Privacy policy

Effective 1 November 2026.

This policy explains what AskHooman (the service at askhooman.com, called Qtracker until November 2026, and the AskHooman apps) collects, why, and how you control it. The data controller is Allover Studio, LLC. Questions about privacy: privacy@askhooman.com.

The short version

Your agents' asks and tasks are stored in your own Google Drive, in a hidden folder that only AskHooman can use. Our server keeps your email address, an encrypted Google token and the agents you connected (their names and hashed keys and tokens), and nothing else about you. We use data only to run AskHooman: no ads, no tracking, no analytics, and we never sell it. You can delete your account in the app at any time.

What is stored in your Google Drive

The asks (questions, their context, options, links, your answers and their history) and tasks your agents create are files in your Drive's appDataFolder: a hidden folder that belongs to AskHooman and that you can't see in Drive's file list. AskHooman asks Google only for access to that folder (the drive.appdata scope); it can't see or change any of your other files. Our server reads and writes these files only to carry out a request from you or one of your agents. Their content passes through the server's memory and may be kept briefly in an in-memory cache; it is never copied to our database or written to our logs.

What our server stores

Your account: your Google account ID and email address, when you signed up, the counters that number your asks and tasks, and the Google refresh token that lets the server reach your app folder when an agent calls, encrypted. If Google shares your name when you sign in, it is used only to show who is signed in; the server does not store it.
Your agents: the name you gave each one, which app connected it (for example "Claude Code"), when it connected and was last active, and, if you set one, its webhook address and an encrypted webhook secret.
Sign-in records: registrations of the apps that connect agents, the OAuth tokens and agent keys your agents use, and sign-ins in progress. Tokens and keys are stored only as one-way hashes.
Logs: minimal request logs kept by our hosting provider (time, address, URL and response status) for security and troubleshooting. They never contain tokens or the content of your asks and tasks.

While you connect an agent, the server sets one cookie that ties the sign-in to your browser; it expires within 10 minutes. There are no other cookies.

How we use it

Only to provide AskHooman: to sign you in, connect your agents and check their credentials, read and write your asks and tasks when you or your agents ask, call the webhooks you set, and keep the service secure. We don't use your data for advertising, profiling or training AI models, and we don't sell it.

Google user data

AskHooman's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Google data AskHooman accesses is your Google account ID and email address (to sign you in) and the files in AskHooman's own hidden folder in your Drive (the drive.appdata scope). In particular:

We use it only to provide and improve the features of AskHooman that you use, as described on this page.
We transfer it only to provide those features (to the agents you connect and the webhooks you set), when the law requires it, or as part of a merger, acquisition or sale of assets, after notifying you.
We don't use or transfer it for advertising, including retargeting and personalized or interest-based ads, we don't sell it, and we don't use it to determine credit-worthiness or for lending.
No human at AskHooman reads it, unless you ask us to (for example in a support request), it is needed for security (such as investigating abuse), it is required by law, or it is aggregated and anonymized for internal operations.
We don't use data from Google Workspace APIs, including Google Drive, to develop, improve or train generalized artificial intelligence or machine learning models.

Who else handles data

Google signs you in and stores your asks and tasks in your Drive. Google Cloud is our processor: it hosts our server, its database and its logs.
Your agents and the apps they run in (for example Claude) receive the asks and tasks they wrote and your answers, under those apps' own privacy policies.
Your webhook, if you set one for an agent, receives the ask and your answer when you act on it.

We don't share data with anyone else unless the law requires it.

The apps

The AskHooman apps sign in with Google and read and write the same Drive folder directly. They keep your Google sign-in in secure storage on the device (on Apple devices, the Keychain) and a copy of your list on the device. Signing out removes both.

How long we keep it

Your account and agents: until you delete your account. A disconnected agent's name stays on your account, with its tokens and keys revoked, until then.
Access tokens expire after an hour and refresh tokens 60 days after they were issued; authorization codes after two minutes, sign-ins in progress after 10 minutes; app registrations nobody signs in with after a day. Expired records are removed automatically.
Request logs: up to 30 days.

Deleting your account and your data

In the app: Settings → Delete account. This deletes your account and everything our server keeps for you: your email address, the encrypted Google token, your agents, their tokens and keys, and their webhooks. It also revokes AskHooman's server access to your Google account at Google. Your agents stop working at once.
By email: if you can't use the app, write to privacy@askhooman.com from the email address you signed in with. We delete your account within 30 days and confirm by email.
Your asks and tasks stay in your Google Drive: they are your files, and deleting your account doesn't delete them. To delete them, open Google Drive on the web → Settings → Manage apps → AskHooman → Options → Delete hidden app data. To remove AskHooman's access to your Google account, go to Google Account → Data & privacy → Third-party apps & services (myaccount.google.com/connections) → AskHooman → Delete all connections.
To disconnect a single agent, use the app at any time: its tokens and keys stop working at once.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or in California), you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. Most of this you can do yourself: your asks and tasks are files in your own Drive, and the app shows and deletes what our server keeps. For anything else, write to privacy@askhooman.com. We process your data to provide the service you asked for, and to keep it secure. You can also complain to your local data protection authority.

Security

All traffic is encrypted (HTTPS). Tokens and keys are stored only as one-way hashes; Google tokens and webhook secrets are encrypted at rest. Please report vulnerabilities to security@askhooman.com.

Children

AskHooman is not meant for children under 13 (or the minimum age for digital services where you live), and we don't knowingly collect their data. If you think a child has given us personal data, write to privacy@askhooman.com and we'll delete it.

Changes

When this policy changes, we update this page and the date at the top. If a change is significant, we also tell you in the app or by email before it takes effect.

Contact

Allover Studio, LLC: privacy@askhooman.com for privacy, support@askhooman.com for everything else.