Privacy policy

Last updated: 9 October 2026

1. Who is responsible

Responsible for the processing of personal data on quak.party, in the web app, the apps, the CLI and the Quak API (together “Quak”) is:

Mike Lieser
St.-Josef-Platz 2a
56068 Koblenz, Germany
Email: hello@quak.party

See also the legal notice; the rules for using Quak are in the terms. We have not appointed a data protection officer, as we are not required to. For anything about your data, write to the address above.

2. Visiting the website

Server logs

When you open a page, our hosting provider Vercel processes the technical data your browser sends: IP address, date and time, the page requested, referrer, browser and operating system. This is needed to deliver the pages and to keep them secure (for example against attacks). The logs are kept only briefly and are not merged with other data. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a working and secure website.

Statistics with Plausible

To understand how Quak is used, which pages are read and where visitors come from, we use Plausible Analytics on the website and in the web app, on quak.party only. We run Plausible ourselves (hub.mikelieser.dev), so the data goes to no analytics company. Plausible works without cookies and without storing personal data. Your IP address is only used to derive the country and, together with the browser, a daily changing, one-way hash that lets Plausible count unique visitors per day; the IP address itself is not stored, and nobody can be recognised across days or websites. Plausible records the page, referrer, country, device type, browser and operating system, clicks on links to other sites and downloads, and a few events such as a click on a plan, a started sign-up or checkout, always as categories (which plan, monthly or yearly), never your email, name, texts or any id, and without any link to your account. Invitation links and login parameters are removed from addresses before anything is sent. The data stays on our server at Hetzner in Germany.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in improving Quak with anonymous statistics. Because Plausible reads or stores nothing on your device, no consent is needed under § 25 TDDDG. You can still object: tools that block trackers, or the “Do Not Track” setting, also stop Plausible.

Error reports with Sentry

When something breaks on the website or in the web app, an error report goes to Sentry, so we can fix it: what went wrong, where in the code, the page (without invitation or login tokens), browser and operating system. Before a report leaves the browser or our server, emails, keys, tokens, headers, cookies and form contents are removed; IP addresses are not stored and there are no session recordings. Sentry stores the reports in its EU region (Germany) and keeps them for up to 90 days. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a working service.

3. Your account

Sign-up and login

To create an account you give us your email address. We send a link to confirm it; the account only exists once you confirm. Logging in works the same way, without a password. With every sign-up and login we process your IP address and derive the rough location (country, city) and time zone from it. We show time, IP address and location in the login email, so you can spot a login that wasn't you. The lookup result (city, country, time zone) is cached for one hour; only country and time zone are kept with your account.

What we keep with your account:

• email address, and a new address while you are changing it
• country, time zone and language (from sign-up, changeable), for quiet hours and multi-language voices
• your settings: default voice, volume, speakers, intro, outro, quiet hours and audio cache time
• credits, plan and subscription status
• API keys with their name, origin (web app, CLI, API) and usage counts
• whether you want the newsletter, and when you agreed
• which upcoming clients you voted for on the clients page

Legal basis: Art. 6 (1) (b) GDPR, to provide Quak under our contract with you; for the login security data also Art. 6 (1) (f) GDPR, our legitimate interest in protecting your account.

Your Sonos connection

When you connect Sonos, you log in at Sonos and allow Quak to play on your speakers. We receive access tokens and the names and IDs of your households, rooms and groups, and keep them until you disconnect Sonos or delete your account. Sonos processes the playback as its own controller under its privacy policy. Legal basis: Art. 6 (1) (b) GDPR.

Integrations you connect

Quak works with other services only if you connect them yourself, for example the Slack app, IFTTT, a trigger URL in another tool, or apps and extensions such as the one for Raycast. Then Quak exchanges with that service what the integration needs: for Slack the access tokens of your Slack workspace and the commands sent to Quak, for a trigger the requests it sends. That service processes the data as its own controller under its own terms and privacy policy, which you agreed to with it; it isn't a service provider of ours. Apps and extensions on your device talk to the Quak API with your key. When you disconnect an integration or delete its key, Quak deletes its tokens. Legal basis: Art. 6 (1) (b) GDPR.

4. Announcements

• Content: the texts, recordings, files and URLs of your announcements are not stored in our database. To play an announcement and to let you replay it, its audio and, for a text, the text itself stay in a cache on our servers for your audio cache time: at least 5 minutes, at most 24 hours after it last played (you choose 5 minutes, 1, 3, 12 or 24 hours; 24 hours by default). Then both are deleted. From the microphone we only keep the finished audio, not the raw recording; live talk is passed on to the speakers and not stored. URLs and file names are not stored at all. A text goes to the voice provider you chose to be turned into speech (see section 7).
• History: for each announcement we keep who made it, when, on which speakers, the kind, voice, effects, the length of a text in characters, credits and status. How long depends on your plan: 1 day without a subscription, 1 week (Home), 1 month (Family), 3 months (Team), 6 months (Business); then it is deleted. What stays is only a daily sum per workspace (number of announcements and credits), without person, text or speaker.
• Clips: audio you upload or keep as a clip is stored in the EU until you delete it. Links to it are signed and expire after 15 minutes.

Legal basis: Art. 6 (1) (b) GDPR.

5. Payments

Subscriptions and credit packs are sold through Stripe Managed Payments. The seller and merchant of record is Link, LLC (USA): it handles payment, invoices, taxes and refunds and processes your payment data as its own controller under its privacy policy. In the EU, payments are processed by Stripe Technology Europe, Ltd. (Ireland). Checkout and the customer portal are pages of Stripe you are taken to; quak.party itself loads nothing from Stripe. We receive what we need to activate your plan (for example plan, status, country and the billing email), not your card details. Invoices are kept for the periods tax law requires (up to 10 years). Legal basis: Art. 6 (1) (b) and (c) GDPR.

One free trial each: so a trial can only be started once, we store hashed the household ID of your Sonos system and the fingerprint Stripe gives your payment card, never the card number. This is our legitimate interest in preventing abuse (Art. 6 (1) (f) GDPR). These values stay stored for 3 years, also after your account is deleted.

6. Emails and newsletter

We send you emails that belong to the service, such as login links, confirmations and notices about your credits (Art. 6 (1) (b) GDPR). The newsletter only comes if you ask for it at sign-up or in your settings, and only after you confirmed your address (Art. 6 (1) (a) GDPR). Every newsletter has a link to unsubscribe, and you can switch it off in your settings at any time. Emails are sent through Brevo; until then they wait in a queue, stored encrypted and deleted 7 days after sending. When you write to us, we use your message and address to answer and keep them as long as needed for that.

7. Who else receives data

We use the following service providers, who process data on our behalf and under our instructions (Art. 28 GDPR):

• Hetzner Online GmbH (Germany): two cloud servers in Nuremberg: one runs the Quak API with its database, cache and audio cache, the other its deployment; and the server of our statistics (Plausible), to which the website and the API send page views and events, from the API with IP address and browser for the daily visitor hash.
• Cloudflare, Inc. (USA): network, encryption and firewall in front of the API; storage of the built-in sounds and your clips in R2 with EU jurisdiction, clips also up to 24 hours in its edge cache. Transfer to third countries based on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Vercel Inc. (USA): hosting of this website and the web app, server functions in Frankfurt. Transfer to third countries based on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Functional Software, Inc. (Sentry) (USA, data in the EU region (Germany)): error reports of the website, the web app and the API, pseudonymised (internal user and workspace IDs), without content, email addresses or keys. Transfer to third countries based on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Brevo (Sendinblue SAS) (France): sending all emails of the service, login and sign-up links included, and the newsletter.
• Amazon Web Services EMEA SARL (Amazon Polly) (Luxembourg, processing in Frankfurt): speech for Amazon voices; it only receives the text and the chosen voice. Transfer to third countries based on the processing in the EU; standard contractual clauses of the AWS data processing addendum.
• Google Cloud EMEA Limited (Cloud Text-to-Speech) (Ireland, processing also outside the EU): speech for Google voices, Gemini voices included; it only receives the text and the chosen voice. Transfer to third countries based on the EU-U.S. Data Privacy Framework and standard contractual clauses of the Cloud data processing addendum.
• OpenAI Ireland Ltd (Ireland, processing also in the USA): speech for OpenAI voices; it only receives the text and the chosen voice. Transfer to third countries based on the standard contractual clauses or an adequacy decision, as in OpenAI's data processing addendum.
• Eleven Labs Inc. (ElevenLabs) (USA): speech for ElevenLabs voices; it only receives the text and the chosen voice. Transfer to third countries based on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• IPLocate Pty Ltd (iplocate.io) (Australia): country and time zone from your IP address at every sign-up and login, for quiet hours, the language of voices and the login email. Transfer to third countries based on the standard contractual clauses of its data processing agreement.

Some voice providers may process the text of an announcement outside the EU. If you want to avoid that, choose a voice of a provider that processes in the EU; ask us which ones.

We don't sell your data and don't pass it on for advertising.

8. Cookies and storage in your browser

This website and the web app only use what they need, no advertising or tracking cookies:

• quak_key: keeps you logged in; httpOnly, not readable by scripts; up to 400 days or until you log out.
• quak_signed_in: only says that you are logged in, so the website can show “Open app”; same lifetime.
• quak_play: remembers your speakers, volume and advanced mode in the app.

These are strictly necessary for the service you asked for (§ 25 (2) TDDDG), so no consent is needed. Plausible sets no cookies.

9. How long we keep data

We delete data as soon as it is no longer needed for its purpose: history and audio cache as described in section 4, your account data when you delete your account. The technical logs of the API are kept for 30 days and contain no content of announcements. What tax or commercial law requires us to keep, we keep for the periods it sets.

Deleting your account: in the web app under Account you can download all your data as a file and delete your account. We email you a link to confirm; only that link deletes. Then all data of your account and of the workspaces only you use are deleted. In workspaces you share with others, your announcements stay in their history without your name. Your newsletter contact at Brevo is deleted too. We delete the access to your Sonos account; Quak stays listed in the Sonos app until you remove it there. Only the hashed values that limit the free trial stay, for 3 years (section 5).

10. Your rights

You have the right to

• know what data we have about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a common format (Art. 20),
• object to processing based on our legitimate interest (Art. 21),
• withdraw a consent at any time, with effect for the future (Art. 7 (3)).

Download your data and delete your account in the web app, or write to hello@quak.party. You can also complain to a supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Mainz.

We don't use automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Changes

When Quak changes, this policy changes with it. The current version is always on this page, with the date at the top.