Privacy Policy

QSO One is made by Francesco Catena, based in Ohio, United States. You can reach us at [email protected] or by post at 46 Shopping Plaza, Unit #5015, Chagrin Falls, OH 44022.

We decide what data QSO One collects and what happens to it, which makes us the data controller under the GDPR and UK GDPR.

Our apps. QSO One runs on Android, Windows, iPhone and Mac. The iPhone and Mac apps collect the same data, for the same reasons, as the Android and Windows apps. Everything on this page applies to all of them unless it says otherwise.

Your account. When you sign up we store your email address, your callsign, and optionally your name and license class. We need these to give you an account and to know that you are a licensed operator. We also use your email address to send you occasional updates about QSO One, such as new features, new platforms and release notes. Every one of those has an unsubscribe link, and unsubscribing does not affect your account.

Signing in with Apple. If you sign in with Apple, Apple gives us your name and email address. You can choose to hide your email, in which case Apple gives us a private relay address (ending in privaterelay.appleid.com) that forwards to you. Apple also gives us a sign-in token, which we store encrypted and use for one thing only: to tell Apple to disconnect QSO One from your Apple ID when you delete your account.

Purchases through Apple. If you become a Supporter on iPhone or Mac, Apple handles the payment. We never see your card or bank details. Apple sends us the transaction number, the product you bought, its dates, and an account token, which is your QSO One account number, so the purchase is matched to your account. Test purchases (for example in TestFlight) are kept only as tests and never count as support.

Push notifications, only if you allow them. If you allow notifications, the app gives us a device token so we can send you QSO One notifications, such as a reply to your bug report or news about the app. Notifications are delivered through Google's Firebase Cloud Messaging and, on iPhone and Mac, Apple's Push Notification service. The token identifies the app on your device, not you, and is removed when it stops working or you delete your account.

Network credentials, only if you turn on syncing. QSO One can save the usernames and passwords you use for AllStarLink, EchoLink, BrandMeister, TGIF and similar networks, so that signing in on a second device restores them. This is off unless you turn it on. Passwords are encrypted before they are stored, each account with its own key.

The same login on two of your devices. While a DMR network or an AllStar node is connected, the app tells our server a random ID for this install, the network and login ID or the node number, and the device type (Android, Windows, iPhone or Mac). That lets the app warn you when two of your own devices use the same login, because the network then drops one of them without saying so. For an AllStar node it also tells you when another QSO One user has the same node connected, never who; nobody is ever told anything about you or your account. Each entry is removed when you disconnect; one left behind (for example by a crash) is cleared the next time you connect, and all of them when you delete your account.

Your QSO log. The contacts you record in the app's QSO log, including their grid squares and any notes you add, are backed up to your QSO One account and synced across the devices you sign in on, so they are there when you reinstall QSO One or move to a new device. They are deleted when you delete your account.

Connection diagnostics. While the app is running it reports which network you are connected to, what you are connected to on it, your app version and platform, and by default your account and callsign. We use this to tell whether an update has broken connections for people, and to help you when you write in with a problem. Our reason for collecting it is our legitimate interest in keeping the app working for everyone, including the many people who never report a problem. You can turn off the account and callsign part in the app under Settings, and we ask you when you first install it. Connection activity is still recorded without you attached to it.

Bug reports. When you send a bug report it includes your app's log file, your callsign and email, your app and device version, and network details including IP addresses and information about who your app was connected to. We use it to diagnose the problem you reported.

Your position, only if you turn it on. QSO One can share your location over M17 so you appear on the map. This is off unless you switch it on, and you can switch it off at any time. Your position goes out over the M17 network as part of what your radio sends; QSO One does not store it on our servers. The app reads your location only for this and for Weather (below), and only while you have allowed location access.

Weather, only if you use it. Weather sends the coordinates of your saved places, rounded to about 1 km, directly from your device to the US National Weather Service (weather.gov) to get forecasts, observations, radar and alerts. If you turn on Current location, QSO One reads your approximate location each time you open Weather, only while you have allowed location access, and sends those rounded coordinates the same way. Nothing goes through QSO One's servers. Cities and ZIP codes you type are looked up on your device and are not sent anywhere. Your saved places stay on your device. Nothing that identifies you, such as your callsign or account, is sent to the weather service.

Password reset requests. When someone asks to reset a password on this website, we record the email address that was entered, the IP address the request came from, and the time. We use this to limit how often a reset email can be sent and to see whether an address is being targeted, so people are not spammed with reset emails they did not ask for. We keep these records for 30 days and then delete them.

Server logs. Our hosting and database providers keep short term technical logs that include IP addresses, in the ordinary course of running a website.

When you run or join a live net in QSO One or on qso1.net, we handle:

• The check-in list: callsigns, the name and location that come from public callsign lookups, the check-in types you pick (for example "mobile"), the times, and which room or frequency the check-in came from. Check-in lists of live nets are public: anyone can read them, with or without an account, the same as a net heard on the air.
• Chat: messages you write in a net's chat, with your callsign. Only signed-in users can read or write chat.
• Reports, mutes and removals: if you report a message, we keep a copy of that message with the report so we can act on it.
• Blocking: when you block someone, the block is saved to your QSO One account, so their messages are hidden from you in the app and on this website. A block stays until you remove it or delete your account.
• Share links: when you start a net you can pick a short link for it (qso1.net/net/your-net-name). While the net is live we keep the link name and the net's name, tied to your account, so nobody else can take it. Anyone with the link can see your net and your callsign as net control. When the net ends, the link is deleted and the name is free for anyone again; deleting your account frees it too.

How long: live check-in lists and all chat are deleted within 24 hours after the net ends. The finished check-in list is saved to the account of the person who ran the net, until they delete it or their account. If you delete your account, your account link is removed from every check-in (your callsign stays in the net's log, like a paper log). Reports are kept for 90 days.

Who processes it: the live part runs on Cloudflare; the saved record is in Supabase. Both are listed below. We never send On the Net data to NetLogger or any other net service. Exports (ADIF, CSV) happen only on your device when you choose them.

QSO One keeps the microphone open while you are connected to a network. This avoids a delay on every key press, keeps Bluetooth headsets connected, and lets the app notice a failed microphone. Your voice is transmitted only while you hold the push-to-talk button. When you are not transmitting, microphone audio is discarded. It is not recorded, stored, or sent anywhere.

Bluetooth. Used only to work with push-to-talk buttons and headsets you pair with QSO One.

Local network. Used only to connect directly to nodes and hotspots you choose on your own network, for example an AllStarLink node at home. iPhone and Mac ask your permission for this the first time.

Location. Used only when you turn on M17 position sharing or use Current location in Weather, as described above.

Speech recognition (Net Runner). Net Runner can turn what it hears into text to help a net control keep the log. The speech recognition runs on your device, and the audio never leaves it.

We do not use advertising. We do not use third party analytics or tracking scripts on this website. We do not use an advertising identifier. We do not sell your data or share it with anyone for their own marketing.

We use these companies to run QSO One. They only process data on our instructions.

• Supabase, for our database and sign-in
• Netlify, for hosting this website and its server functions
• Cloudflare, for file storage and for live nets (On the Net)
• Resend, for sending email
• Google, only if you choose to sign in with a Google account, and Google's Firebase Cloud Messaging, to deliver push notifications
• Apple, if you sign in with Apple, buy through the App Store, or get notifications on iPhone or Mac

To show a name and location next to a check-in, our live-net server looks the callsign up in HamDB and RadioID.net, two public callsign directories. Only the callsign is sent to them, nothing about you or your account.

The US National Weather Service receives the rounded coordinates of your saved places, and of your current location if you turn it on, when you use Weather. It is a US government service, not one of our processors.

When you open a live net's chat, your browser loads the emoji font from Google Fonts, so Google receives your IP address and browser details, as with any file a website loads from another service. Nothing about you or the chat is sent with it.

All of them are in the United States, which is where our servers are. If you are in the EU or UK, that means your data is stored outside your country.

• Your account data, for as long as you have an account
• Connection diagnostics, no more than 90 days (currently deleted after about 45 days)
• Bug reports, 90 days, or 30 days once we have marked them resolved
• Password reset request logs, 30 days
• On the Net live check-in lists and chat, deleted within 24 hours after the net ends; finished check-in lists, until the person who ran the net deletes them or their account; reports, 90 days
• Payment records, for as long as tax law requires us to keep them
• Your Sign in with Apple token, until you delete your account, when we ask Apple to revoke it

You can delete your account from the app, from qso1.net/account-deletion (which works even if you no longer have the app), or by emailing [email protected]. Deleting removes your profile, your callsign, your saved credentials, your favorites, your QSO log, your diagnostics, your bug reports, the On the Net nets you ran and your blocks, your notification tokens, and your sign-in. If you signed in with Apple, we also tell Apple to disconnect QSO One from your Apple ID. It is not a deactivation and it cannot be undone.

Deleting your account does not cancel a subscription you bought through Apple or Google Play, because those stores run the billing. Cancel an Apple subscription in your Apple account settings (on iPhone: Settings > your name > Subscriptions). Cancel a Google Play subscription in the Play Store under Payments & subscriptions.

Three things survive. If you have ever paid us, the payment record stays because tax law requires it, but it is no longer connected to you. If you have submitted something to the net directory, the entry stays for everyone else's benefit, without your name on it. If you checked in to someone else's On the Net net, your callsign stays in their saved check-in list, but it is no longer connected to your account.

If you are in the EU or the UK, you have the right to ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable form, and to object to our use of it.

You have the right to object to our use of your connection diagnostics. Because we rely on legitimate interests for that, you can tell us to stop at any time, and you can also switch off the identifiable part yourself in the app.

Email [email protected] to exercise any of these. We will respond within one month.

You also have the right to complain to a data protection authority. In the EU that is the authority in the country where you live. In the UK it is the Information Commissioner's Office at ico.org.uk.

Passwords for other networks are encrypted before storage, and each account has its own encryption key. Everything travels over an encrypted connection.

Two things you should know. As the developer, we can access the data stored on our servers, including diagnostics and, technically, stored credentials. And EchoLink's own protocol sends passwords without encryption, which is how EchoLink works everywhere and is not something QSO One can change.

If we change this policy we will update the date at the top.