Privacy Policy

QuickBox Pro ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

By using QuickBox Pro, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2.1 Personal Information

We collect the following personal information when you register and use our services:

• Account Information: Email address, password (encrypted), and username
• Discord Integration: Discord user ID, username, and avatar (if you choose to authenticate via Discord OAuth)
• Two-Factor Authentication: TOTP secret keys (encrypted) if you enable 2FA
• Payment Information: Billing details processed through Stripe and PayPal (we do not store credit card information on our servers)

2.2 License and Usage Data

To provide and improve our services, we collect:

• License Information: License keys, activation status, seat allocation, and subscription details
• Server Information: What a QuickBox Pro server sends us at activation, at license checks and, only if an administrator turns it on, as telemetry is listed in full in Section 2A
• API Usage: API endpoint access, request methods, IP addresses, user agents, response times, and error logs

2.3 Automatically Collected Information

• Log Data: IP addresses, browser type, device information, access times, and pages viewed
• Cookies: Session cookies for authentication and user preferences (see Section 6)
• Analytics: Website usage patterns and performance metrics

QuickBox Pro is closed source, but what it reports is not secret. Here is everything a QuickBox Pro server can send to quickbox.io, and what you control.

Always Sent: License Activation and Verification

These are needed to activate your license and keep it valid, and to list your servers in your quickbox.io account.

• At activation: license key and installation ID, server hostname, public IP address, operating system, QuickBox Pro and dashboard versions, and uptime.
• At license checks: license key and installation ID only.

Telemetry: Only If You Turn It On

Telemetry is off on new installs and is sent only while a server administrator has it turned on. Servers installed before October 16, 2026 had it turned on at install; check yours. You can turn it on or off at any time, in the dashboard under System > API Control (Telemetry on/off) or with qb manage telemetry -o off. The same panel shows the exact payload your server sends. While it is on, the server sends a check-in every 5 minutes with:

• Server: hostname, public and local IP addresses, operating system, QuickBox Pro and dashboard versions, uptime
• Hardware: CPU model, core count and frequency, memory and disk totals with used and free space
• Load: CPU usage and load averages
• Network: interface name, current transfer speeds, monthly received and sent totals, and the results of any network speed test (download, upload, ping, jitter, test engine and time)
• User accounts on the server: username, email address, whether the account is active, last login, and pending software-update counts, along with the number of seats in use

Telemetry powers the online status, server health, usage, and user views in your quickbox.io account. With it off, your account still lists your activated servers and your license, but cannot show whether a server is online, because online status comes from the 5-minute check-in (a server reads offline after 7 minutes of silence).

Why We Collect It

• To verify your license and the number of servers it covers
• To show your servers, and with telemetry their health and users, in your quickbox.io account
• To deliver updates and alert you when a server or its license needs attention
• To provide support when you ask for it

What We Don't Do

• We do not sell this information.
• We do not collect the contents of your files, downloads, or media libraries.
• We do not collect passwords.

Retention

We keep only the most recent check-in for each server; each new check-in replaces the last one. We also keep a record of when each server went online and offline. Activation data, the latest check-in, and the user-account list are kept while your license exists, and are permanently deleted 30 days after your license expires. Turning telemetry off stops new check-ins; to have existing server data removed sooner, contact echo@quickbox.io.

If You Host Users for Others

While telemetry is on, the usernames and email addresses of accounts on your server are included. Tell your users, or turn telemetry off.

We use your information for the following purposes:

• Service Delivery: To create and manage your account, process payments, and deliver license keys
• Authentication: To verify your identity and enable secure access to your dashboard
• License Management: To track server activations, seat usage, and enforce license limits
• Payment Processing: To process subscriptions, one-time purchases, and seat add-ons via Stripe and PayPal
• Customer Support: To respond to your inquiries and provide technical assistance via Discord
• Service Improvement: To analyze usage patterns, monitor performance, and develop new features
• Security: To detect and prevent fraudulent activities, unauthorized access, and abuse
• Compliance: To comply with legal obligations and enforce our Terms of Service
• Communication: To send important service notifications, updates, and subscription reminders

We use the following third-party services to operate QuickBox Pro:

4.1 Payment Processors

• Stripe: Processes credit card payments and manages subscriptions. See Stripe Privacy Policy
• PayPal: Alternative payment processing. See PayPal Privacy Policy

4.2 Authentication

• Discord OAuth: Optional authentication via Discord. See Discord Privacy Policy

4.3 Hosting and Infrastructure

• Database: MariaDB/MySQL for secure data storage
• SSL Certificates: Let's Encrypt for encrypted communications

These third-party services have their own privacy policies and data handling practices. We recommend reviewing their policies to understand how they protect your information.

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party services (Stripe, PayPal, Discord) necessary to operate our platform
• Legal Requirements: When required by law, court order, or government regulation
• Protection of Rights: To protect our rights, property, safety, or that of our users
• Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified)
• With Your Consent: When you explicitly authorize us to share your information

We use cookies and similar tracking technologies to enhance your experience:

6.1 Essential Cookies

• Session Cookies: Required for authentication and secure access to your account
• Security Cookies: Used for two-factor authentication and fraud prevention

6.2 Preference Cookies

• User Settings: Remember your preferences and dashboard customizations
• Theme Preferences: Store your dark/light mode selection

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality of our services.

We implement industry-standard security measures to protect your information:

• Encryption: All data transmitted between your browser and our servers is encrypted using SSL/TLS
• Password Protection: Passwords are hashed using bcrypt before storage
• Two-Factor Authentication: Optional 2FA provides an additional layer of security
• Secure Payment Processing: PCI-DSS compliant payment processing through Stripe
• Access Controls: Restricted access to personal data on a need-to-know basis
• Regular Security Audits: Ongoing monitoring and vulnerability assessments

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any data breaches as required by law.

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: Data is retained while your account is active and for the duration of your subscription or license
• Inactive Accounts: Account data may be deleted after 2 years of inactivity (with prior notice)
• Transaction Records: Payment and license transaction records are retained for 7 years for tax and legal compliance
• API Logs: Usage logs are retained for 90 days for security and debugging purposes
• Account Deletion: Upon request, we will delete your personal data within 30 days, except where retention is required by law

You have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information through your dashboard settings
• Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications (service notifications will still be sent)
• Objection: Object to certain types of data processing
• Withdraw Consent: Withdraw consent for optional data collection at any time

To exercise these rights, please contact us via our Discord support channel or email us at echo@quickbox.io.

QuickBox Pro operates globally. Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer your data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or other legally recognized transfer mechanisms.

QuickBox Pro is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information from our systems.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email or dashboard notification for material changes
• Provide a reasonable notice period before the changes take effect

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

For EU Residents (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.

For California Residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt-out of the sale of personal information. We do not sell your personal information.