookies until you play a video. If you do, YouTube (Google) may use cookies and similar technologies under its own privacy policy.

If we materially change that approach in the future, we will update this policy and any related consent or disclosure flows as needed.

9. Data retention

We keep personal data only for as long as reasonably necessary for the purposes described above. In practice, retention depends on the type of record and the legal or operational need tied to it.

• Purchase, tax, and accounting records may be retained for the period required by law.
• Licensing, activation, and anti-abuse records may be retained while a license remains active and for a reasonable period afterward for support, fraud prevention, and audit needs.
• Account data is kept while your account exists and is erased when you ask us to delete the account; the licenses you bought stay on record (as purchase records) but are no longer linked to you.
• Rate-limiting records are deleted after 7 days, confirmation and reset links after 30 days, ended sign-in sessions and entitlement records 180 days after they end, and licensing audit events after 24 months.
• Beta application records are kept on an ongoing basis to manage the beta program. We only use them to contact you about the beta, never for unrelated communications, and keep them until you ask us to delete them (see Your rights).
• We may delete, anonymize, or minimize records when they are no longer needed.

10. Your rights

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to receive the data you gave us in a portable format. Where processing is based on consent, you can withdraw it at any time. We answer requests within one month.

To make a privacy request, email qrealmstudios@qrealmstudios.com and include enough detail for us to identify the relevant record. We may request additional information reasonably necessary to verify the request and avoid unauthorized disclosure or deletion.

If you think we have not handled your data lawfully, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or with the supervisory authority of your country of residence.

11. Minimum age

You must be at least 14 years old to create an Intervals account or send a beta application. We do not knowingly collect data from younger children; if you believe a child under 14 has given us personal data, contact us and we will delete it.

12. Security

We use administrative, technical, and organizational measures appropriate to the size of the service and the type of data processed, including encrypted connections, salted Argon2id password hashes, hashed sign-in session tokens, limits on repeated sign-in attempts, and database access restricted to our own server functions. No system can guarantee absolute security, but we aim to minimize data collection, limit access, and reduce unnecessary exposure wherever practical.

If a personal data breach occurs, we notify the Spanish Data Protection Agency within 72 hours where required, and tell affected users without undue delay when the breach is likely to put their rights at high risk.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the product, law, operations, or provider stack. The latest version will be published on this page with an updated effective date.

14. Contact details