Account & privacy

Your data, your analytics, and how the beta works.

Your account#

The pill at the foot of the dashboard sidebar is your account: your photo or your initials, your name, and your email — or Email not verified if it still needs confirming. Its menu holds everything an account owns.

In Settings, a typed field saves when you leave it or press ⏎; Esc puts back what was saved. Signing out ends the session, but is not a full erasure of browser data. Local document copies and preferences can remain on the device. On a shared device, finish syncing or export work you need, then use the browser's site-data controls to remove Quodra's local data before handing it over.

Your profile#

Settings › Profile is how the people you work with see you. A cloud account has all of it; a local studio has its name and address.

• Photo — a PNG or a JPEG, at least 256 pixels on its shorter side. Quodra keeps its middle square, at 512 pixels, and shows it on your cursor's avatar, your comments, share lists and your account. Remove goes back to your initials on your colour.
• Headline — one line under your name in comments and share lists, up to 90 characters.
• Your colour — your cursor, your selections and the mark on your comments: one of eight. In a deck where someone already has your colour, you take the next free one there.
• Mainly for — Teaching, Research, Studying or Industry. Home puts first the templates and the level of sample that suit it.
• Fields — pick any. Home's samples come from your fields, and their templates and studios come first. A field you picked in the gallery on one device still holds there until you change your fields.
• Institution — where you teach, study or work, filled from your academic verification when there is one.

Your photo, name, headline and colour are shown only to the people you work with: those you share a deck, circuit or molecule with, the members of your workspaces, and anyone commenting on something you can both open. In a document's Share, everyone who has access to it also sees your email address beside your name and your role (who sees whom). A photo is served from an address no one can guess, and a new photo gets a new one. Others see a change within a few minutes; in a deck that is already open, the next time you open it.

Sign-in & security#

Settings › Sign-in & security is how you get into Quodra, where you are signed in, and what to do if something might not have been you. A cloud account has all of it; a local studio has its password.

• Security checkup — a verified address, a way in besides an emailed link (a password, Google or a passkey), and two-step verification: what is done, and what is left.
• Ways to sign in — your password (changing it asks for the current one and signs out every other browser); Google, linked or not, which you can unlink while you have another way in; the sign-in link by email, which you can switch off so no one-time link is sent for your account; and passkeys — Touch ID, Windows Hello or a security key — which you add, rename and remove.
• Two-step verification — after your password or a sign-in link, a six-digit code from an authenticator app (Google Authenticator, 1Password, Authy and the like). Set up shows a QR code to scan and a key to type, and your first code turns it on. You are then shown ten recovery codes, once: each works once in place of a code, for a day without your phone, and Make new codes replaces them all. Turning two-step off asks for your password. Google sign-in keeps Google's own checks, and a passkey is two steps in one, so neither asks for a code.
• Where you're signed in — each browser, by its network rather than its exact address, with when it was last active. Sign out ends one; Sign out everywhere else ends all but this one. A browser leaves the next time its session renews, within fifteen minutes.
• Security activity — sign-ins and how they happened, changes to how you sign in, and the assistants you connected, newest first.

On the sign-in screen, Passkey signs you in with nothing to type. With two-step on, your password (or a sign-in link) leads to a second screen for the code, with Use a recovery code and Start over beneath it.

Cloud accounts and local accounts#

Settings › Profile says which kind of account you have. The hosted beta uses cloud accounts; local accounts are supported in local configurations.

• A cloud account syncs your decks. They follow you to any device you sign in on, and cloud features — sharing, comments, feedback, MCP — are available.
• A local account stores its account and decks in this browser without cloud sync. Loading the application, fetching packages and using optional integrations can still make network requests.
• Signed-out visitors can use the public sample demo, whose temporary edits do not save to a personal library. The full hosted application requires a free account and sign-in.

Your decks#

Everything you make with a cloud account autosaves to your device first and syncs from there, so the library never waits on the network. Revision history keeps the saves you can restore from, and restoring adds a new revision rather than overwriting one — you never lose a version by looking at an older one.

Taking your work with you#

Settings › Privacy & data has two ways to take everything at once:

• Every deck in one file — one JSON file holding every deck, with its pictures inside, which Quodra imports again.
• Everything, as files — each deck as PowerPoint and as PDF, in one .zip. It is made in your browser a deck at a time, so keep the tab open while it works; the line under the button names the deck it is on, and the file downloads when the last one is done. A code cell comes with its code but not what a run drew: export that deck from its own menu, where its cells run, to bring the figures. The files carry the Made with Quodra mark where your plan, or your choice in Settings › Sharing & export, puts it. A deck that can't be made is named, and the rest still come.

Receipts#

Settings › Plan & billing › Receipts lists each payment, with its date, amount and invoice number. Receipt opens the payment provider's PDF. Receipts go to your account's address until you've bought a plan; after that, Billing email can send them elsewhere, such as an accounts office. Both the provider's receipts and Quodra's confirmations go there.

Sharing and access#

• You own the decks you create; only the owner manages who else has access.
• Can edit opens the editor and its comments; Can view opens a read-only slide viewer, where Python does not run. The current deck viewer has no comment controls.
• Revoking someone removes them from both the document and any live session.
• A view link's embed code works unless you switch Allow embedding off in Settings › Sharing & export before making the link; each link keeps the choice it was made with. An embed of a link that doesn't allow one says so, and opens the deck on Quodra instead.
• A deck in a team workspace also follows the workspace's rules, below: its links may ask people to sign in, or be off.

See Collaboration for the full model.

Team workspaces#

On Teams, your own workspace becomes your team's. Settings › General & members is where you run it; a member sees the same page read-only, with you named as its owner, and a way to leave.

• Name and mark — what members see in their workspace menu and what an invitation names: the workspace's name and its two letters on one of eight colours.
• Members — who is in and their role. An editor makes and edits the workspace's decks; a viewer opens them. Change a role from the list.
• Invite people — anyone by address. Someone whose Quodra account has proven that address joins at once. Anyone else gets an invitation by email: its link makes their account with that address, and they join once the address is confirmed. An invitation holds a seat until it's answered and lasts thirty days; Waiting to join lists each one, to Send again (once a minute at most) or Cancel.
• Seats — the members and the invitations waiting share them. When every seat is taken, Change seats adds one.
• Make someone else the owner — hands the workspace to a member who already has a Teams plan with a seat for everyone in it. You stay on as an editor, with a new Personal workspace of your own.
• Close — everyone else leaves and every invitation is cancelled. You choose first whether the decks members made stay here or go back to the people who made them. The workspace stays yours; end Teams in Plan & billing if you no longer need it.
• Leave — for a member: you stop seeing the workspace's other decks and your seat is freed. The decks you made there stay yours, and stay in the workspace too.

Settings › Security & policies holds the workspace's rules. The owner sets them, and each takes effect at once; a member sees them as they apply to them.

• Links to the workspace's decks — anyone with the link, signed-in people only, or no links. A link already shared follows the rule: tightened, it asks people to sign in to a Quodra account with a confirmed address, or stops opening. Embeds on other sites are usually signed out, so signed-in-only links keep most embeds out too.
• Editors can add people from outside — off, only the owner shares one of the workspace's decks with someone who isn't a member.
• Members' assistants may change the workspace's decks — off, an assistant connected with Claude or another MCP client still reads and renders the workspace's decks, but can't change them or make new ones there.
• Audit log — for the owner alone: who added, removed or changed the role of a member, sent or cancelled an invitation, renamed the workspace or changed its rules, and when. Export as CSV saves up to the last thousand entries.
• Single sign-on through your university or organisation's own login is part of Universities & Organizations; Talk to us to set it up.

Notifications#

Settings › Notifications chooses what reaches you, and where: In Quodra is the bell on Home, and each kind can also come by email.

• Your decks — comments on your decks, replies to your comments, changes collaborators make (one note an hour for each deck), and what your assistants changed.
• Sharing — a deck shared with you, someone asking for access to one of yours, and your access changing.
• A workspace you own — someone joining or leaving, and every seat taken.

Email comes as it happens, or in a daily or weekly digest at 08:00 on your clock; replies and requests come straight away either way, and nothing comes in your quiet hours. Anything you have already read in Quodra isn't emailed. Receipts, failed payments and security email always arrive. Your time zone is in Settings › Preferences; it starts as your browser's.

Asking for access — a deck someone sent you that isn't shared with you, or a link its workspace keeps closed, offers Ask for access, with a note if you like. The deck's owner answers in its Share window, and you hear either way. Owners who'd rather not be asked turn Let people ask for access off in Settings › Sharing & export.

What Quodra collects#

Usage analytics, error diagnostics and operational logs have different purposes and controls.

Usage analytics — optional and off by default. Settings › Privacy & data carries the Usage analytics switch. Collection requires both your opt-in and analytics configured for the deployment. When active, PostHog receives a fixed list of events, such as project creation, saving, presentation starts and code-run failures, with identifiers, app version and environment. These events do not include deck content, code or titles. Automatic page capture and session recording are disabled. Turning the switch off stops collection and resets the client.

Error diagnostics — separate from the analytics switch. Sentry receives error reports only when configured for the deployment. Reports are filtered to redact sensitive fields and recognized tokens, email addresses and URLs; they may include an account id, error details, feature flags and technical context. Filtering reduces the data sent but is not a guarantee that arbitrary error text cannot contain sensitive information.

Operational logs support hosting, API reliability and security. They can contain request metadata and error information, independently of optional browser analytics. See the Privacy Policy and Subprocessors for the services involved.

Sending feedback#

Send feedback is in the dashboard sidebar and under Help in the editor's ⋯ menu. You choose a category — Something broke, Suggestion, or I'm stuck — a severity, a one-line summary, and a description. A screenshot of the current screen is attached unless you switch it off.

The report includes what you write, your account association, the release and commit, environment, current application route, an error correlation id when available, and a truncated browser string. An attached screenshot can contain visible slide content or other information on screen. Turn off Attach a screenshot of this screen before sending if you do not want that image included.

Your MCP token#

Settings › Assistants & API, like the Assistants page, provides connection details where supported by your sign-in configuration. A session token lets an external AI tool act with your permissions. Treat it as a password and share it only with a client you trust. See AI assistants (MCP).

New tokens last sets how long the next token you make works: 30 days, or a week for a tool you are trying. A token you already made keeps its own expiry.

The beta#

Quodra is in active beta. Features and availability can change, and failures can occur. Export .quodra.json to keep the Quodra document, or use PDF and PowerPoint with the format limitations in mind. You can delete your account yourself in Settings › Privacy & data, or request account and data deletion at hello@quodra.app; the Privacy Policy explains retention and applicable exceptions. Your acceptance of the beta terms is recorded with its version against your account.

A few consequences worth knowing:

• Feature availability can vary by account and deployment. Canvas requires enablement; Matter Lab, Python and other studios can also be restricted during the beta.
• Invites to people who haven't signed up yet are parked, and unlock once they sign up and confirm their email.
• An admin can pause an account. Your access is paused says so directly, and "Your decks and data are untouched — access can be restored at any time."
• Things change quickly; where a page describes account-specific behaviour, it says so.

Next#

• Introduction — back to the start.
• The dashboard — where accounts, settings, and decks meet.
• Your first deck — build something.