QuidCast is built so that your financial figures never leave your device. If you create an account, we hold your email address, a sign-in session, your Stripe billing ids, whether Plus is active, and a count of how many Explains you used today. That is the whole list. We never store your money profile, holdings, saved stories, article text, or anything you ask the AI.
1. Who we are
QuidCast (quidcast.com) is operated by Dash Digital, a UK-based independent project, which is the data controller for the personal data described here.
- Controller: Dash Digital Ltd, a private limited company registered in England and Wales (company number 17185782), trading as QuidCast
- Address: 3rd Floor, 86‑90 Paul Street, London EC2A 4NE (registered office)
- Email for privacy matters: [email protected]
- ICO registration number:
2. What this policy covers
It covers the QuidCast website, the optional QuidCast account and QuidCast Plus subscription, and the API service that powers them. It does not cover third-party sites we link to (news publishers, the Bank of England, Buy Me a Coffee); those have their own policies.
3. Using QuidCast without an account
Most of QuidCast needs no account. Calculators, My Money, My Stocks and saved stories all run in your browser and are saved in your browser's local storage. We do not receive them.
Some features send a request to our server so it can fetch data for you. When they do, our hosting provider (Cloudflare) processes the connection details needed to serve the request, such as your IP address, and we use your IP address for short-lived rate limiting (for example, three free Explains a day). Specifically:
- Explain / AI scenarios: the text you ask about (a headline, a summary, an article you chose, your scenario wording) is sent through our server to Anthropic to generate the explanation. We do not store the request or the answer. Please avoid typing names, account numbers or other identifying details into it.
- Market quotes and news: ticker symbols and feed requests go to the data providers via our server. No account or profile data is attached.
- Likes: an anonymous counter per article, with no link to you.
4. What we store if you create an account
| Data | Why | Kept for |
|---|---|---|
| Email address | To send your sign-in link and tell you apart from other members | Until you delete your account |
| Sign-in session (a one-way hash of the cookie value) | To keep you signed in for 30 days | 30 days from sign-in, or until you sign out |
| Magic-link token (hashed) | To sign you in from the email link | 15 minutes, then deleted |
| Stripe customer id and subscription id | To know which Stripe records are yours and to open your billing page | Until you delete your account |
| Plan status and period-end date | To know whether Plus is active and until when | Until you delete your account |
| Explains used today (a number) | To apply the daily limit | About 7 days, then deleted |
| Stripe event ids | So we never apply the same billing event twice | 30 days |
5. Payments
Subscriptions are taken by Stripe on Stripe's own pages. Stripe receives your card details, billing name and address, and email; QuidCast never sees your card number. Stripe acts as a processor for us for the subscription itself, and as an independent controller for its own legal obligations (such as fraud prevention and financial record-keeping). See Stripe's privacy policy.
6. Our processors
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosts the website and API; stores the account database (D1); provides security and caching | Global network; EU/UK-adequate transfer terms |
| Stripe | Takes payment, manages subscriptions, hosts the billing portal | UK/EU/US, with standard contractual safeguards |
| Resend | Sends your sign-in email | US, with standard contractual safeguards |
| Anthropic | Generates AI explanations from the text you submit (no account data attached) | US, with standard contractual safeguards |
Where a provider is outside the UK, transfers rely on the UK International Data Transfer Addendum or UK adequacy regulations.
We do not sell personal data, and we do not share it with advertisers. QuidCast has no advertising.
7. Lawful bases (UK GDPR Article 6)
- Contract — email, session, billing ids and plan status: needed to provide the account and subscription you asked for.
- Legitimate interests — IP-based rate limiting, abuse prevention, the daily usage count, and security logs: needed to keep the service available and fairly shared. We have assessed that these do not override your interests because the data is minimal and short-lived.
- Legal obligation — Stripe's retention of payment records for tax and anti-fraud law.
We do not rely on consent for anything essential, so there is nothing to withdraw; you can simply stop using the service or delete your account.
8. Cookies
QuidCast sets one cookie, and only after you sign in: qc_session, on our API domain api.quidcast.com. It is strictly necessary to keep you signed in, is marked HttpOnly and Secure, and lasts 30 days or until you sign out. It is not used for analytics or advertising and is not shared with anyone. Because it is strictly necessary, UK law (PECR) does not require a consent banner for it, and we do not show one.
We set no analytics, advertising or third-party cookies. Theme preference and your local data use browser storage, not cookies, and never reach our servers.
9. Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you (it is the list in section 4, and your account page shows most of it live);
- Correct it, for example if your email changes (currently: delete the account and sign up with the new address, or ask us);
- Erase it — use Delete my account on your account page for an immediate deletion, or email us;
- Port it — on request we will send the section 4 data in a machine-readable file;
- Restrict or object to processing based on legitimate interests;
- Complain — see section 11.
Deleting your account removes our records immediately. Stripe keeps its own invoice and payment records for as long as financial regulations require; you can also contact Stripe directly about those.
We will respond within one month. We do not make automated decisions with legal or similarly significant effects about you.
10. Security
We keep the data small so there is less to protect. Session and sign-in tokens are stored only as one-way hashes. Secrets live in Cloudflare's encrypted secret store, never in page code. All traffic uses HTTPS. Payment pages are Stripe's own. We review access and dependencies periodically.
11. Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected] and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Children
QuidCast accounts are for people aged 18 or over. We do not knowingly collect data from children. If you think a child has created an account, email us and we will delete it.
13. Changes to this policy
If we change what we store, we will update this page and the "last updated" date, and for anything significant we will email account holders before it takes effect. The core promise — no financial figures server-side — would need a new policy, not a quiet edit.