Privacy Policy

Last Updated: October 26, 2026

This Privacy Policy explains how SwiftQuantum Technologies, LLC ("SwiftQuantum", "we", "us") collects, uses, discloses, and protects information when you use any application or service in the SwiftQuantum ecosystem ("Services"). The Services covered include SwiftQuantum, QuantumNative, Q-Bridge, QuantumCareer, Q-Alpha, Q-Shield, Q-Logos, Q-Bio Genesis, the SwiftQuantum website, the QuantumNative EDU website, and the SwiftQuantum Legal API.

By using the Services, you agree to the collection and use of information in accordance with this policy.

0. Geographic Scope and Targeted Audiences

This Privacy Policy applies worldwide to users of the Services with the following important clarification regarding language coverage:

• Chinese-language (中文 / zh) content in our Services and on this site is intended for the global Chinese-speaking diaspora — including Chinese Americans, Singaporeans, Taiwanese, Hong Kong residents, and Malaysians. The Services are not distributed in mainland China or in Russia, and SwiftQuantum applications are not published on any mainland-China or Russia app stores. We do not represent compliance with mainland-China or Russian legal regimes.

• The Services are provided by SwiftQuantum Technologies, LLC (Delaware, USA) and hosted in the Republic of Korea, under Korean Personal Information Protection Act (PIPA) primary jurisdiction. Where you reside in another jurisdiction with applicable data-protection law, additional rights apply (see Section 9 below).

1. Information We Collect

1.1 Information You Provide

When you create an account or use the Services, you may provide:

• Account credentials: email address, username, password (stored hashed; never in plaintext), display name, and optional profile picture.
• Profile and preference information: learning preferences, skill level, interests, and language selection.
• Subscription and payment information: handled by Apple App Store or Stripe — we receive transaction confirmation but do not receive or store payment card numbers, bank account numbers, or full billing details.
• Communications: messages you send to support, feedback, bug reports.
• App-specific content:
  • SwiftQuantum / QuantumNative: quantum circuits, simulation outputs, saved experiments, AI Tutor chat history (retention: see Section 5).
  • Q-Bridge: hardware-execution submissions to third-party quantum backends (anonymized before forwarding).
  • QuantumCareer: resume / portfolio details, job-search history, skill certifications. Career data is not shared with employers without your explicit "apply" action.
  • Q-Alpha: financial-risk model parameters, portfolio configurations, quantum-random-number-generator (QRNG) seeds. We do not receive your bank account or brokerage credentials.
  • Q-Shield: organization profile, algorithm selections, compliance parameters. No real security-infrastructure data is collected; Q-Shield is a planning and assessment tool.
  • Q-Logos: GPS coordinates, route data, vehicle status, delivery metrics — collected only while the app is foregrounded for an active route, revocable in device settings.
  • Q-Bio Genesis: compound parameters, in-silico toxicity scores. The platform is Research Use Only (RUO); no patient data and no clinical decision support.

1.2 Information We Collect Automatically

• Device information: device type, operating system version, app version, screen size, language and region settings, unique device identifiers (IDFA / Advertising ID only with your consent on platforms that require it).
• IP address: for security, abuse prevention, and rough geolocation (country / region only). Not used for advertising.
• Usage data: which features you use, session duration, course progress, quiz scores, time spent — aggregated and anonymized after 30 days.
• Diagnostic data: crash reports, error logs, app performance metrics. Crash reports do not include the contents of your circuits or chats.
• Referral source (websites only): if you reach one of our websites through a link with campaign tags or from another site, a first-party cookie (sq_attr, 90 days) keeps the tag values, the referring domain, the landing page and the date, and our server records them once, without your email, account ID or IP address, when you sign up or start a checkout. It is not set if your browser sends Global Privacy Control or Do Not Track. See the Cookies Policy.
• Website analytics (websites only): we count page views with Umami, an open-source tool we host ourselves at stats.swiftquantum.tech (AWS Seoul region). It sets no cookies and does not store your IP address. For each page view it records the page path (query strings removed except campaign tags; IDs and tokens in the path masked), the referring site's domain, browser, operating system, device type, screen size, language, and an approximate location (country, region, city) derived from the IP address when the request arrives; visits are grouped by a pseudonymous identifier that changes periodically. It is not loaded if your browser sends Global Privacy Control or Do Not Track, or if you turned analytics off or declined in a site's cookie banner. Short links on go.swiftquantum.tech (Shlink, also self-hosted) record each click's time, referring site, browser and an anonymised IP address (last part removed). These statistics are used only to improve our websites and are never used for advertising, sold or shared.

1.2.1 AI Service Providers

When you use an AI feature, the text you enter, and where needed a recent part of the conversation, is sent to one of the following providers to generate a response:

• OpenAI, L.L.C. (model gpt-4o-mini unless noted): the QuantumNative AI Tutor; the AI tutoring, curriculum, and Daily Pulse features of the SwiftQuantum account service; and these features:
  • SwiftQuantum IDE web, circuit generation: the circuit description you type (model gpt-4 by default).
  • Q-Bridge quantum tools (qubit health, noise diagnosis, error budget, crosstalk): calibration and noise figures, the backend name, and the circuit type you choose.
  • QuantumCareer cover letters: the role and company, the tone you pick, the first 1,500 characters of the job description, what you write about yourself for the letter (story, achievements, highlights, background), the first 1,500 characters of any résumé text you paste, your skills from your Talent Pool registration and skill certifications, and your name (or username).
  • QuantumCareer résumé tools: for analysis and optimization, the résumé text you paste (up to 6,000 characters) and, for optimization, your target role; for job matching, your résumé and the job description (up to 3,000 characters each).
  • QuantumCareer AI career curriculum: your interests and current skills.
  • QuantumCareer career profile document: your QuantumCareer career profile, up to 3,000 characters: headline, summary, current and desired role, desired salary and locations, experience, education, certifications, skills, publications, and languages, as you entered or edited them. If you connected LinkedIn, it also includes what we imported from LinkedIn: your name, LinkedIn member ID, profile photo URL, and country.
• Anthropic PBC (Claude models): the QuantumNative EDU web tutor, the Sentinel assistant in the Q-Shield web app, and the BioAdvisor in the Q-Bio Genesis web app.

Both providers act as our service providers under their API terms, which do not allow them to use this data to train their models by default. They may keep it for a limited period to monitor abuse, as their terms describe. The current list is on our Subprocessors page.

QuantumNative (iOS app and QuantumNative EDU website)

• iOS app: on devices where Apple's on-device model is available, the AI Tutor answers on your device by default, and nothing is sent to us or to an AI provider. Otherwise, or if you choose cloud mode, your message goes through our servers (AWS, Seoul) to OpenAI in the United States, together with earlier messages of the same conversation (when a conversation gets long, older messages are replaced by a short summary that OpenAI also writes) and the title of the lesson or quiz you asked from.
• QuantumNative EDU website: your question goes from our web server to Anthropic (model claude-sonnet-4-6) in the United States, with your curriculum level (a number) and your language setting. Each question is sent on its own, without earlier messages.
• Your name, email address and account ID are not sent to OpenAI or Anthropic.
• Answer checks (HallucinationGuard) run on your device, on our web server or on our own servers, not with a third party. Feynman practice feedback and answer grading do not use an AI provider. Daily Pulse summaries are written by OpenAI from public arXiv papers, without user data.
• How each provider handles API data: OpenAI, Anthropic.
• Tutor conversations from cloud mode and from the website are saved with your account on our servers in Seoul so they follow you between devices. Messages older than 365 days are deleted from your history the next time it is loaded. In the iOS app you can delete one conversation, or all of them, at any time; for the website, write to privacy@swiftquantum.tech.

Except for QuantumNative (above), AI chat history visible in your account is auto-deleted after 90 days.

1.2.2 Research Study Data (QuantumNative, IEEE QCE26 pilot — opt-in)

QuantumNative (the iOS app and the QuantumNative EDU website) runs an education-research pilot for IEEE Quantum Week 2026 (QCE26) paper #305. Taking part is optional and off by default.

• Who: only users who declare in the app that they are adults (18 or older) and who explicitly turn research participation on. Age is self-declared; the option is not shown to users who declare an age under 18, and we do not accept their research data.
• What we collect while you take part:
  • quiz answers: the item and level, the choice, whether it was correct, the attempt number, and how long you took to answer;
  • level completions: the level, number of attempts, pass or fail, and time spent;
  • AI tutor usage metadata: the verification tier of the answer, whether it ran on your device or in the cloud, response time, language, and whether a safety check flagged a claim; for tutor requests handled by our server, also the model name, token count and cost. Never the text of your questions or of the answers;
  • feature-use events (for example, that you opened a questionnaire);
  • session start, end and duration;
  • your answers to the pilot questionnaires (knowledge pre/post test, usability scale, self-efficacy scale, feedback survey), if you choose to submit them;
  • app version, app language and device type; in the iOS app also the device model, the iOS version and the region setting.
• Pseudonymous, not anonymous: these records are stored with your account's internal user ID, not with your name or email. Because we can link that ID to your account, the records are personal data and this policy applies to them. The 30-day anonymization described in Section 1.2 does not apply to them.
• Purpose: to study how learners use the curriculum and the AI tutor, and how well the tutor's answers stay grounded, for the IEEE QCE26 education research. Not used for advertising or profiling, not sold, and not shared with anyone other than the hosting providers that store it for us.
• Publication: only aggregated, de-identified statistics may be published (for example in the paper or a talk). No individual record, user ID or other information that identifies you is published.
• Legal basis: your consent (GDPR Art. 6(1)(a); PIPA Art. 15(1)(1)).
• Withdrawal: you can withdraw at any time in the app's settings (Research & Privacy). From then on no research data is sent or accepted, and events still waiting on your device are discarded. Withdrawing does not delete records already collected; to have them deleted, write to privacy@swiftquantum.tech.
• Retention: until the analysis for the study is finished, and no longer than 2 years after collection; then deleted or irreversibly de-identified.

1.2.3 Saved Data and Memory Features (Updated 2026-10-26)

Since October 26, 2026, some of our apps keep short saved notes with your account on our servers so that you do not have to repeat yourself. We do not use these notes to train any model. Each product's own privacy page describes the same.

QuantumCareer — saved career profile

• What is kept: the preferences you enter (such as target role, location, work arrangement, seniority, skills, interests, industries, working languages and a note for writing help); the skill names found when you analyze a résumé and the target role you enter for résumé optimization; your profile and roadmap, if you sync them from the app; your passed skill tests, when you choose "Import from my records"; and a one-line note (job title and company) for each cover letter you save.
• Email addresses, phone numbers, national ID numbers and card numbers are masked before saving. Each plan keeps a limited number of facts (Free 100, Pro 500, Enterprise 1,000); beyond that, older or replaced facts are removed first.
• You can view, edit, delete (one fact or all of them) and download your saved profile as JSON on the Saved career profile page; it is also included in your account data export. Deleting a saved cover letter removes its note, deleting the AI data synced from the app removes the synced facts, and deleting your account deletes the whole saved profile.
• Facts from your saved profile are included in the requests we send to OpenAI (Section 1.2.1) for AI cover letters, the Cover Letter Studio, résumé optimization and the AI career curriculum. Job and news matches for your saved profile are calculated on our own servers by comparing words, without an AI provider.

QuantumNative — learner memory and My Quantum Notebook

• What is kept: sentences from your tutor questions in which you mention a learning goal or a difficulty (picked out by fixed phrase rules, not the whole conversation); the topics you asked the tutor about; the learning profile the iOS app sends with tutor messages; practice results (the concept and a score band); and your journal entries. My Quantum Notebook is built from these and from tutor answers that passed our HallucinationGuard check.
• Email addresses, links, phone numbers and other long numbers are masked before saving.
• This is on by default. You can switch it off in Settings ("Let the tutor save and use notes"); nothing new is then saved, and saved notes are no longer added to tutor requests. Notes already saved stay until you delete them or they expire.
• Notes are kept for 365 days and then deleted. Deleting a tutor conversation or a journal entry removes what came from it. In Settings ("What the tutor remembers") you can view your notes, delete one or all of them (deleting all also removes the notebook pages) and download them as JSON. Deleting your account deletes all notes and the notebook.
• While saving is on, saved notes related to your question are added to tutor requests sent to the AI provider (Section 1.2.1): OpenAI for the iOS app in cloud mode, and Anthropic for the website tutor (not in Socratic mode). On the website, earlier messages are still not sent, but these saved notes are.

Q-Bio Genesis — stack memory

• Off by default. Notes are saved only if you turn it on in Settings ("What Q-Bio remembers").
• What is kept: your BioAdvisor questions, your Bio-Stack compound lists and short simulation summaries (the compound name or formula and the overall level, never the SMILES string). Email addresses, phone numbers and similar details are masked first, and a note that still looks like personal data after masking is not saved.
• Each note is deleted 48 hours after it was saved. You can delete notes one by one or all at once; turning stack memory off deletes every note, and deleting your account deletes them as well.
• While stack memory is on, saved notes related to your question are added to BioAdvisor requests, which go to Anthropic (Section 1.2.1).
• The compounds and simulation results you save stay in your account until you delete them (the Library page on the website, or the saved compounds list in the app) or delete your account; they are not removed automatically after 48 hours. Deleting your account deletes them, with their scores and reports, together with stack memory and the other Q-Bio records kept for your account. Our tamper-evident audit log is the exception: its entries cannot be removed without breaking its verification, so the content of your entries (such as compound names) is erased and only the event type, the time and a numeric account number remain.
• Tox21 assay estimates are calculated on our own server with a model we run ourselves; your structure is not sent to any third party for them.

Q-Shield — saved context

• What is kept: short facts from your own records — assessments (score, risk level, the algorithms you declared and their replacements), crypto scans (the TLS and certificate details measured for each domain), vendor assessments (risk score and estimated algorithms) and the Echo questionnaire answers you drafted (answered questions only).
• A fact that contains anything resembling a key or other secret is dropped rather than saved; email addresses and phone numbers are masked.
• Each fact is kept for 365 days or until the record it came from is deleted, whichever comes first. Your plan sets how many facts are kept (from 50 on Free to 10,000 on Enterprise); beyond that, the oldest are removed first.
• On the Crypto wiki page (Saved context) you can view your saved facts, delete one or all of them (deleting all also removes the wiki built from them) and export them as JSON. Deleting your account deletes all saved context and the wiki.
• Saved context is used by the Sentinel Advisor when it is available: facts related to your question are picked on our servers by matching words, without an AI provider, and added to the advisor request sent to Anthropic (Section 1.2.1). Each answer shows which saved facts it was given and which it relied on.

1.3 Information We Do NOT Collect

• Bank account numbers, full credit card numbers, brokerage credentials, national ID / SSN-equivalent numbers — never collected.
• Real-world facial recognition data — never collected.
• Patient health records or clinical diagnostic data (Q-Bio is RUO).
• Children under 13 information without verified parental consent — see Section 8.

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Services;
• Authenticate accounts and prevent abuse, fraud, and security incidents;
• Process subscriptions and refunds via Apple or Stripe;
• Send you transactional and security emails (you cannot opt out of security-critical notices);
• Send you product updates and educational content (you can opt out at any time);
• Conduct internal research and analytics on aggregated, anonymized data;
• Comply with legal obligations and respond to lawful requests.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

3. Data Sharing and Disclosure

We share information only as follows:

• Service providers under written Data Processing Agreements: Amazon Web Services (AWS: hosting in ap-northeast-2 / Seoul, with content delivery through Amazon CloudFront worldwide, and email delivery through Amazon SES), OpenAI and Anthropic PBC (AI features), Apple (App Store payments, Sign in with Apple, push notifications), Stripe (web payments and sales tax calculation), and ImprovMX (email forwarding for our @swiftquantum.tech addresses). The current list, with the data each receives and where it is processed, is on our Subprocessors page.
• Quantum hardware partners (Q-Bridge only): IBM Quantum, IonQ, Rigetti Computing, and other backends you explicitly choose. Submissions are anonymized — no account email, name, or device identifier is forwarded.
• Legal compliance: in response to a valid subpoena, court order, or other lawful government request, with notice to you where legally permitted.
• Business transfers: in the event of a merger, acquisition, or asset sale, your information may transfer to the successor entity, which must honor this Privacy Policy or provide 30 days' advance notice.

4. Data Security

We protect your information with:

• HTTPS / TLS 1.2+ in transit;
• AES-256 encryption at rest in AWS;
• bcrypt password hashing;
• JWT-based session tokens with short rotation windows;
• Quarterly security reviews and continuous vulnerability scanning;
• Migration to NIST Post-Quantum Cryptography (ML-KEM-768 / ML-DSA / SLH-DSA) ongoing — Q-Shield, Q-Alpha, and Q-Bridge backends targeted for full PQC by end of 2026 to align with NSA CNSA 2.0 timelines.

No system is perfectly secure. If you discover a vulnerability, please contact security@swiftquantum.tech (we will not pursue legal action against good-faith researchers who follow responsible-disclosure norms).

5. Data Retention

6. Your Rights and Choices

You may, at any time:

• Access your data: visit Settings → Privacy → Export Data.
• Correct inaccurate data: via in-app profile editor.
• Delete your account: Settings → Account → Delete (30-day irreversible erasure window with cancellation option).
• Port your data: receive a JSON export of your circuits, progress, and chat history.
• Opt out of marketing emails: footer of every marketing email, or Settings → Notifications.
• Restrict processing for specific purposes: contact privacy@swiftquantum.tech.
• Withdraw consent for processing where consent is the legal basis.

We respond to all rights requests within 30 days (or 45 days where permitted by CCPA), with one 30-day extension where the request is complex.

7. Children's Privacy (COPPA)

The Services are not intended for children under 13. For users under 13:

• We do not knowingly collect personal information without verified parental consent.
• Parental consent is verified by a credit-card-on-file confirmation charge (refunded immediately) or by signed parental-consent form.
• If we learn we have collected a child's information without parental consent, we delete it and the account immediately.
• Parents may review, modify, or request deletion of their child's data by contacting privacy@swiftquantum.tech.

QuantumNative EDU additionally requires that users 13 and older agree to its Terms of Service, with school-administered installations using parental delegation forms.

8. International Data Transfers

The Services are operated from the Republic of Korea. When you use them from outside Korea, your information is transferred to and processed in Korea. We rely on:

• Korea — EU adequacy decision under GDPR Article 45, adopted by the European Commission on 17 December 2021 and currently in effect. The decision is reviewed every four years, with the first review period shortened to three years; transfers from the EEA to commercial operators in Korea may proceed without additional transfer tools.
• Standard Contractual Clauses (SCCs) or the provider's equivalent data processing terms for transfers to OpenAI, Anthropic, Apple, Stripe, and AWS services outside Korea. The recipients, countries, data items, purposes, and retention periods of these transfers are listed on our Subprocessors page;
• Data Processing Agreements (DPAs) with all named service providers.

9. Region-Specific Rights

9.1 European Economic Area (GDPR), United Kingdom (UK GDPR), Switzerland

You may file a complaint with your local Data Protection Authority. Our designated representative for EEA inquiries is reachable at privacy@swiftquantum.tech.

9.2 California (CCPA / CPRA)

We do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete, correct, and limit use of sensitive personal information. We do not discriminate against users who exercise these rights. Authorized agents may submit requests on your behalf with written authorization.

9.3 Republic of Korea (PIPA)

The Korean Personal Information Protection Act ("PIPA") amendment was passed by the National Assembly on 12 February 2026 and officially promulgated on 10 March 2026. Most provisions take effect on 11 September 2026; the regime described below applies prospectively from that date.

Key changes you should know about:

• The administrative-fine cap increases from 3% to up to 10% of total revenue, but only in specific high-severity circumstances: (a) repeated violations involving willful misconduct or gross negligence within a three-year period, (b) violations affecting ten million or more data subjects, or (c) failure to comply with a corrective order issued by the Personal Information Protection Commission (PIPC). Lower-severity violations remain subject to the prior penalty bands.
• The business owner or legal representative is now explicitly designated as the ultimate person responsible for processing and protecting personal information.
• Where a violation is not caused by intent or gross negligence, the PIPC must reduce penalties for organizations that demonstrate verified investment in privacy (dedicated budget, personnel, equipment, and systems).
• ISMS-P (Personal Information & Information Security Management System) certification, previously voluntary, becomes mandatory for qualifying private entities from 1 July 2027.

We treat Korean users' data under PIPA's mandatory / optional consent distinction. We do not collect Korean Resident Registration Numbers (주민등록번호) under any circumstance.

9.4 Japan (APPI)

The most recent amendment bill to Japan's Act on the Protection of Personal Information ("APPI") was approved by the Japanese Cabinet on 7 April 2026 and submitted to the Diet. As of the "Last Updated" date of this Privacy Policy, the bill is pending Diet enactment; once enacted and promulgated, the amendments come into force within two years.

Anticipated changes once the amendment takes effect include:

• A new consent exemption for statistical processing, including AI-model training, allowing businesses to use publicly available sensitive personal data and to share personal data with third parties for such purposes, subject to transparency and contractual safeguards.
• New protections for children's data, including parental consent for users under 16 and enhanced child rights to request deletion or suspension of data use.
• New protections for biometric data.
• An administrative fine system under the Personal Information Protection Commission (PPC).
• A risk-based notification regime: businesses may be exempt from individual notification where the PPC designates a breach as low-risk, provided alternative safeguards are taken.

Cross-border transfers to Japan-based partners (including quantum hardware partners where Q-Bridge routes a circuit submission to Japan) are made under SCCs with explicit Japanese-language disclosures available on request to privacy@swiftquantum.tech.

9.5 Canada (PIPEDA, Quebec Law 25)

Quebec users may request French-language communications. Our designated Privacy Officer is Park Eun Min, contactable at privacy@swiftquantum.tech.

9.6 Germany (BDSG)

We operate without a physical presence in Germany; for inquiries please contact privacy@swiftquantum.tech. Data minimization and storage limitation principles are applied across the platform.

9.7 Brazil (LGPD), Australia (Privacy Act 1988)

LGPD: our Data Protection Officer is contactable at the privacy email. Australia: complaints may be lodged with the Office of the Australian Information Commissioner (OAIC) after first attempting resolution with us.

9.8 Other Jurisdictions

We aim to comply with applicable data-protection laws in every jurisdiction where the Services are available. The Compliance page (/compliance) lists our regulation tracking across the eight primary jurisdictions.

10. Quantum Hardware Disclosure

When you use Q-Bridge to submit a circuit to a third-party quantum backend (IBM Quantum, IonQ, Rigetti, or others you select):

• Submissions are subject to the applicable hardware provider's terms and privacy policy.
• Hardware availability is not guaranteed; queues, calibration windows, and outages may delay or prevent execution.
• Results may be affected by quantum noise and decoherence; shot-by-shot variance is inherent and not a defect.
• Hardware-execution credits are non-refundable once consumed.

11. Changes to This Policy

We will notify you of material changes by:

• In-app notification at next launch;
• Email to your registered address (for non-trivial changes);
• Updating the "Last Updated" date at the top of this page.

For material changes affecting privacy rights, we provide 30 days' advance notice before the change takes effect.

12. Contact

Operating Entity: SwiftQuantum Technologies, LLC Limited liability company, Delaware, USA 1111B S Governors Ave #56506, Dover, DE 19904, USA Designated Privacy Officer: Park Eun Min (박은민)

This policy is the canonical English version. Translations are provided for convenience; in case of conflict, the English version controls unless local law mandates otherwise (notably PIPA in Korea, where the Korean version controls).