Qpash

Privacy Policy

Last updated: April 9, 2026

This Privacy Policy describes how Qpash ("we", "us", or "our") collects, uses, and protects your information when you use our virtual queue management service at www.qpash.app.

1. Information We Collect

Business account holders (registered users):

Email address
Business name
Password (stored as a bcrypt hash — never in plain text)
Google account information (name, email) if you sign up via Google OAuth

Queue customers (end users):

No personal data is collected. Customers receive an anonymous session token stored in their browser's localStorage to track their queue position.

2. How We Use Your Information

To create and manage your business queue account
To send account verification and password reset emails
To send optional daily/weekly queue statistics reports (PAID plan only, can be disabled)
To display your uploaded advertisement images on your queue screen

We do not sell, trade, or rent your personal information to third parties.

3. Cookies and Local Storage

We use a single httpOnly cookie named token to keep business users logged in. This cookie cannot be accessed by JavaScript and expires after 7 days.

Queue customers' session tokens are stored in browser localStorage only — no cookies are set for customers.

4. Google API Services

Qpash uses Google Identity Services (Google Sign-In) as an optional authentication method. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google data we access:

Email address — used as your account identifier
Display name — pre-filled as a convenience during registration
Google account ID (sub) — used to link your Google account to your Qpash account

What we do NOT access: We do not access Google Drive, Gmail, Contacts, Calendar, or any other Google service. We only request the basic profile scope (email and name).

How Google data is stored: Your email address and Google account ID are stored in our database hosted on Railway. We do not store your Google profile photo or any other Google data.

How to revoke access: You can revoke Qpash's access to your Google account at any time via Google Account Permissions. You may also request deletion of your Qpash account by emailing support@qpash.app.

5. Third-Party Services

We use the following third-party services to operate Qpash:

Google Identity Services — optional sign-in method. Subject to Google's Privacy Policy.
Brevo (Sendinblue) — used to send transactional emails (verification, password reset, reports). Subject to Brevo's Privacy Policy.
Cloudinary — used to store advertisement images uploaded by PAID plan users. Subject to Cloudinary's Privacy Policy.
Railway — cloud hosting provider where our servers and database run. Subject to Railway's Privacy Policy.

6. Data Retention

Your account data is retained as long as your account is active. You may request deletion of your account and associated data by contacting us at support@qpash.app. Queue history data is retained for analytics purposes and deleted upon account deletion.

7. Data Security

We implement industry-standard security measures including:

Passwords hashed with bcrypt (12 rounds)
Authentication via signed JWT tokens in httpOnly cookies
HTTPS enforced on all connections
Rate limiting on authentication endpoints

8. Children's Privacy

Qpash is not directed to children under the age of 13. We do not knowingly collect personal information from children.

9. Your Rights

Depending on your location, you may have the right to access, correct, or delete your personal data. To exercise these rights, contact us at support@qpash.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:
support@qpash.app
www.qpash.app