1. Who runs QubitLab
QubitLab is built and run in Cambodia by a solo AI engineer and quantum researcher. For any privacy question, use Feedback (signed in) or “Contact support” on the Forgot password page.
2. What we store
- Account: email, username, password (only as a bcrypt hash, never the password itself), and whether your email is verified.
- Profile, only what you add: name, picture, bio, website, blog, social links, country, organisation, date of birth.
- Google or GitHub sign-in: the verified email and name they send us. We never receive your Google or GitHub password.
- Passkeys: only the public key and a name for the device. Your fingerprint or face never leaves your device.
- What you do here: saved circuits, jobs and their results, lesson progress, quiz answers, points and credit history.
- Signed-in devices: browser name, IP address and times, so you can see and end sessions in Dashboard → Security.
- IBM Quantum and IQM tokens you save: encrypted at rest, used only for jobs you start, never sent back to the browser.
- Feedback and support requests you send, with the optional screenshot and contact email.
- Guests: a random key kept in your browser (stored only as a hash on the server) that brings back your guest account.
- Searches in the site search are logged without any account, to improve results.
3. Why we use it
- To run QubitLab for you: sign-in, saving work, running circuits, credits and lessons.
- To keep accounts safe: rate limits, locking after wrong passwords, and spotting abuse.
- To answer you: password resets, email confirmation, replies to feedback and support.
- To improve lessons from totals (for example how many finish a lesson), never to profile you for ads.
6. How long we keep it
- Your account and work: until you or an administrator delete the account.
- Guest accounts nobody has used for 90 days are deleted automatically.
- Password reset links: 60 minutes. Email confirmation links: 24 hours (1 hour for a change of email). Each works once.
- Run credits expire 365 days after they are given (see Dashboard → Credits).
- Database backups are kept on the server for a limited time so we can recover from mistakes.
7. How we protect it
HTTPS everywhere, bcrypt passwords, encrypted provider tokens, single-use hashed links, rate limits, optional passkeys, and a sandbox that runs your Python with no network and no secrets. No system is perfect: tell us at once if you think your account was misused.
8. Your choices
- See and edit your profile, email and username in the Dashboard (a new email and username need your password; a new email must be confirmed).
- Articles and shared links show only what you put in them, your name, username and picture. Draft and private ones are seen by you alone; unlisted ones by anyone with the link; public ones by everyone. Change the status, make a new link (the old one stops working) or delete them at any time in My articles. Uploaded images have hidden photo data (such as location) removed. A report about public content keeps the page, the reason, your note and (if you give it) your email, for the administrators only.
- Hide your name from the Community page and ranks board at any time (Ranks → visibility), or make your whole profile page private (Dashboard → Profile → Who can see it).
- Remove passkeys, saved tokens and signed-in devices yourself in Dashboard → Security.
- Download everything we keep about you, or delete your account yourself, in Dashboard → Security → Your data. Deleting removes your circuits, jobs and credits at once; copies in backups disappear as backups rotate.
- Need help with any of this? Use Help & feedback; we answer within 30 days.
9. Young learners
QubitLab is made for students. If you are under 13, use a guest account or ask a parent or teacher before creating an account.
10. Changes to this policy
When this page changes we update the date at the top and note it in the Changelog.