Privacy Policy

Noria Ltd, a private company limited by shares, incorporated in Mauritius (Company No. 240586, BRN C26240586), registered office: Pereybère, Mauritius (“we”, “us”, or “our”), operates Quasar on a fundamental belief: your financial data belongs strictly to you. This Privacy Policy explains what we hold, where it sits, and what we cannot read.

1. The “Zero-Knowledge” Principle

Quasar’s accounting data is engineered so that we cannot read it. The portal and the website exist to deliver and support your licence; neither is a window into your books.

Data at rest: Your financial ledgers, receipts, and client records are stored in a local SQLite database wrapped in SQLcipher on your own machine.

Data in transit: If you use snapshot sync, the payload is end-to-end encrypted with XChaCha20-Poly1305 before it leaves your device. Our servers store only ciphertext. We cannot harvest, read, or sell it.

Credentials synced to your account (planned): Where Quasar needs to reach the same encryption material on a second machine, it will be stored only in encrypted form. We would never hold it in a form we can decrypt.

2. No Telemetry or Tracking

There is no analytics, no tracking pixel, and no usage telemetry in the Quasar application, the portal, or this website. We do not profile your activity.

3. What the Portal Holds

The customer portal on this website (the pages under /portal) exists to manage your licence and devices. Signing in creates an account with us, and that account holds the following. None of it is your accounting data.

Identity: your email address, first and last name, and a hashed password. If you enable two-factor authentication, we store the authenticator enrolment and one-time recovery codes as SHA-256 hashes only — the codes are shown to you once and never stored in readable form.

Entitlement: your subscription tier and status, how many seats you have purchased, and your Paddle customer reference so we can match billing to your account.

Licences and devices: the signed licence payload issued to you, and the identifier of the machine each licence is bound to. This is what lets you release an old device.

4. Payments

Merchant of record: Purchases are processed by Paddle.com, who act as merchant of record for the transaction. We never see or store your card number.

What we receive: your email address and the order outcome, which is what allows us to sign and deliver your licence.

5. Service Providers

We use a small number of processors, each limited to a specific function:

• Supabase — authentication and the portal database. Our staff can access portal records for support and security purposes.
• Vercel — hosting for this website and the portal.
• Paddle — payments and subscription billing.
• Brevo — transactional email for licence delivery, password reset, and messages you send us through the contact form.

We do not sell, rent, or share your personal data with anyone for marketing. If a processor were ever required to process your accounting data, that data reaches it only as ciphertext.

6. Your Choices

Export and deletion of accounting data: because we do not possess your unencrypted data, requests for it must be carried out by you, directly within the Quasar application on your own hardware.

Viewing and correcting your portal data: the Privacy & Data page in the portal lists everything we hold about your account, and you can change your name and email from the Profile page.

Deleting your account: you can delete your portal account at any time from Privacy & Data. Deletion removes your account, subscription, licences, device bindings, and recovery codes. Because the deletion is irreversible, we ask you to type your email address to confirm it.

What survives deletion: one audit record, kept for traceability and internal accountability. It holds your email address, the time of the request, your IP address, and your browser, along with whether two-factor authentication had been satisfied at the time. It is not used for marketing, is never shared or sold, and exists so that we can demonstrate a deletion was requested by its owner. We will delete this record on request.

7. Contact

For privacy inquiries, contact Noria Ltd at studio9niko@gmail.com. Quasar is operated from Mauritius.