Quo

Privacy Policy

Last updated 2 November 2026. Applies to the Quo apps (phone, web and desktop) and this website.

In short: Quo runs its AI on your device. Your conversations, files, photos, voice and memories are processed and stored only on your device and are never sent to us or anyone else, unless you choose the optional cloud model in Quo Web or the desktop app; those messages, and any files or photos you attach to them, are sent to the model’s provider to answer, and nobody keeps them. If you choose to turn on Quo Sync (optional, and it needs a Quo account), your chats and memories are uploaded only after being encrypted on your device with a key we never receive, so we still can’t read them. To fix crashes and improve the app, Quo collects limited usage and crash data that never includes your content: in the EU and EEA only if you allow it, and anywhere you can turn it off at any time in Settings.

Who we are

Quo is made by Astra Labs Ltd (“we”, “us”), a company registered in England and Wales (company number 16558481), registered office 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. We are the controller of the limited personal data described in this policy. For any privacy question or request, email [email protected].

What stays on your device

The following is processed on your device and is never sent to us or to any AI service in a form anyone can read:

Read-aloud uses your device’s built-in text-to-speech engine. You don’t need an account to use Quo. We cannot see, read or recover your conversations. That stays true if you use Quo Sync, described below, because what it uploads is encrypted on your device with a key only you hold.

Information we collect

Usage and crash data

Quo uses Google Firebase Analytics and Firebase Crashlytics to understand how the app is used and to fix problems. This collects:

This data never includes the content of your chats, prompts, files, photos or voice. Error reports are reduced to short codes so they don’t contain your data.

In the EU and EEA, Quo asks for your consent first and collects no usage or crash data unless you choose “Allow”. Elsewhere, collection is on by default. Wherever you are, you can change your choice at any time in Settings → Data → Share Usage Analytics, which turns both analytics and crash reporting on or off.

Quo does not use the advertising ID, does not show ads, does not track you across other apps or websites, and does not sell or share personal data for advertising.

App configuration

Quo downloads configuration values from Firebase Remote Config to adjust app behaviour. This request includes the app’s Firebase installation identifier and app version, and never your content. It happens only when usage data collection is allowed; otherwise Quo uses built-in defaults.

When you contact us

If you email us, we receive your email address and whatever you include in your message. We use it only to reply to you.

Accounts and Quo Sync

You only need a Quo account to use Quo Sync, which keeps your chats and memories in step between your devices (Quo Web, the desktop app and the Android app), or to buy Quo Pro or a Quo Sync plan. Everything else works without one.

Your account

You sign in with your email address: we email you a six-digit code (through our email provider, Resend), which works for 10 minutes. We keep your email address, a one-way hash of the code until it is used or replaced, and records of your plan and credits. So the free trial can be given only once, we also keep a one-way keyed hash of your email address for a year after the trial, even if you delete your account; it can’t be turned back into your address. Staying signed in uses a secure cookie (Quo Web and the desktop app) or a token held in your phone’s secure storage; signing out removes it from that device, and “sign out of all devices” ends every sign-in at once.

What Quo Sync stores

If you turn on Quo Sync, each chat and memory is encrypted on your device before it is uploaded, with a key made from a recovery key that you save and that we never receive. We store the encrypted data, a random identifier for each item, its size and when it last changed, and a small encrypted check value that lets a new device confirm your recovery key. The names of attached files are part of the encrypted data; the files, photos and models themselves are never synced.

We can’t read, search or recover your synced chats and memories, and if you lose your recovery key nobody can open them. We can tell that your account uses Quo Sync, roughly how many items it holds, how big they are and when they changed, but not what they say.

Payments

Quo Pro and Quo Sync plans bought on the web or in the desktop app are sold by Paddle, our merchant of record, which collects your payment details and handles tax. We receive your email address, your country and the status of your plan, never your card details.

Deleting your account

You can delete your account yourself at any time (Settings → Sync in the Android app, Plan & credits in Quo Web and the desktop app; see how to delete your account), as long as you have no running plan; cancel that first. Deleting it removes your synced chats and memories, your credits and your plan records from our systems. The chats and memories on your devices stay. Paddle keeps its own records of purchases, as the law requires.

Downloads and purchases

AI models are downloaded from Hugging Face, a public model host, or, if you add a custom model, from the web address you enter. On Android, the starter model may instead be delivered by Google Play. As with any download, the host receives standard request information such as your IP address and is responsible for it under its own privacy policy.

The optional Premium upgrade is bought through Google Play or the App Store, which process your payment under their own privacy policies. We receive confirmation of the purchase (such as the product and its status), never your payment details.

Notifications and permissions

If you allow notifications, Quo shows notifications generated on your device (for example when a long reply finishes). Quo does not use a push notification service.

Quo asks for access to the microphone (voice input), camera and photos (to attach images) and files (to attach documents) only when you use those features. What they capture is processed on your device.

This website

This website uses no cookies, analytics or trackers. It runs on our own server in the UK, behind Cloudflare, which delivers it and protects it from attacks. Our server and Cloudflare process standard request information (such as IP address, browser type and the pages requested) to deliver and secure the site.

Quo Web and Quo for desktop

With offline models, everything happens on your computer: your chats are saved only in your browser’s or the app’s storage on that computer, and nothing you type is sent anywhere. Models are downloaded once from Hugging Face, and the desktop app checks GitHub for updates; like any download, these requests show your IP address to those services.

Files you attach (PDFs, text files and photos) are read on your computer. With an offline model they stay there. With a cloud model, or a model you reach with your own account (your own API key, or Claude Agent with your own Claude Code login), they go with your message to that model’s provider: documents as text, and photos only to models that read images. Attached files are never synced. Voice input turns your speech into text on your computer: the speech model (about 80 MB) is downloaded once from Hugging Face, and your audio is neither saved nor sent anywhere. Read aloud uses your system’s own voices. The desktop app runs the AI in a separate program on your computer (llama.cpp) that can only be reached from your own computer, with a key that only the app knows.

Optional cloud model

Quo Web and the desktop app also offer a free cloud model, clearly marked and used only when you pick it. When you do, the messages in that chat are sent through our server to OpenRouter, which passes them to the model’s provider (for example OpenAI) to write the reply. We only use providers that don’t keep or train on your messages, and our server doesn’t store them either.

In Code mode (desktop app, only when you turn it on and choose a project folder) with an offline model, nothing leaves your computer. With a paid cloud model, the files Quo reads from that folder, and the output of commands you approve, are sent to the model’s provider as part of the conversation, in the same way. Quo never reads secrets files (such as .env files and keys), changes a file or runs a command only after you confirm it in a window the page can’t click (apart from a few read-only checks, such as git status, that run on their own and can’t change anything), and has no internet access other than downloading public GitHub repositories you or the model ask to look at, web search when it is on, and pushing your project to its own remote (such as your GitHub repository) when you ask and approve that push.

Web search

Models can search the web when they decide a message needs it; there is no switch in the chat. You can turn searching off in Models & storage → Web: it is allowed by default for cloud models and your own API keys, and off for offline models until you turn it on, so an offline chat stays offline. In the desktop app, models can also read pages. When it is on, the words the model searches for go to the search service you chose (Brave Search, Tavily or Exa with your own key, a SearXNG address, or DuckDuckGo), and pages are fetched by your computer, not through our servers. Quo only opens addresses you wrote, that a search returned, or that a page it read links to, and never addresses on your own computer or network. Keys for search services are kept like other API keys. In a browser, web search is done by OpenRouter or Anthropic, if you use your own key with them.

With Quo’s cloud models, when the model decides to search, the words it searches for go through OpenRouter to its search partner, Exa, and the results come back to the model. The free model includes a few searches a day.

Making images

When you ask for an image, the model you are chatting with writes a description of it (a prompt). That prompt, and the image you ask to change if you ask for a change, goes through our server to OpenRouter and on to an image model’s provider, which makes the image. Only providers that don’t keep or train on what they receive are used, and our server doesn’t store the prompt or the image. With an offline model, the prompt is written on your device and only the prompt leaves it. Images you make are kept on your device and are not synced. A few images a day are free (a change to an image counts as two).

Your own API keys

You can also use models with an API key of your own (from OpenRouter, Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral, Groq, or a server you run yourself), with no Quo account. When you do, the messages in that chat, and in Code mode the files Quo reads, go straight from your computer to that provider, under that provider’s terms and privacy policy. They do not go through our servers, and we never see your key or your messages. In the desktop app your key is saved encrypted by your operating system’s secure storage (where it has none, it is kept in memory until you quit) and the app’s pages can never read it back; in a browser it is saved in that browser only. Keys are never synced and never sent to us. Memories are not sent to these models, as with our own cloud model; files you attach go with your message.

To keep the free allowance fair, our server counts how many cloud messages are sent each day per device and per IP address. It stores these counts under one-way keyed hashes, never the IP address or the app’s random device ID itself, and deletes them after two days. We also keep daily totals of how many cloud requests were made and what they cost, with nothing about who made them.

Why we use your data (legal bases)

Where UK or EU data protection law applies, we rely on:

Service providers and international transfers

This website, Quo Web and our server run on our own server in the UK. Google (Firebase), Cloudflare (which delivers and protects them), Neon (our database, in London) and Resend (sign-in emails) process data for us as service providers, Vercel runs our old web addresses for older versions of the apps, and Paddle sells Quo Pro, Quo Sync and credit packs as merchant of record. When you choose a cloud model, OpenRouter and that model’s provider process those messages to answer them. They may process it outside the UK and EU, including in the United States. Where they do, the transfer is protected by recognised safeguards such as the EU–US Data Privacy Framework and its UK Extension, or Standard Contractual Clauses.

How long we keep data

Security

Your content is protected by your device’s own security and, unless you use Quo Sync, never leaves it. Quo Sync data is encrypted on your device (AES-256-GCM) before it is uploaded, and the key never leaves your devices. The limited data sent to our service providers is encrypted in transit.

Children

Quo is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has used Quo and data was collected, contact us and we will help.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to its use, and to data portability. You can withdraw consent or object to usage and crash data at any time by turning it off in Settings. To make a request, email [email protected]. If you have a Quo account you can delete it yourself, and everything we hold for it, as described above. For usage and crash data, which isn’t linked to an account, we may need information from your device (such as its analytics identifier) to find what’s linked to you.

If you are in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk). If you are in the EU, you can complain to your local data protection authority. We would appreciate the chance to resolve your concern first.

California residents

In the past 12 months we have collected the categories described above: identifiers (pseudonymous app identifiers), internet or other electronic activity (app usage), approximate geolocation, and commercial information (purchase records). We use them only for the purposes in this policy. We do not sell or share personal information, as those terms are defined under California law, and we do not use sensitive personal information. You have the right to know, delete and correct your personal information, and we will not discriminate against you for exercising these rights.

Changes

We may update this policy. We will post the new version here with a new date, and tell you in the app if a change is significant.

Contact

Astra Labs Ltd, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
[email protected]