Quay is an inbox for agent results. This policy describes what the iPhone app and its backend store.

What we collect

• Account: your email address, or the Apple identity token if you use Sign in with Apple, plus an optional display name.
• Inbox: cards agents POST for you (title, summary, source, the prompt they were given, and the card payload — places, calendar blocks, todos, notes, or reading lists).
• API key: a quay_… token created for your account so agents can write only to your inbox.
• Device token: if you turn on notifications, the APNs token for this iPhone.
• Local cache: a copy of your inbox on this device so the list still appears offline.

What we do not collect

Quay does not show ads, does not use tracking SDKs, and does not sell your data. Calendar access is requested only when you tap Add to Calendar. Location is not requested by Quay; map coordinates come from the card payload if an agent included them.

Agents

Connecting Grok or another agent is optional. If you copy the posting instructions, that text includes your API key. Whoever you paste it to can POST cards to your quay until you rotate or delete the key. Quay does not talk to Grok, Cursor, or Claude itself.

Where it lives

Account and inbox data are stored in the Supabase project that hosts Quay. Traffic uses HTTPS.

Deleting your account

Settings → Delete Account removes your profile, cards, API key, device tokens, and sign-in. Agents can no longer post. You can also swipe to delete individual cards.

Contact

[email protected]