CQL

Privacy policy

Last updated 15 October 2026

CQL is a database client for macOS, sold by Khairul, a sole proprietor in Malaysia. This policy covers the CQL app and this website. We handle personal data under Malaysia’s Personal Data Protection Act 2010 (PDPA).

What stays on your Mac

CQL does not send these to us. The one exception is what a crash report may still contain after the app tries to remove it; see Crash reports below.

  • your SQL queries and their results;
  • your database hosts, usernames and passwords. Passwords are kept in the macOS Keychain; the other connection details are kept in a file on your Mac;
  • your AI provider keys. They are kept in the macOS Keychain. AI requests go straight from your Mac to the provider you configured, and never through our servers. What you send there is covered by that provider’s own terms.

The app has no analytics or tracking.

What we collect, and how long we keep it

  • Your account. When you sign in with Google, we store your email address. Google also shares your name and profile picture with us, but we don’t store them. We keep your email until you ask us to delete your account.
  • Your plan. We store your tier (Free, Trial or Pro), the features it includes, your trial dates, and whether your tier came from a payment or was set by us. This is kept as long as your account exists. To enforce the device limit, the app also sends a random identifier created for each Mac. It is not based on your hardware, your Mac’s name or your user name, and we store only a one-way hash of it, with when that Mac was first and last used. We delete it 30 days after the Mac was last used, or when you remove the Mac from your account. We also keep a record of when each Mac was given or lost its place on your plan, without the identifier, for as long as your account exists.
  • Payments.
    • Stripe handles checkout and stores your card details; your card number never reaches us.
    • To keep the free trial to one per card, we keep Stripe’s fingerprint of each card used while on a free trial (a code Stripe derives from the card, not the card number) and which account used it first. We keep it indefinitely, including after that account is deleted, so that deleting an account does not make the card eligible for another trial.
    • We store your Stripe customer and subscription IDs and your subscription’s status, price and renewal or end date, for as long as your account exists.
    • Stripe also sends us records of each payment event, such as a payment, renewal, refund or dispute. We keep these as financial records even after an account is deleted, because Malaysian tax law requires us to keep business records for seven years.
  • Support messages. What you write to us, the email address we reply to, and some app details attached to each request:
    • app version, macOS version and chip type;
    • language setting;
    • your plan and billing status;
    • how many connections you have and which database engines they use (no names, hosts or contents).
    We keep these until you ask us to delete them.
  • Crash reports. When the app crashes, it sends us:
    • the app version, macOS version and chip type;
    • the kind of error;
    • an error message and stack trace;
    • the time it happened.
    Before a report is sent, the app tries to remove queries, quoted names, file paths, web and email addresses, and server addresses from the message and stack trace. This removal is automatic and best effort: a fragment it does not recognise can still get through. Crash reports are not linked to your account, and we do not store your IP address with them. We delete them after 90 days. You can turn crash reports off in Settings → General → Privacy.
  • Update checks. About every six hours, the app asks our server whether a new version is available. Each check sends your app version, operating system and chip type.
  • Server logs. Like most websites, our server records each request it receives, including your IP address. We keep these logs for up to 90 days to keep the service secure and running.

Who else handles your data

  • Stripe: payments, invoices and the customer portal.
  • Google: sign-in.
  • Resend: emails about your support requests.
  • Cloudflare: carries traffic to our server.
  • GitHub: hosts the app downloads and updates.
  • Telegram: sends us notifications about new support messages and crashes. These can include your email address and the text of a support message.

We do not sell your data, and we do not use it for advertising.

Your rights

Under the PDPA, you can ask us to:

  • show you the personal data we hold about you;
  • correct it;
  • stop using it;
  • delete your account and support messages.

There are two exceptions. We keep payment records for as long as the law requires, and we keep the card fingerprints used to limit free trials (see Payments above). To make a request, contact us using the details below.

Contact

Use the Support form in the CQL app, or email support@keroldev.com. See also our Terms of service and Refund policy.