Does Q-Link save or record voice calls and video calls?

No. Q-Link voice and video calls operate strictly over a sovereign Peer-to-Peer (P2P) WebRTC mesh with DTLS-SRTP 256-bit encryption. Zero audio bytes, zero video feeds, zero call recordings, and zero communication logs are saved on servers. Media streams flow directly device-to-device with true zero data retention.

Can you send unlimited large files on Q-Link without server storage?

Yes. Q-Link provides unlimited direct device-to-device P2P file transfers (including 10 GB, 50 GB or larger) via WebRTC DataChannels. Zero file data is saved on Q-Link servers. The file remains on the sender's local hardware and streams directly to the receiver's device with zero cloud storage fees or artificial compression.

How does Q-Link compare to WhatsApp and Big Tech platforms for calling and file sharing?

Unlike WhatsApp and corporate platforms that mandate phone number verification, log user metadata (call times, durations, IP graphs), cap file sizes at 2 GB, and route calls through centralized corporate SFU relays, Q-Link requires zero phone numbers (KYC-free Quantum IDs), stores zero bytes of call data on servers, and supports unlimited direct P2P file sending without centralized cloud storage.

🛡️ Architectural Charter

Privacy & Technical Sovereignty Protocol

An exhaustive technical autopsy of Big Tech surveillance capitalism, deceptive corporate legal loopholes, and behavioral manipulation — contrasted with Q-Link’s mathematical zero-knowledge web architecture.

0 Phone Numbers

Eliminates SIM-swaps & carrier wiretaps

0 Plaintext Bits

Client-side WebCrypto AES-256 encryption

0 Ad Trackers

W3C sandbox physically isolates hardware

01Clause 01

The Surveillance Capitalism Autopsy: How Big Tech Spies & Manipulates

A forensic breakdown of keystroke logging, behavioral micro-telemetry, ultrasonic beacons, and unposted draft harvesting.

Modern commercial surveillance is no longer about cookies or banner ads. It has evolved into a real-time neurological extraction apparatus pioneered by legacy tech giants (Meta, ByteDance, Google, X). To understand why Q-Link is engineered as a zero-knowledge Web App, one must first confront the clandestine telemetry vectors embedded in mainstream consumer platforms:

1.1 Keystroke Telemetry & Unposted Draft Harvesting

Mainstream platforms record text you type into input boxes even if you never click Send or Post (academically documented as "Self-Censorship Profiling"). Every backspace, hesitance, and deleted draft is timestamped to evaluate emotional volatility, impulsivity, and vulnerability.

1.2 Micro-Biometric & Motion Telemetry

Native apps poll your gyroscope, accelerometer, and touch pressure at up to 120Hz. Correlating scroll velocity and finger tremor allows neural networks to infer whether a user is fatigued, intoxicated, anxious, or depressive, timing targeted dopamine triggers accordingly.

1.3 Ultrasonic Cross-Device Audio Beacons (uBeacons)

Commercials and websites broadcast inaudible high-frequency acoustic signals (18kHz–22kHz). Native apps with background microphone permissions listen for these ultrasonic beacons to link your phone to household televisions and smart speakers without your awareness.

1.4 Relational Shadow Profiling

When a user grants "Address Book Access", platforms harvest the contacts of people who never signed up. Intersectional graph theory builds exhaustive shadow profiles for individuals who deliberately refused to register.

⚡ The Q-Link Architectural Defense

Q-Link operates strictly as a W3C Sandboxed Web App. Web browsers physically prohibit websites from reading contacts, polling background accelerometers, listening to inaudible background audio, or accessing local disk files. Unposted draft state exists exclusively inside local component memory.

02Clause 02

Corporate Legal Loopholes & The Illusion of Consent

How corporate policies exploit Legitimate Interest, Data Clean Rooms, and unilateral TOS amendments to sell data legally.

When a Silicon Valley corporation claims "We never sell your personal data," they rely on sophisticated legal loopholes and contractual sleight of hand:

2.1 The "Legitimate Interest" Loophole (GDPR Article 6(1)(f))Loophole

Under EU regulations, data processing requires consent. However, corporations classify behavioral tracking and ad telemetry as "Legitimate Operations" or "Fraud Prevention," bypassing opt-in mandates and burying opt-outs behind convoluted multi-step menus.

2.2 "Data Clean Rooms" & Pseudonymous Cashless ArbitrageDeception

Corporations technically do not exchange raw names for physical currency. Instead, they hash personal identifiers (SHA-256(email)) and pool them into corporate "Data Clean Rooms" with brokers (LiveRamp, Acxiom). Advertisers bid on matched synthetic segments, achieving identical surveillance outcomes while technically circumventing the legal definition of a "data sale."

2.3 Forced Binding Arbitration & Class Action WaiversDisenfranchisement

Virtually all consumer tech agreements force users into confidential private arbitration, forbidding collective court lawsuits. When a company experiences a catastrophic data breach, individual arbitration costs make legal recourse economically impossible.

03Clause 03

Q-Link Cryptographic Architecture: Mathematical Immunity

Client-side WebCrypto API execution, ephemeral ciphertext routing, and zero plaintext server visibility.

Q-Link rejects corporate verbal promises. We replace corporate trust with mathematical impossibility. Our communication protocol is engineered so that even if Q-Link servers are seized or compromised, plaintext conversations cannot be reconstructed:

Layer 1: Key Custody

WebCrypto API Sandbox

All cryptographic keys (Elliptic Curve ECDH / P-256 / AES-256-GCM) are minted strictly inside the user's browser runtime (window.crypto.subtle). Private keys are held in hardware-isolated browser storage and are mathematically incapable of being transmitted to Q-Link infrastructure.

Layer 2: Wire Transit

Blind Ciphertext Pipe

Encryption completes before the network payload leaves the local machine. Q-Link relays and PostgreSQL databases act as blind ciphertext conduits; they record only encrypted byte streams and pseudonymous routing identifiers.

Layer 3: Delivery Acks

W3C WebPush Protocol

Push notifications utilize standardized W3C WebPush APIs via Service Workers. The notification payload contains no plaintext message preview, and the Service Worker immediately signals a hardware delivery acknowledgment (status: DELIVERED) without running persistent background tracking daemons.

04Clause 04

Data Minimization: What We Store vs. What Is Impossible to Store

Complete transparency into database schemas: pseudonymous handles, public keys, and cryptographic hashes.

✓ Exactly What Q-Link Infrastructure Stores

•Quantum Handle & Display Name: User-chosen string identifier (@handle).
•Public Cryptographic Key: Exportable public curve string (publicKeyString) used by peers to encrypt outbound payloads.
•Encrypted Transit Buffer: Ciphertext payloads held in storage until delivery acknowledgment is received.
•Node Gamification Metrics: Public Aura percentage score, badges, and points allocation.

✕ What Q-Link CANNOT Physically Store or Harvest

•Private Cryptographic Keys: Never transmitted across the network under any circumstance.
•Plaintext Message Contents: Servers possess zero decryption keys or backdoors.
•Address Books / Contact Scraping: Impossible under browser security sandbox restrictions.
•Physical GPS Geolocation: No location tracking APIs, cellular triangulation, or IP telemetry logs.

05Clause 05

Algorithmic Manipulation & Behavioral Profiling Immunity

Zero AI sentiment extraction, zero variable-ratio dopamine feed scheduling, and sovereign chronological feeds.

Mainstream social platforms utilize artificial intelligence not to assist users, but to maximize session dwell time using Skinner-box psychological conditioning:

5.1 Rejection of Variable-Ratio Reward Algorithms

Q-Link does not employ machine learning recommendation engines designed to hijack human dopamine pathways. The Global Directory displays items in transparent chronological or tier-authenticated order.

5.2 Zero Sentiment Analysis & Natural Language Processing

Because communication payloads are encrypted client-side with AES-256-GCM, our infrastructure is incapable of running Large Language Models (LLMs) or sentiment analysis algorithms over your private conversations.

06Clause 06

Terms of Protocol & Node Operator Etiquette

Decentralized communication rights, zero tolerance for exploitation, and Upstash rate limiting governance.

6.1 Autonomous Identity Sovereignty

You are solely responsible for safeguarding your browser session and cryptographic private key. Q-Link personnel will never request your private key, password, or security credentials. If you clear your browser storage without backup, your identity cannot be restored by administrators.

6.2 Zero-Tolerance Prohibited Conduct

The network strictly prohibits: (a) dissemination of Child Sexual Abuse Material (CSAM); (b) violent extremist terror mobilization; (c) distribution of malware, ransomware, or distributed denial of service (DDoS) command payloads; (d) automated credential harvesting or unauthorized scraping botnets. Violation results in immediate, permanent cryptographic node ban.

6.3 Distributed Rate-Limiting & Fair Use

To prevent network exhaustion, Q-Link enforces cryptographic token-bucket rate limits governed by Upstash Redis clusters. High-frequency automated spamming or beacon abuse triggers automatic temporary throttling at the network edge.

07Clause 07

The 'Nuclear Purge' Protocol: The Absolute Right to Disappear

Atomic zero-retention cascading hard deletes. When you destroy your account, every byte is permanently wiped.

Unlike traditional social media networks that maintain "soft-deleted" records in backup archives for 90 to 180 days, Q-Link implements the Nuclear Purge Protocol:

⚡ 1-Click Complete Erasure Pipeline

Database Cascade: PostgreSQL triggers an atomic hard-delete cascade across all user records, sessions, push subscriptions, and message buffers.
Media Expungement: Uploaded attachments and 24-hour ephemeral posts are immediately deleted from storage buckets.
Local Sandbox Scrubber: The browser executes an automatic wipe of IndexedDB cryptographic keyrings and LocalStorage identifiers.

Result: Zero residue. No shadow profiles, no archived metadata, no recovery backdoors.

08Clause 08

Warrant Canary & Subpoena Mathematics

Mathematical impossibility of compliance with unlawful surveillance orders. Active warrant canary statement.

🛡️ Official Cryptographic Warrant Canary

As of the current protocol epoch, Q-Link has received ZERO (0) National Security Letters, secret FISA court orders, or governmental interception directives. Q-Link has never installed a master decryption key, law enforcement backdoor, or silent surveillance tap within its codebase.

Because Q-Link operates on client-side zero-knowledge encryption, any legal subpoena compelling us to decrypt user communications will receive the only technically accurate response: "We do not possess the cryptographic keys. Decryption is mathematically impossible."

09Clause 09

International Regulatory Compliance (GDPR & CCPA by Design)

Full structural compliance with European Union GDPR, California CCPA/CPRA, and international data frameworks.

European Union GDPR (Regulation 2016/679)

• Art. 15 (Access): Full access to all raw stored records via ID Console.
• Art. 17 (Right to Erasure): Instantaneous hard-purge with zero delays.
• Art. 25 (Privacy by Design): Client-side cryptographic isolation by default.

California Consumer Privacy Act (CCPA / CPRA)

• Zero Sale of Data: No commercial transactions involving user telemetry.
• Zero Cross-Context Ads: No behavioral tracking or retargeting pixels.
• Non-Discrimination: Complete protocol functionality without paywalling privacy.

10Clause 10

Protocol Verification & Official Legal Coordinates

Cryptographic commit logging, reproducible web builds, and official legal contact channels.

The ultimate test of a security architecture is transparent reproducibility. All platform updates, cryptographic handlers, and Service Worker scripts are tracked within authenticated public Git repositories.

Official Protocol Contact Coordinates:

• Security & Vulnerability Disclosures: security@qlink.chat

• Legal & Regulatory Affairs: legal@qlink.chat

• Official Network Status: All Nodes Operational (0 Telemetry Relays)

Document Version: Q-LINK-CHARTER-v3.0.4 • Cryptographically Validated • Last Re-anchored: September 2026