Effective 22 July 2026 · Version 1.4
Privacy policy
SideQuesto is local-first. The app needs enough context to help you understand coding work, but that does not mean we need a copy of your project. This policy explains what stays on your Mac, what is sent to our service providers, and what you can control.
Who is responsible
The controller is ulterier sp. z o.o., registered in the Register of Entrepreneurs of the National Court Register, KRS 0000983425, VAT PL5273012387, REGON 52267137400000.
Registered address: al. Jerozolimskie 85/21, 02-001 Warszawa, Poland. Correspondence: Chmielna 73, 00-801 Warszawa, Poland. Represented by Ahmad Piraiee, Founder and CEO. Privacy requests: hi@sideques.to.
What the Mac app does locally
In standard mode, SideQuesto reads coding-agent event sources on your Mac so Dex or Pip can understand the current task. Raw prompts, source code, full commands, tool input and output, full logs, secrets, and absolute file paths are not retained in SideQuesto history or uploaded as learning data. The app reduces events locally to a limited description before deciding whether anything should be shown or spoken. The separately consented, local Research Lab described below is the only exception for selected visible conversation text.
Saved Dex and Pip messages and cached summaries are encrypted with authenticated AES-256-GCM. A random key is created for each installation and stored in macOS Keychain. Local database files are owner-only and excluded from device backups. Preferences, usage totals, onboarding choices, entitlement state, token-ledger totals, and Mastery Lab scores are also stored locally. Device activation uses a separate P-256 signing key held by Secure Enclave when available, or by the non-migrating macOS Keychain otherwise. The private key is never uploaded.
Data we process
| Data | Why and legal basis | Where it goes |
|---|---|---|
| Account email, user ID, sign-in provider, role and session | Create and secure your account, provide the service and prevent misuse. Contract; legitimate interests in security. | Supabase; Google or Apple only when you choose that sign-in. |
| Activation-code and email HMAC digests, device public key, public-key fingerprint, activation and revocation times | Enforce one account and one activated Mac, reject replayed requests and prevent copied codes or sessions from unlocking a second laptop. Contract; legitimate interests in security and fraud prevention. | Supabase. The device private key remains on the activated Mac. Resend receives the invitation email and private DMG attachment. |
| Plan, Stripe customer and subscription IDs, payment status, invoices, natural-voice allowance, and a protected digest of Stripe’s card fingerprint for trial-abuse checks | Take payment, manage subscriptions, prevent overspend, keep accounting records, and stop one payment method from creating repeated trials through duplicate accounts. Contract; legal obligations; legitimate interests in fraud prevention. | Stripe and Supabase. SideQuesto does not receive full card numbers. The limited fingerprint is transformed before SideQuesto stores it. |
| The exact words Dex or Pip will speak, or a locally minimized description of a complex event | Produce optional natural voice or an optional cloud-generated explanation. Contract, initiated by your selected feature. | OpenAI only when the relevant cloud feature is enabled. |
| Optional thumbs rating, character, source category, priority, bucketed length and random message ID | Adapt locally and evaluate whether explanations are useful. Legitimate interests in product improvement; you may object. | Stored locally. When signed in, the minimized rating signal is also sent to Supabase. The message itself is not included. |
| Optional Research Lab session: the categories you select among lifecycle events, visible prompts, visible assistant responses, SideQuesto Context Cards, narration, Prompt Coach answers and voluntary usefulness labels | Evaluate and improve SideQuesto explanations with a closed test group. Consent, which can be paused or withdrawn at any time. | An encrypted, separate vault on your Mac. Nothing is uploaded automatically. A readable export goes only to a location you choose and is reviewed locally by an administrator only if you deliberately provide it. |
| Daily active seconds, sessions, tasks started and completed, failures, approvals, coding-agent provider, app version, locale and time zone | Understand private-beta onboarding, reliability and broad product use without collecting project content. Legitimate interests in improving and operating the service; you may object. | Supabase while you are signed in and have active access. No prompts, code, paths, logs, messages or audio are included. |
| Beta invitation source and cohort, onboarding status, lifecycle stage, follow-up and action history, product-email choice and limited founder notes | Deliver and improve private-beta onboarding and support, avoid duplicate contact, and show the founder what was or was not done. Contract; legitimate interests. Product, upgrade and win-back email is sent only with consent, which you may withdraw. | Supabase; Resend for an opted-in email; Stripe only when a customer-specific promotion code is created. |
| Email address, authentication email and support messages | Sign you in, answer requests and send service notices. Contract; legitimate interests; legal obligations where applicable. | Supabase and Resend; our support mailbox. |
| Verified plan interest, billing interval, legal acceptance, release-delivery state and transactional-email status | Save the plan you requested, avoid starting a trial before the Mac release is available, deliver one private download and activation code, and prevent duplicate service messages. Contract; legitimate interests in reliable onboarding and misuse prevention. | Supabase, Stripe when checkout opens, and Resend for delivery. |
| IP address, browser and basic security request data | Deliver and protect the website. Legitimate interests in a secure and reliable service. | Website hosting and Cloudflare. |
| Website pages, section views, demo and product choices, plan interest, beta/contact intent, checkout-return status, approximate city or country, browser, device and operating system | Understand broad website use and improve the site. Consent; analytics remains off unless you allow it. | Google Analytics after your permission. |
Website analytics and storage
Sideques.to uses essential security storage and a first-party local preference named sidequesto.cookiePreferences.v2. The preference remembers your choice for 180 days.
Google Analytics remains completely blocked unless you select “Allow analytics.” If allowed, Google may set _ga and_ga_* first-party cookies for up to two years to distinguish visitors and maintain session state. Advertising storage and personalisation remain disabled. Reopen “Cookie preferences” in the footer to withdraw permission at any time.
Analytics events use product labels such as the selected companion, coding agent, plan or section. They do not include an email address, source code, prompts, project paths, payment-card details or the contents of a message. A return from Stripe is measured only as a success or cancellation status; a website return alone is not treated as proof of a completed purchase.
The restricted founder dashboard retrieves aggregated reports through Google’s read-only Analytics Data API. This does not send account, subscription or Stripe records to Google, and Google Analytics is not used as the authoritative record of members or revenue.
Voice, mute, and cloud processing
Apple on-device speech does not send speech text to a SideQuesto voice provider. OpenAI natural voice sends the words being spoken to the OpenAI API. A complex-event summary sends only the locally filtered event description. When SideQuesto or the device output is muted, hosted voice and hosted summaries are not requested.
OpenAI states that API data is not used to train its models by default unless the customer opts in. Its standard abuse-monitoring logs may retain API content for up to 30 days unless a different approved data control applies. SideQuesto does not opt user content into model training.
Optional SideQuesto Research Lab
Research Lab is off by default and intended for a closed test group. Before each session, you choose separately whether to include lifecycle events, visible prompts, visible assistant responses and SideQuesto outputs. A persistent recording indicator is shown while it is active. You can pause, end, export or delete the local research vault in Settings. A session that was recording is paused after an app restart.
The Lab never records audio, the screen, source files, full commands, tool inputs or outputs, terminal logs, secrets, or private model chain-of-thought. Codex and Claude do not expose private chain-of-thought to SideQuesto; the Lab can record only supported visible text and lifecycle signals. Obvious credentials, email addresses and user-home path segments are redacted before encrypted storage.
Raw Lab records expire locally after 30 days by default. Exported bundles are readable files, so review them before sharing and protect them as you would the underlying conversation. SideQuesto does not send a Lab bundle through Google Analytics, product analytics, Supabase or an automatic training pipeline. If you voluntarily provide an approved export for research, access is restricted, it is retained for no more than 180 days, and you may request its deletion at hi@sideques.to.
Learning and Mastery Lab
Outside an optional Research Lab export that a participant deliberately provides, SideQuesto does not upload raw prompts, code, paths, commands, logs, transcripts, audio, or a copy of Dex or Pip’s message as learning data. Mastery evidence contains aggregate event counts, active observed time, benchmark results, dimension scores and security-gate status. It does not make decisions that produce legal or similarly significant effects about you.
The current L2 “Reliable Observer” milestone records that this version passed SideQuesto’s local SQMB-1-L2 product preflight. It is not an independent certification and does not grade, rank or profile a user.
Service providers and transfers
We use suppliers only for the functions described below. Some may process data outside the EEA. Where required, transfers rely on the provider’s data-processing terms and safeguards such as Standard Contractual Clauses, an applicable adequacy decision, or the EU-U.S. Data Privacy Framework.
- Supabase — authentication, account database, entitlements and minimized feedback.
- Stripe — checkout, subscription management, invoicing, tax and fraud prevention.
- Resend — authentication and transactional email delivery.
- OpenAI — optional natural voice, optional complex-event summaries and site hosting services.
- Cloudflare — website delivery, security and bot protection.
- Google — optional account sign-in and consent-based website analytics; and Apple — optional account sign-in selected by the user.
Codex and Claude are separate services selected by the user. Their own terms and privacy policies govern the data they already process. We do not sell personal information, share it for cross-context behavioural advertising, or run targeted advertising.
How long we keep data
- Local messages and cached summaries: 30 days by default; you can choose 7, 30 or 90 days, or keep them until deletion.
- Local ratings: follow the related message retention and can be deleted with one click.
- Optional Research Lab: raw records expire from the encrypted local vault after 30 days. Any approved export voluntarily provided to SideQuesto is kept for no more than 180 days.
- Account and entitlement data: while the account is active, then deleted or anonymised after a valid deletion request, subject to required records and short-lived backups.
- Trial-abuse fingerprint digests: while an associated SideQuesto account remains active. They are deleted when the associated accounts are deleted and cannot be used to reconstruct a card number.
- Identifiable feedback signals: no longer than 24 months, unless deleted with the account sooner.
- Daily product-activity summaries: no longer than 24 months, unless deleted with the account sooner.
- Private-beta lifecycle records, action history and founder notes: while the account or beta relationship is active, then deleted or anonymised after a valid deletion request unless a legal dispute requires limited retention.
- Billing and tax records: for the statutory period required by Polish tax and accounting law.
- Support correspondence: up to 24 months after the matter closes, unless a dispute or law requires longer.
- Website storage: as listed in the website analytics and storage section.
Security
We use data minimisation, encrypted transport, per-install local encryption, macOS Keychain, database row-level security, signed webhooks, least-privilege access and access-controlled provider accounts. No system is risk-free; we maintain a response process for security incidents and will notify authorities and affected users when required by law.
Your choices and rights
Depending on where you live, you may request access, correction, deletion, restriction, portability or objection, and may withdraw any consent without affecting earlier processing. We may need to verify your identity. We normally respond within one month under GDPR.
Delete local messages, summaries and ratings, or the complete Research Lab vault, in the app’s Privacy & Data settings. Pausing or ending a Lab session stops new collection; deleting the vault removes its encrypted local records. For deletion of a Lab export you previously provided, account deletion or any other request, email hi@sideques.to. Account deletion also ends access to paid entitlements; billing records required by law may remain.
You may complain to Poland’s supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent authority where you live.
California privacy
California users receive the disclosures required by CalOPPA: this policy identifies the categories collected, purposes, recipients, correction process, effective date and third-party collection. We do not use behavioural advertising. Optional Google Analytics remains off unless you consent, and a Global Privacy Control signal keeps it off. We do not sell or share personal information as those terms are used by the CCPA.
Whether or not SideQuesto currently meets the CCPA’s business thresholds, California residents may use the same access, correction and deletion channel described above. We do not discriminate against a user for making a privacy request.
Children and changes
SideQuesto is not directed to children under 16. If you are under the age at which you can enter a contract where you live, a parent or legal guardian must approve your use. Contact us if you believe a child’s data was provided improperly.
We will post material changes here and, when appropriate, notify account holders before they take effect. Earlier versions may be requested at hi@sideques.to.