Privacy Policy
Effective Date: October 1, 2026
01. Introduction & Philosophy
At Q-Deflate (operated by the Microforce Project, "we", "us", or "our"), we believe privacy is not an afterthought—it is a fundamental engineering constraint. We provide an RFC 1951-compatible, high-density entropy compression service for modern web developers, DevOps pipelines, and autonomous AI agents.
This Privacy Policy describes what minimal information we collect, why we collect it, and our unwavering commitment to our Zero-Storage Guarantee.
02. The Zero-Storage Guarantee (Payload Privacy)
We never permanently store, inspect, copy, or index the contents of any files, datasets, or payloads sent to our compression endpoints.
- In-Memory / Ephemeral Processing: Uploaded raw data is compressed in RAM or transient scratch space strictly for the duration required to compute optimal LZ77 matches and dynamic Huffman trees.
- Immediate Cleanup: Once the compressed archive (.gz) is returned via HTTP stream or transient sandbox download (retained up to 10 minutes for user convenience), all raw and intermediate representations are irrevocably purged.
- No Machine Learning Training: Your payload data is never used to train, tune, or evaluate any third-party or proprietary AI models.
03. Information We Collect
We only collect the absolute minimum data required to deliver reliable infrastructure:
| Category | Data Elements | Purpose |
|---|---|---|
| Account Credentials | User ID, Password hash (bcrypt/argon2), API Tokens | Authentication and secure API authorization |
| Usage Metrics | Bytes compressed, balance quota | Billing enforcement and prepaid balance tracking |
| Operational Telemetry | IP address, HTTP method, status code, timestamp | DDoS mitigation, rate limiting, and ephemeral diagnostic logs (auto-rotated) |
04. Payment Information & Stripe Protection
Payment transactions are processed entirely through Stripe, Inc. via Stripe Checkout.
We never collect, store, or transmit your credit card numbers, expiration dates, or CVC security codes on our servers. All financial transaction handling complies with PCI-DSS Tier 1 standards enforced directly by Stripe.
05. Cookies & Tracking Technologies
We value clean engineering. We do not use tracking pixels, analytics beacons, or advertising cookies.
We exclusively issue essential, encrypted HTTP-only session cookies strictly required for dashboard authentication and security state management.
06. Security Architecture
Our production systems leverage a defense-in-depth architecture:
- TLS 1.3 Encryption: All data in transit across public networks is encrypted using modern cipher suites.
- UDS Fortification: Internal account validation and token verification operate within an isolated Unix Domain Socket (UDS) layer with zero external network port exposure.
- Immutable Actor Model: Built on Gleam and the Erlang BEAM virtual machine, preventing shared-memory corruption and concurrent race conditions.
07. Your Rights & Data Erasure
Regardless of your jurisdiction (including GDPR, CCPA, and Japanese APPI), you retain full sovereignty over your account. You may at any time request the total deletion of your User ID, API tokens, and operational records by contacting our support desk.
08. Sub-processors & Third-Party Infrastructure
To deliver global low-latency availability and secure transactions, we partner with vetted infrastructure providers who comply with rigorous security standards:
- Cloudflare, Inc.: Global Anycast DNS, DDoS mitigation, edge network routing, and secure tunnel ingress.
- Stripe, Inc.: Payment tokenization, subscription invoicing, and payment processing (PCI-DSS Level 1 certified).
None of these providers are granted rights to store, harvest, or utilize customer payload data beyond what is strictly necessary to transit network packets or process payments.
09. Limitation of Liability & Governing Law
While Q-Deflate employs rigorous mathematical validation conforming to RFC 1951 lossless specifications, the service is provided on an "AS IS" and "AS AVAILABLE" basis. Users are strongly advised to maintain redundant primary copies of all raw data. To the maximum extent permitted by applicable law, the Microforce Project shall not be liable for any indirect, incidental, or consequential damages resulting from network latency, service interruptions, or force majeure events.
Jurisdiction: This Privacy Policy and any related disputes shall be governed by and construed in accordance with the laws of Japan. The Fukuoka District Court shall have exclusive primary jurisdiction for any legal proceedings arising out of or in connection with this service.