Privacy Policy
Last updated 20 October 2026
This policy describes how YADA Technology ("we") handles information when you use Qestor (the "Service"). It reflects the current product implementation. It is not a substitute for formal legal advice. Qestor is in beta; practices may change — we will update this page when they do.
Who we are
The Service is operated by YADA Technology. Product and privacy inquiries: [email protected].
Account information
When you create or use an account we store data such as email address, display name, avatar image (if you upload one), timezone, language (locale), date format preferences, and other profile preferences. Authentication secrets (password hashes, OIDC/session material) are kept server-side and are not exposed through the product API to other users.
Sign-in and session data
You may sign in with email and password and/or organization single sign-on (OIDC), depending on configuration. We may send one-time codes by email for sign-up, new-device verification, and password reset. The browser keeps a session token in local storage (qestor-token). We also use HttpOnly cookies for session refresh (qestor_session), trusted devices (qestor_device), and OIDC login state (qestor_oidc). Theme and some UI layout preferences may be stored in local storage on your device.
Space content
Spaces, projects, items, comments, attachments, dashboards, and views you create or receive are stored so members of that space can collaborate according to their roles (for example owner, admin, member, or guest). Guests typically have limited permissions (such as reading items and writing comments) compared with members. Qestor Tokens (QT): when an item with QT reaches a closed status, each active assignee is credited with its full QT. Space members who can see an item's QT and assignees can see per-person QT totals, ranks, badges, and earning history (item IDs and titles) on the QT page. Credits are removed if the item is reopened, its QT changes, or the person is unassigned. The same members can see each person's 4-week and 12-week QT tier (space-wide, or per project when filtered). People who manage members can set per-person tier thresholds and names; only they can see those override values.
Files
Attachments, avatars, and brand images are stored in S3-compatible object storage. Files are removed when the related attachment (or avatar) is deleted. Upload size is limited by server configuration (commonly up to about 50 MB per file). We do not publish a separate long-term archival retention schedule beyond delete-with-record behavior. If you set a password on a file, the browser encrypts it before upload. Qestor stores the encrypted bytes plus the salt and nonce needed to decrypt them. The password is not stored, and a locked file cannot be recovered if the password is lost. Files can also be stored on the workspace library, in folders, without being attached to an item.
Public share links
Members may create public dashboard or view share links (table, Kanban, Timeline, and Gantt views), public library share links for a file, a library folder, or a project's files, and related feed tokens. Anyone with a valid link can read the scoped data without signing in, until the link expires, is disabled, or is revoked. A library link lists file and folder names in that scope and allows download of files that are not locked. Locked files are never published. A link stops working when it is disabled or revoked, or when its creator loses access. Board links show item titles, IDs, and the fields on the board, including assignee display names, plus Timeline and Gantt holidays, blocked days, and schedule names; they never show the space member list. A calendar link shows one project month and only what its creator chose: one-off and repeating event names, holidays and blocked days, and work titles and dates (optionally limited to chosen item types). It does not allow adding or editing, and it does not show descriptions, files, hours, points, or the space member list. Treat share links as confidential.
Email communications
We send transactional email (for example OTP codes, invites, and optional digests or notification rules) using SMTP. Messages are sent from Qestor via [email protected]. An invitation is also emailed to an address that does not yet have a Qestor account. That person has no profile preferences yet; they join the space the first time they sign in with that address. A system email or in-app notice is sent only when the space, the project (when the notice is about a project), and your profile all allow that kind. Space and project admins can turn system email and in-app kinds off for that space or project, and you can turn them off in your profile. Items in an archived project, or in a project whose workspace is archived, are left out of those digests, notification rules, and the in-app inbox. Inquiry form submissions on the marketing site are emailed to [email protected] and include the details you provide (and use your address as reply-to).
API and MCP credentials
If you create API tokens or MCP credentials, those secrets are shown once and stored hashed. An API token grants access according to the read or write scope and the spaces, projects, and permissions you choose. An empty list means everything you can already do. You are responsible for keeping them private and revoking them when unused. A read-scope API token can also list and download the files on items its owner can already open, including files attached in comments. Download links are short-lived, and password-locked files are never served.
Analytics and processors
The web application does not embed common third-party marketing analytics SDKs. Operational processing may involve identity providers (OIDC), email delivery (SMTP), and object storage providers that host files for the Service.
Requests, children, and beta
The Service is not directed at children. Automated account export or self-serve account erasure is not currently offered in-product; contact [email protected] for privacy requests. Because Qestor is in beta, features and data practices may evolve. Permanent deletes (for example space or project deletion) remove data via cascading deletes and are not soft-deleted.
Mood check-ins
If you use the daily mood check-in, we store each answer for that local day: the mood or a “can’t tell” answer, an optional note (the reason), the timezone used for the day, and the time. You can save more than one check-in on the same day, and earlier answers stay. You can turn the daily prompt off in Profile. You can still add a check-in from My mood. You can read your own history, including every reason. People who have the team mood permission in a space you belong to can read the mood. They can read the reason only when you turn on Share the reason in Profile. That choice applies to every reason you have saved. We do not email check-ins.
Bounties, payout details, and chat
If you post or join a bounty, Qestor stores the public brief, acceptance checklist, submissions, sealed payment-evidence fingerprints, payout instructions you enter for that bounty, chat messages, and an audit log. Payout instructions are shown only to the awarded hunter and people who can manage that bounty. They are redacted 90 days after the bounty ends. The financial record (terms version, acceptances, payment requests, evidence fingerprints, and the event log) is kept for ten years after close, even if the item, space, or account is later removed, so both parties can download it. Super Admin can open a dispute record to set a final outcome or block an account. Qestor never receives, holds, or transfers the reward.
Where records are hosted
Account data, files, and bounty records are hosted on the infrastructure used by the Qestor service operated by PT YADA Technology Indonesia. You can ask for a copy of your record pack from a bounty you take part in. A deletion request does not erase the ten-year financial pack described above.
Who is here
While the app is open in a space, we store the time you were last seen in that space and whether you were recently using the page, so other members of that space can see who is here. The record stays until you leave the space. You are not shown in your own list.