Privacy Policy

What we collect

When you create an account we store your email address and, if you sign in with Google, your name and profile picture. We use them to run your account and to send service emails (sign-in links, receipts and a short three-email setup series).

When you use the product we store what you enter: your rate card, company name, logo, phone, email and website, and the quotes you save, including the client name, email and address you type into a quote. Your clients' details are only used to show and send that quote; we do not contact your clients.

Using the calculator without an account does not require you to give us any personal information.

Shared quote links

A quote you share by link can be opened by anyone who has the link. The link is a long random address and is not listed anywhere, but you should treat it like the quote itself.

Payments

Payments are processed by Stripe. We do not see or store your card number. We keep your Stripe customer and subscription IDs to manage your plan.

Cookies and analytics

We use a cookie to keep you signed in. To understand how the site is used we run a self-hosted Umami instance and PostHog product analytics, and Sentry to catch errors. PostHog may record how pages are used, with text and form fields masked, and for signed-in users it links activity to an internal account ID and plan, never to your email address. We do not use advertising networks or sell data.

• authjs.session-token (with a __Secure- prefix on the live site): keeps you signed in. HttpOnly, 30 days without activity.
• authjs.csrf-token, authjs.callback-url: protect the sign-in form and remember the page to return to. Lasts until you close the browser.
• farm_cohort_ref: set only when you arrive from one of our own campaign links, to record which campaign. HttpOnly, 30 days.
• PostHog stores its own identifier in a cookie or local storage entry (up to one year). Umami sets no cookie.

How long we keep data

• Account, rate card, company details and saved quotes: until you ask us to delete them.
• Event log (sign-ins, payments, email delivery, saved quotes): deleted after 400 days. It holds your internal account ID, never your email address or IP address.
• Server logs: kept for 90 days. They hold the page path, status and a one-way hash of the IP address that changes every day, so visits can be grouped within a day but the address cannot be recovered.
• Backups of our database: kept for 60 days.
• Sentry (error reports) and PostHog (product analytics and page recordings) keep data for the period set in our plan with each provider; Umami data stays on our own server.

Other services that process data for us

• Google, for sign-in with Google
• Resend, to deliver email
• Hetzner, which hosts the service and its database

Security

Data in transit is encrypted with HTTPS/TLS. Sign-in uses secure, httpOnly session cookies, and each account can only open its own quotes and settings.

Your rights

You can ask for a copy of your data or for your account and everything saved in it to be deleted at any time by emailing [email protected]. We reply within a few business days.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with an updated date.

Contact

Questions about this policy? Email [email protected].