Privacy Policy

toqe is built local-first: your data lives on your own devices and, if you choose, in your own cloud. We designed it so that we can’t see it.

Last updated: 13 August 2026. This policy explains what happens to your information when you use the toqe website, the toqe apps, and when you buy a licence.

The short version

Your toqe data (bookings, invoices, finances) stays in a file you own — on your device and, if you link one, in your own Dropbox / iCloud / Google Drive / folder. It never touches our servers.
The desktop and iOS apps send us no analytics or telemetry at all.
The website and live demo use privacy-friendly analytics (Vercel + PostHog) to understand traffic — no accounts, no selling your data.
Purchases are handled by Lemon Squeezy, our payment provider and merchant of record; we never see your card details.
toqe needs no account with us. There’s nothing to log in to.

Who we are

toqe is made by Second March (“we”, “us”). This policy covers toqe.pro, the toqe apps for macOS, Windows and iOS, and the live demo. You can reach us any time at hello@secondmarch.xyz.

Your toqe data lives with you

Everything you put into toqe — projects, studios, bookings, invoices, expenses, settings — is stored as a plain file on your own device (in the app’s local storage and, when you link one, a `toqe-data.json` file you choose the home for). We do not host, receive, or store this data. There is no toqe server holding your information.

Because the data is yours and local, deleting it is entirely in your hands: remove the file and clear the app’s storage, and it’s gone. We hold no copy to delete.

Syncing through your own accounts

To use the same data on more than one device, toqe can sync your file through a service you connect — Dropbox, iCloud Drive, Google Drive, or any folder your own sync client watches. When you do this:

toqe talks directly to that service from your device. The sign-in tokens are stored on your device only (your browser’s local storage, or the system keychain) — they are never sent to us and never written into your synced data file.
toqe only reads and writes its own file (and a companion `toqe-files/` folder for attachments). It doesn’t browse your other files.
The service you connect (Dropbox, Apple, Google) processes that data under its own privacy policy. Your relationship for the stored file is with them, not with us.

Coming from Notion normally means a CSV or Notion export you drop into the import tool, which never leaves your machine. Where a document is set up with Notion database ids, a one-time, read-only API import is also available: it runs through a stateless relay that only forwards the request and stores nothing, your Notion token stays on your device, and toqe never writes back to Notion. Connecting Google Calendar / Tasks is likewise read-only and device-side; a relay holds only the credential needed to complete sign-in and stores no data.

The relays above (for Notion, Google and attachment downloads) are pass-through proxies with no database. They forward a request and return the response — they don’t log or retain your content.

The website and the demo

The marketing site and the browser demo at toqe.pro use two analytics tools to understand how the site is used and improve it:

Vercel Analytics — privacy-friendly, aggregate traffic measurement (page views and performance). It doesn’t use cross-site tracking cookies.
PostHog (hosted in the EU) — product analytics for anonymous usage events such as which pages are viewed, onboarding steps reached, and clicks on “demo”, “download” or “buy”. We use it to see what’s working, not to identify you.
Session replay (part of PostHog) — on this website and the browser demo only, an anonymous recording of how a visit moved through the page: scrolling, clicks and navigation. It shows us where people get stuck in the demo, which runs on made-up sample data. Anything you type is masked before it is recorded, and the recording is tied to a random id, never to a name or an email. The installed apps are never recorded — they contain no analytics of any kind.

These record technical basics your browser sends (like a rough region, device type and referrer) and the events above. They do not receive the contents of your toqe data. The demo runs on sample data that never leaves your browser.

The apps collect nothing

The installed toqe apps — macOS, Windows and iOS — contain no analytics, tracking or session recording. The analytics described above belong to the website and the browser demo; none of it exists in the apps. They run offline and reach the network only for things you trigger: checking for an update, syncing to a service you connected, running an import you started, or fetching exchange rates. We receive no usage data from the apps.

Purchases

When you buy a licence, the checkout is run by Lemon Squeezy, who act as the merchant of record. They collect and process the details needed for the sale — your email, billing information and payment details — under their privacy policy. We never see or store your card details. We receive a record of the purchase (such as your email and licence key) so we can deliver and support your licence.

Cookies and local storage

The website uses local storage and cookies set by the analytics tools above, plus small preferences (like your light/dark choice). The apps use your device’s local storage to hold your toqe data and settings — that’s the product working, not tracking. We don’t use advertising cookies or sell data to anyone.

Third-party services we rely on

Vercel — hosts the website and provides its analytics.
PostHog (EU) — anonymous product analytics and session replay for the website and browser demo (never the apps).
Lemon Squeezy — payments and licensing.
Services you connect yourself — Dropbox, Apple iCloud, Google, Notion — each governed by its own policy.

Data retention

We keep website analytics only as long as it’s useful for understanding trends, and purchase records for as long as needed to support your licence and meet our legal and accounting obligations. Your toqe data isn’t ours to retain — it stays with you.

Your rights

Depending on where you live (including under UK and EU GDPR), you may have the right to access, correct, or delete the limited personal data we hold — essentially your purchase record and any support correspondence — and to object to or restrict its processing. Since your actual toqe data lives on your own devices, most of it is already fully in your control. To make a request, email hello@secondmarch.xyz and we’ll help.

Children

toqe is a tool for working freelancers and isn’t directed at children under 16. We don’t knowingly collect data from them.

International use

toqe is available worldwide. The services we use (above) may process limited data in the UK, EU or US under their own safeguards. By using the site you understand this limited processing takes place.

Changes to this policy

If we change how we handle data, we’ll update this page and the “last updated” date above. Material changes will be made clear.

Contact

Questions about privacy? Email hello@secondmarch.xyz and we’ll get back to you.

This policy is provided in good faith and in plain language. It isn’t legal advice; for your own compliance obligations, consult a professional.