In one paragraph
AltQ is a small desktop app that types or pastes text that your organization prepared (part numbers, standard replies, prices) into whatever program the person is using. It doesn’t read the screen, the dealer management system, customer records or other programs’ files, and it doesn’t record keystrokes. The only information about the computer that leaves it is the device name, operating system and app version, sent when the device signs in, plus the time it last synced. Catalog content is written by your organization, stored in Google Cloud in the United States, and delivered only to the people your organization gives access.
Quick answers
Does it need administrator rights?
No. The Windows installer installs for the current user only. An MSI is available for IT-managed installs on every user of a PC.
Who publishes the installer?
YouZag, Inc., the company that makes AltQ. The installer and the MSI are signed with its code-signing certificate, so Windows names YouZag, Inc. as the publisher when they run. If Windows shows another publisher, or none, don’t run the file. Delete it and tell us at support@altq.app.
Does it read customer or DMS data?
No. It never reads text from other programs. It writes text into the program that was active when the person pressed the shortcut.
Is it a keylogger?
No. It registers one shortcut with the operating system (RegisterHotKey on Windows) and receives only that key combination. It installs no keyboard hook.
What does it look at on the computer?
When the shortcut is pressed, it looks at the active window’s program name (such as chrome.exe) and window class, to choose between typing, pasting and copying, and at the text cursor position, to open next to it. Never the window’s title or contents.
What does it change on the computer?
The text it inserts; the clipboard while pasting, which is restored right after; its own files; and, unless the person turns it off, a “start at login” entry for the current user.
Where is data hosted?
In Google Cloud (Firebase), region us-central1 in Iowa, United States. Payments are handled by Stripe.
How is data protected?
All traffic uses HTTPS (TLS 1.2 or 1.3), checked against the Windows certificate store. Google encrypts stored data at rest. The desktop app’s sign-in token is kept in Windows Credential Manager (the Keychain on macOS), and the server stores only a hash of it.
Does it work behind our proxy?
Yes, with the proxy set in Windows’ settings or in HTTPS_PROXY. Automatic configuration scripts (PAC files) aren’t read: set the proxy explicitly for those computers, or allow the addresses below directly.
Single sign-on and two-step verification?
There are no AltQ passwords. People sign in with a one-time link sent to their work email, or with their Google account (including Google Workspace), so signing in is as strong as that mailbox or Google account, two-step verification included.
Can we cut someone off?
Yes. Removing them from your organization, removing their access, or signing out their computer on the Organization page takes effect the next time the app checks in: at start, every 15 minutes, and on demand. A computer that can’t reach AltQ stops showing catalogs after the offline grace period (7 days). Text someone already copied can’t be taken back by any software.
Network addresses
The desktop app connects only to these, over HTTPS on port 443:
| Address | Used for |
|---|---|
us-central1-altq-537e8.cloudfunctions.net | Signing in, catalog sync, documents and current values |
| The download address, announced with the first release | Checking for and downloading updates |
People use a web browser for signing in, managing catalogs and billing: my.altq.app, Google’s sign-in services (identitytoolkit.googleapis.com, securetoken.googleapis.com, and for Google sign-in also accounts.google.com and apis.google.com), firestore.googleapis.com, and Stripe’s hosted pages (checkout.stripe.com, billing.stripe.com) for people who pay.
To check that a computer can reach AltQ, open https://us-central1-altq-537e8.cloudfunctions.net/desktop/v1/health in a browser on it. It shows {"ok":true}.
What is stored on the computer
For each Windows user:
| What | Where | Removed |
|---|---|---|
| The app | %LOCALAPPDATA%\AltQ (per-user installer) or Program Files (MSI) | On uninstall |
| Sign-in token for this device | Windows Credential Manager, entry app.altq.desktop | On sign-out |
| Downloaded catalogs and documents | %LOCALAPPDATA%\app.altq.desktop | On sign-out; a catalog as soon as access to it ends |
| Settings (shortcut, theme, insert method, error reports on or off) | %APPDATA%\app.altq.desktop\settings.json | On uninstall |
| Log (at most 1 MB) | %LOCALAPPDATA%\app.altq.desktop\logs | Rotated |
The log records events such as sync results and the program an insert went to. It never contains inserted text. When the app stops unexpectedly, it reports where in its code that happened at the next start, unless error reports are off. Reports carry no sign-in, inserted text, catalog content or payment details, and aren’t tied to a person or device. Documents opened from a catalog carry Windows’ “downloaded from the internet” mark, so Office opens them in Protected View.
What is stored in the cloud
| What | Contents | Kept |
|---|---|---|
| Account | Email address, display name if given, how the person signs in, Stripe customer id | Until the account is deleted |
| Memberships and invitations | Organization, role, who added them and when | Until removed |
| Catalogs, records, documents, versions | What your organization writes and uploads | Until your organization deletes them; deleted items can be restored for 30 days |
| Devices and seats | Device name, operating system, app version, last sync, the person’s email, a hash of the sign-in token | Until signed out; a device that hasn’t checked in for 30 days is signed out automatically |
| Desktop sign-in requests | Device name, approval, a hash of the one-time secret | Deleted a day after they expire |
| Access grants and subscriptions | Email, catalogs, dates, status, Stripe subscription id | Until removed |
| Trial claims | A one-way hash of the email address that started a free trial | Kept, so each address gets one trial |
| Audit log | Who did what to which item, without content | 400 days |
| Outgoing emails | Recipient, sender, organization and catalog names, delivery result | 30 days |
| Logs and error reports | Request outcomes and errors, without content, tokens or payment details | 30 days |
| Backups | A daily copy of the database, point-in-time recovery for the last 7 days, and earlier versions of stored files | 14 weeks; 30 days for files |
Card and bank details go straight to Stripe’s hosted pages and never reach AltQ.
Subprocessors
| Company | What it does for AltQ | What it receives |
|---|---|---|
| Google (Firebase, Google Cloud) | Hosting, database, file storage, sign-in emails, logs | Everything in the table above |
| Stripe | Checkout, subscriptions, invoices, billing portal | The buyer’s email and payment details |
| Cloudflare | DNS for altq.app and forwarding of email sent to support@altq.app | Messages you send us |
| Resend | Sending invitation and access emails, from noreply@mail.altq.app | The recipient’s email address, the inviting person’s name and email address (used as the reply-to address), and the organization and catalog names in the message |
We’ll update this list before adding a subprocessor.
Access control
- Every change and every download is authorized on the server, against the person’s current role or access, for that specific organization and catalog. Changing an id in a request gives no access; automated tests try this across organizations.
- The database and file storage refuse all direct writes from browsers and apps. Published catalogs and documents are never public files.
- Each organization’s people have roles: owner, admin, editor and staff. Staff use the organization’s catalogs on their computer and can’t edit anything.
- Whether an organization’s trial or subscription is current, and whether a computer has a seat, is decided on the server at every check-in. Nothing the browser or desktop sends changes it.
- Installers and updates are signed. Windows shows YouZag, Inc. as the publisher, and the app installs an update only if it is signed with AltQ’s update key. It refuses an older release offered as a newer one.
Account deletion and data requests
Everyone can do both from the web app’s Account page, under Your data:
- Download my data gives a file with what AltQ stores about the person: their account, sign-in methods, organizations and roles, invitations, access, subscriptions, devices, the free trial their address started, the activity entries that name them, and the emails sent to them. Catalogs belong to their organization and are exported from the catalog editor.
- Delete my account deletes the account, its devices (which stop syncing at once and free their seats), access grants, subscription records, invitations, pending emails and uploads. An organization where they are the only member is deleted with its catalogs, after the confirmation names it.
Organizations the person belonged to keep the audit entries that name them for 400 days, as the record of changes to their catalogs. Stripe keeps its own records of past payments, as the law requires. Deleted data can remain in backups for up to 14 weeks before it’s gone for good. See the privacy policy for the full picture.
Reporting a security issue
Email support@altq.app with “Security” in the subject. Please give us a reasonable time to fix an issue before you share it, and don’t access other people’s data while testing. We read every report and will reply.
If we confirm a security incident that affects your organization’s data, we’ll tell your organization’s owners by email promptly, with what happened and what we’re doing about it.
Need a vendor questionnaire filled in? Send it to the same address.