Qortara Logic Privacy Notice

Version: 2026-11-12
Effective date: November 12, 2026
Operator: MythologIQ Labs, LLC

1. Who we are

Qortara Logic is operated by MythologIQ Labs, LLC ("Qortara", "we", "us"), a Maryland limited liability company, USA. We are responsible for the personal data described in this notice.

• Privacy questions and requests: support@qortara.com, subject line "Qortara Logic privacy request".
• Security issues: security@qortara.com.
• Mail: MythologIQ Labs, LLC, 103 Bay Meadows Lane, Stevensville, MD 21666, USA.
• Phone: (443) 837-5054.

2. What this notice covers

This notice covers the hosted Qortara Logic service:

• sign-in at auth.qortara.com;
• the MCP service at api.qortara.com;
• your account page at app.qortara.com.

It does not cover the general qortara.com website, which has its own notice. ChatGPT, Claude, GitHub and any other tool you connect to Qortara Logic are run by other companies under their own privacy terms. Your conversations with those tools stay with them; we never receive them, only the tool calls the tool sends us.

Status. Qortara Logic is a free public alpha, offered to users in the United States. There is no paid plan and we do not process payments for it.

3. What we collect, and why

3.1 Sign-in

• Your email address. You sign in with a one-time code sent to your email. We use the address to send the code and to derive your account identifier. Our email provider, Resend, delivers the code email.
• Where your address is kept. Your account record does not contain your email address. It holds a pseudonymous identifier computed from your address with a secret key (HMAC). The address is held only:
  • with your pending sign-in code (up to 10 minutes) and the short sign-in step that follows it (up to 2 more minutes);
  • in the sign-in record for the Qortara account page at app.qortara.com, so that the page can show you which address you signed in with. Sign-in records for other apps, such as ChatGPT or Claude, do not contain it.
• Sign-in codes expire after 10 minutes and are deleted automatically.
• Abuse limits. To stop account farming and code flooding, we count sign-in attempts per address and per network. Your IP address (IPv4 address, or the /64 prefix of an IPv6 address) is replaced by a keyed hash (HMAC) before anything is stored. For each network we keep keyed hashes of up to 5 email addresses used from it, for up to 24 hours. Other attempt counters last between 10 minutes and 1 hour.
• Marketplace review accounts. A small number of accounts issued to app-marketplace reviewers can sign in with a password instead of a code. Only salted password hashes are stored, in our service configuration.
• Terms acceptance. When you tick the box at sign-in, we record the version of the Terms and this notice that you accepted, the time, and the sign-in method, against your pseudonymous identifier.

3.2 Your account

• An internal account id and workspace (tenant) id, your plan and status, when your identity was created and last seen, and which apps you have connected, when each was last used and when you disconnected it.
• Sign-in records (OAuth grants) for each app you approve (for example ChatGPT or Claude). Access tokens last 1 hour. Refresh tokens rotate and expire after at most 30 days.
• When you disconnect an app, its access ends immediately. Its stored grant record is removed when it expires, within 30 days.
• Daily usage counters for your free-plan allowance, and a service-wide counter that is not linked to you.

We use this to provide the service, keep accounts separate, enforce free-plan limits and let you disconnect apps.

3.3 Tool calls (what your AI app sends us)

• We do not store what you send in a tool call or what comes back. Tool arguments (the policies, artifacts and evidence your AI app sends) are passed to our evaluation engine and processed in memory only, to answer the call. They are not written to our databases or to our logs.
• Activity metadata is stored for each call: the time, which app made it, a connection identifier, the software name the app reports (the first word of its User-Agent header, for example a product name and version), the tool, the outcome, a short result or refusal code, and the duration. We use it to show you your own activity, to enforce free-plan allowances, and to detect abuse.
• Retention: activity metadata is kept for 30 days, and at most 20,000 calls per account (older calls are removed first). An automatic job removes expired calls even if you stop using the service.
• Your controls: at app.qortara.com you can view your activity, export it (up to 5,000 calls per export file; filter by date to export more), and delete all of it at any time.

3.4 Operational logs

Our MCP service writes one technical log line per request to Cloudflare's logging service, for security, debugging and reliability. A line contains the request path and method, a short prefix of your pseudonymous account hash, the MCP method and tool name, the outcome or error code, short status codes for sign-in, account and GitHub checks, a request id, the names (not the values) of any metadata keys your app sent, the HTTP status and the duration. Logs do not contain tool arguments, results, your email address or your IP address. Cloudflare deletes them after at most 7 days.

3.5 Browser sessions on app.qortara.com

When you sign in to your account page we create a session, stored in our database, and set strictly necessary cookies:

• __Host-qortara_account (your session, up to 12 hours);
• __Host-qortara_oauth and __Host-qortara_github (up to 10 minutes, only while you sign in or connect GitHub);
• a cookie on auth.qortara.com for up to 5 minutes during sign-in.

A session ends after 12 hours, or 2 hours without use, or when you sign out. The session stores an encrypted access token and a copy of your dashboard figures (usage, plan and status) so the page still works during an outage. It does not store your email address. Signing out clears the token and the copy. An hourly job deletes sessions 7 days after they expire. We do not use advertising or analytics cookies.

3.6 GitHub Observe (optional)

If you choose to connect GitHub to see a read-only summary of one repository:

• We store your GitHub user id and login, your GitHub access tokens (encrypted with AES-GCM before storage), the GitHub App installation, the repository you select and the latest summary of it.
• The summary includes the repository's name, owner, visibility and default branch; the latest commit's identifier, date and subject line; up to 30 pull requests with their number, title, state, review count, link and their authors' GitHub logins; and the names, results and links of up to 50 checks and 30 statuses. Pull request authors may be other people. We use their logins only to show you the summary.
• We never store your source code.
• Disconnecting GitHub at app.qortara.com deletes our stored link, tokens and summary, and attempts to revoke the token at GitHub. That revocation is best effort: if GitHub is unavailable, the token may remain valid until it expires.
• Uninstalling the Qortara GitHub App is separate. Disconnecting in Qortara does not remove the App from your GitHub account; manage it at github.com, Settings, Applications.

3.7 Support messages

If you email or call us, we keep your message and our reply to answer you and to keep a record of requests, for up to 2 years.

3.8 What we do not do

• We do not sell your personal information or "share" it for cross-context behavioural advertising.
• We do not use advertising or tracking cookies.
• We do not use your tool-call content to train AI models, and we do not let our providers do so.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Why we are allowed to use your data

We use your data to provide the service you signed up for under the Terms, and for our legitimate interests in keeping the service secure, preventing abuse, and being able to show what you agreed to. If the EU or UK GDPR applies to you, those are our legal bases (performance of a contract, and legitimate interests). Ticking the box at sign-in is agreement to the Terms and acknowledgment of this notice, not consent to processing.

5. Who processes your data

Cloudflare and Resend process data for us under their data processing agreements. We may disclose data if the law requires it, to protect our rights or users' safety, or to a successor if the service is transferred (we will tell you first).

6. Where your data is processed

We are based in the United States.

• Our account database and our account-page session database (Cloudflare D1) are created in Cloudflare's US jurisdiction.
• Other parts of the service are not restricted to the US:
  • your activity, GitHub link and usage counters, and the sign-in codes and attempt counters, are held in Cloudflare Durable Objects, which Cloudflare places near where they are first used;
  • sign-in records (OAuth grants) and terms-acceptance records are held in Cloudflare KV, which Cloudflare replicates across its network;
  • every request is processed at the Cloudflare edge location nearest to you;
  • logs are processed by Cloudflare's logging service;
  • Resend processes the sign-in email under its own terms.

If you use the service from outside the US, your data is transferred to the US and may be processed in other countries. Cloudflare and Resend protect such transfers through their EU-US Data Privacy Framework certifications and the EU Standard Contractual Clauses in their data processing agreements.

7. How long we keep it (summary)

8. Deleting your account

8.1 Self-service deletion

At app.qortara.com, open Settings, Delete account.

• To protect you, we ask you to verify your email again with a new sign-in code before deleting, and to confirm.
• Access ends at once. Your account is blocked and every app connection (ChatGPT, Claude or others) loses access immediately.
• Then we delete:
  • your activity metadata;
  • your GitHub Observe link, tokens and summary (and attempt to revoke the GitHub token);
  • your usage counters;
  • your OAuth grants and terms-acceptance record;
  • your account, identity, connection and workspace records;
  • your browser sessions.
• Progress. Deletion runs in steps across several systems. You can follow its status on the confirmation page. To make sure no app can still use an access token issued before deletion began, the final steps wait until at least 65 minutes after access was revoked, so a deletion takes at least about an hour. Most deletions complete within a few hours. If a step fails, your access stays blocked and we keep retrying; if a deletion is not complete within 30 days, we will tell you why.
• What remains for a time:
  • operational logs, for up to 7 days;
  • data held by our providers under their own retention (for example Resend's record of the sign-in emails);
  • a pseudonymous record that a deletion took place (no email address), kept 90 days after completion as evidence of the deletion;
  • the deletion status page summary, kept 30 days after completion.
• What we cannot delete for you: your conversations in ChatGPT, Claude or other apps, and the Qortara GitHub App installation on your GitHub account (remove it at github.com, Settings, Applications).
• Deletion cannot be undone. If you later sign in again with the same email, you get a new, empty account.

8.2 If you cannot use self-service deletion

Email support@qortara.com with the subject "Qortara Logic privacy request". Because our records do not store your email address, an email alone cannot prove which account is yours, and we will not delete an account on the strength of an email. We will help you sign in at app.qortara.com (a new sign-in code proves you control the address) and complete Settings, Delete account with you. If you cannot sign in at all, tell us why and we will respond to your request as required by law.

9. Your rights

Whatever state you live in, you can ask us to:

• tell you what personal data we hold about you and give you a copy (you can export your activity yourself);
• correct it;
• delete it (section 8);
• stop a particular use of it.

We will not treat you differently for making a request. You can use an authorised agent; we may ask the agent for proof of authority.

To make a request, email support@qortara.com with the subject "Qortara Logic privacy request". We will verify it through your account (a fresh sign-in code), not from the email alone, and answer within 45 days. If we decline a request, we will tell you why and how to ask us to reconsider.

10. US state privacy laws

• We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act and similar state laws, and we have not done so in the past 12 months.
• We honour Global Privacy Control (GPC) signals as a request to opt out of sale and sharing. Because we do not sell or share, a GPC signal does not change how the service works.
• Categories collected in the past 12 months: identifiers (email address, pseudonymous ids, GitHub login); internet or network activity (activity metadata, logs, the hashed network key, the software name); and, if you connect GitHub, professional information (the repository summary). Sources: you, your AI app, and GitHub when you connect it. Purposes: section 3. Disclosed for business purposes to the providers in section 5.
• We do not collect sensitive personal information.

11. Age

Qortara Logic is for people 18 and older. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it. Contact support@qortara.com if you believe a child has used the service.

12. Security

We protect your data with encryption in transit, encryption of stored GitHub tokens and session tokens, pseudonymous account identifiers, per-account storage isolation and access controls. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as required by law. Report security issues to security@qortara.com.

13. Changes to this notice

We may update this notice. Each version has a version string, shown at the top. For a material change, we will tell you by email or at sign-in at least 30 days before it takes effect, and ask you to acknowledge the new version at your next sign-in. Previous versions are available on request.

14. Contact

MythologIQ Labs, LLC
103 Bay Meadows Lane, Stevensville, MD 21666, USA
Phone: (443) 837-5054
Email: support@qortara.com (privacy) or security@qortara.com (security)

California residents. Qortara Logic is free. To resolve a complaint about the service, contact us at the address above. You may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.