Privacy, in plain language.

QuoteIron is built local-first: your business data — your price book, clients, quotes, and invoices — lives on your device. We designed it that way on purpose. You can open the app and build quotes without an account. Sending a quote or invoice needs a free, lightweight account — an email address with a passkey or an emailed sign-in link, or Sign in with Apple or Google; no password — and it comes with an automatic, encrypted cloud backup we can't read. Details below.

What we don't collect

• Creating an account only gives us your email address, your sign-in credential (a passkey, an emailed sign-in link, or the account identifier Apple or Google gives us when you use their sign-in), and your subscription status — not your clients' names, your prices, or your business documents. Those stay on your device. There are three exceptions, each described below: automatic reminders, invoices you schedule to send automatically, and autopay. For each, we keep only the few details needed to deliver it. That's your customer's email address or mobile number, the amounts on scheduled invoices, and, for autopay, the card details Stripe gives us (never the full card number) and the record of your customer's agreement.
• We never hold your customers' money or see their card numbers. If you're on Pro and connect Stripe, your customer pays on Stripe's own hosted checkout — see Card payments and Autopay below for the payment details that arrangement requires us to keep.

What we do collect

• Website analytics: anonymous, aggregate counts only. Page views are tallied per day, page, referrer domain (or ad-campaign label), and country — never your IP address, device, or any ID that could identify you — and we honor Do-Not-Track. If the page you land on carries a campaign or link tag (for example utm_source, added by whatever linked you there — a search engine, an AI assistant's answer, a newsletter, a text message), we record that tag's source alongside the referrer domain, stripped down to plain lowercase letters/numbers and capped in length; unusual or excessive tags are simply dropped or grouped as "other" rather than stored as typed. We also tally anonymous on-page actions (for example reaching the middle of a page, tapping a download button, or using a price-book table) by day, page and a broad source label such as “ChatGPT”, “Google” or “direct”, with no cookie and no identifier. To tell which source led to an app install, we remember in your browser tab only (cleared when you close it) how you first arrived, and add that broad label to the download links. The label is passed to the Apple App Store or Google Play as a campaign tag and stored with the download-page visit record. It is a general label shared by everyone from that source, never an identifier. Shared estimates and invoices are tracked the same way: how many were viewed, approved, or declined, by day and document kind only, never which document or client. No cookies, no third-party trackers, and no sale of data.
• Abuse and bot protection: to rate-limit abuse and keep automated traffic out of our visit counts, our server briefly holds a hashed form of your IP address in self-deleting storage (gone within a day at most); it is never saved in our visit records.
• Email address: required to create an account — used to sign you in (passkey, emailed sign-in link, or Sign in with Apple or Google) and for support and billing receipts.
• How you found us and how you get on: when you create an account we record a few plain signals about your relationship with the service — never about your work. That's which door you came in (the website or the app), which page or ad brought you and whether it was an ad click (we keep only that it was one, never the tracking value), the language you use the app in (so our emails match it), and a handful of product milestones kept as simple timestamps — when you first made a quote, first sent one, first had one approved, and first subscribed. We use these to make the product and our emails better, nothing else. We never record what's in your quotes, invoices, prices, or clients — your book stays sealed on your device, as always. No cookies or third-party trackers are involved, and none of this is ever sold.
• Automatic reminders to your customers: When you send a quote or invoice with reminders turned on (they're on by default, and you can turn them off for any document), QuoteIron sends your customer a short reminder on your behalf. On the free plan that's one light email: one about a quote that's still open after about three days, and one about an unpaid invoice. Pro adds a fuller email schedule — up to three emails about an open quote, and about one a week about an unpaid invoice until it's paid — plus optional text messages (below). To send them, we store your customer's email address — and, for text reminders, their mobile number — as-is, so the reminder can be delivered, together with the reminder itself (your business name, the document's number and total, and its link), which is stored encrypted. None of it is ever written into our logs. We delete it when the last reminder sends, when a quote is won or declined, when an invoice is paid, when you pause a document's reminders, or when your customer opts out; a reminder that can't go out within 14 days of its planned time is deleted unsent rather than sent late. Because a reminder email carries the document's link, and that link is what unlocks the document, this is the one case where our server holds a document's link: encrypted, used only to put it in the email, and deleted with the reminder.
• Opting out: Every reminder email has a one-tap unsubscribe link, and every text ends "Reply STOP to opt out." When your customer unsubscribes, or replies STOP (or a similar word, such as UNSUBSCRIBE, CANCEL or QUIT), we delete their pending reminders and keep only a one-way, keyed fingerprint of that address or number — never the address or number itself — so they aren't reminded again. An email unsubscribe stops reminder emails from that business; a text STOP stops reminder texts from every business that uses QuoteIron, because they all come from our one number. Replying START lifts a text opt-out. If your customer has autopay with you and replies STOP, CANCEL or a similar word to one of those texts, we also pause their autopay and email them to ask whether they want it stopped too. Nothing is charged automatically until they choose.
• Text-message reminders (Pro): On Pro, you can also have reminders texted to your customer — only to a mobile number you collected from that customer for your quotes and invoices, and only when you turn texts on for that document. Texts come from QuoteIron's own number, on your behalf: each one starts "QuoteIron reminder for" and your business name ("QuoteIron, recordatorio para" in Spanish) and ends "Reply STOP to opt out" ("Responde STOP para cancelar"). They are reminders about that quote or invoice and nothing else — we never send marketing texts. Our messaging carrier, Telnyx, delivers them as our service provider. Mobile numbers and text-message consent are never sold, and never shared with third parties or affiliates for their marketing. Message and data rates may apply. Reply HELP for help, or email [email protected]. The texting program's terms are in our Terms.
• Ad clicks from Google, Facebook, Instagram, Reddit and TikTok: if you reach our download page from a Meta, Reddit or TikTok ad we keep that platform's click identifier alongside that visit the same way we keep Google's, and we may report the app-store hand-off (and, on Android, the app install that follows it) back to that platform from our own server — that click identifier, the address of our page you arrived on, your IP address and your browser's user-agent, and nothing else; we set no Meta, Reddit or TikTok cookie and run no Meta, Reddit or TikTok tracking code on this site, and we never send your email, your name, or anything from your quotes, invoices, prices, or clients. Google is the one exception to the no-third-party-trackers line above: Google's advertising tag already runs on our marketing pages and now also runs on that download page, so tapping the App Store or Google Play badge there sends Google Ads a conversion ping saying a tap happened — joined to your ad click if you arrived from one, and carrying no email, no name, and nothing from your quotes, invoices, prices, or clients; we set no cookie of our own, and Google's tag keeps the ad-click identifier in a first-party cookie in your own browser exactly as it does on every other page here.
• Marketing list (optional, and separate from your account): if you enter your email on the Book Builder to get launch news and pricing tips, that goes on a marketing list kept apart from any app account — neither is ever derived from the other. We use double opt-in: you get a confirmation email and are added only if you click to confirm. Every email carries a one-click unsubscribe link, and unsubscribing takes you off immediately. The list holds your email address and nothing else, and we never sell it.
• Address suggestions: when you type an address into QuoteIron, we send the address text (and, if you allow it, your approximate location) to Apple's Maps service from our servers to suggest matching addresses; this request is not linked to an Apple ID.
• Purchase records: QuoteIron Pro is bought through Apple's App Store or Google Play, which handle the payment — we receive the subscription's status and renewal details from them, never your card number. Their own privacy terms govern your payment data. Subscriptions started earlier through our web checkout are handled by our payment processor, Stripe, on the same terms. (Card payments your own customers make to you are covered under Card payments below.)
• Agreement records: when you accept these Terms, or exercise your right to opt out of arbitration, we keep a timestamped record of that action and the IP address you used, stored encrypted — never your email address or browser/device details in that record — and it survives account deletion, because the law may require proof of what was agreed.

Cloud backup

Creating an account automatically sets up cloud backup: your book is encrypted on your device before it ever leaves it, so what we store is ciphertext we cannot read. Only your passkey or your recovery code — given to you once, at setup — can unlock it; losing all your passkeys and your recovery code means the backup can't be recovered, by you or by us. We can see when a backup happened and how large it is; we can never see your prices, clients, or documents.

Share links

Send a customer a link to an estimate or invoice, and we host an encrypted copy of that one document so the link works — encrypted on your device before it's uploaded, with the key living in the link itself. If you email it yourself, it never reaches us at all. If you use QuoteIron's Send Email button, the link passes through our server just long enough to hand it to your customer's inbox — we don't store it, log it, or open it. We can't read the document either way. (There are two exceptions. While an automatic reminder is scheduled, or while a future invoice is waiting to be sent automatically, our server holds that document's link, encrypted, so the email can carry it. See Automatic reminders and Recurring invoices sent automatically.) The link auto-expires after about 180 days of inactivity, and while we record that it was viewed or approved (so your app can show status), we can't see what's in it.

Recurring invoices sent automatically (Pro)

What happens. If you set a recurring plan to send invoices automatically, your phone writes each upcoming invoice ahead of time and encrypts it on your device, just like any share link. It then hands our server a scheduled send. When the send time comes, our server emails the invoice to your customer, even if your phone is off.

What our server holds until the invoice is sent. For no more than 70 days before the send date, our server holds:

• Your customer's email address or mobile number, stored as-is so the invoice can be delivered.
• A short sealed note, encrypted with a key only our server has. It contains your business name and reply-to email address, the invoice number and total, its due date, its language, the plan's name and one-line summary, and the invoice's link.
• The invoice's amounts, as plain numbers: the number of visits, the price per visit or plan price, the tax rate, and the dates of the visits being billed. We never hold the descriptions or line text. We use these numbers to check that each invoice matches the plan before it's sent, or charged if autopay is on.

What the link means. The link unlocks the invoice, so while a future invoice is waiting, our systems could technically open that one invoice. We don't, and nothing is written to our logs.

When it's deleted.

• The sealed note and the address or number are deleted the moment the invoice is sent.
• They're also deleted when you skip or change that invoice, pause or end the plan, or delete your account.
• An invoice that can't go out within 48 hours of its planned time is not sent late. It's marked failed, and its data is deleted.

Your customer confirms the plan. Automatic sending starts only after your customer taps "Confirm this plan" on the first invoice you send yourself. We record that confirmation: the plan summary they saw, when they tapped, the IP address of the device (stored encrypted), and its browser details. We keep that record for as long as the plan lasts plus four years, even if you delete your account, because the law may require proof that your customer agreed to the plan.

What we keep about the plan and each invoice.

• For the plan: only how it repeats (for example, "monthly on the 4th"), your time zone, how it's delivered, and whether it's active, plus a one-way, keyed fingerprint of your customer's email address, so they can find their stop link at quoteiron.com/stop.
• For each billing period: its internal IDs, amounts, when it was scheduled and sent, and whether it was paid. This lets your app show what went out, and prevents the same invoice going out twice.
• These records never include your customer's name or address, or the invoice's lines. They're deleted when you delete your account, except the plan confirmation described above.

Card payments (Pro)

Pro subscribers can connect their own Stripe account to accept card payments from their customers. When you add a card-payment link to an estimate or invoice, our server stores only the payment metadata needed to create and settle it — your Stripe account ID, the document's ID, the amount, currency, and reference, and the payment's status. We never see the document itself, which stays end-to-end encrypted the same as everywhere else on this page. Your customer's card details are entered on Stripe's own hosted checkout — never typed into QuoteIron, never touching our servers. The business you pay is the merchant of record for these payments. Stripe processes them, on that business's own Stripe account. Stripe's privacy policy governs the payment data Stripe collects. The status your customer sees on their document view shows only paid or unpaid — never the amount. Disconnecting your Stripe account removes the connection.

Stripe also sends us notices about payments, refunds, disputes and fraud warnings on your Stripe account. We keep only the ones tied to payments requested through QuoteIron, and we discard the rest. If a customer disputes one of those payments, or a card network flags it as possible fraud, we record its status, reason, amount and deadline so we can alert you and show it in the app.

Autopay for your customers (Pro)

What it is. If you offer autopay on a recurring plan, your customer can choose to save a card so each invoice is paid automatically. The card is saved on your own Stripe account, and every charge is made on your Stripe account, in your business's name. Your customer enters the card on Stripe's secure page. QuoteIron never sees or stores full card numbers or security codes.

What we keep while autopay is on.

• Your customer's email address: the one you send their invoices to, where they confirm autopay and get every notice. If they type a different email on Stripe's page, we send a copy of the confirmation there and keep only a one-way, keyed fingerprint of that second address.
• The references Stripe gives us for your customer, their saved card and their sign-up on your Stripe account.
• Card details for recognition and evidence: the card brand, the last 4 digits, the expiry month and year, whether it's credit or debit, any wallet used (such as Apple Pay), Stripe's fingerprint for the card, and the results of the card checks Stripe runs. We also note whether the name on the card matches the name your customer typed to sign. The cardholder name itself isn't kept.
• Your statement name as it appears on your customer's card statement.
• The autopay terms your customer agreed to: the exact text and its version, a copy of the page as it was shown, the approved price or rate and tax, the limit, the schedule, your business details, and your refund terms.
• The consent record: when your customer agreed and when they confirmed by email; the IP address (stored encrypted) and browser details of the devices they used; the page language; the name they typed to sign; their notice choice; and their agreement to get notices by email.
• A log of every notice we sent and whether it was delivered or bounced; every charge attempt and its result, including the bank's decline codes; every request to stop, however it was made, and when; and every refund, dispute, fraud warning and complaint about an autopay charge.

Why we keep it. To run autopay; to prevent double charges; to charge only what your customer approved; to send the notices the law requires; to stop charges the moment your customer asks; and to prove what your customer agreed to and was told. We may need that proof for them, for you, for Stripe, for card networks and banks, or for regulators.

Who we share it with.

• Stripe, which processes the payments on your Stripe account. Stripe's privacy policy governs what Stripe collects.
• You, the business. You see the card brand and last 4 digits and the status of each charge. You can export a consent certificate for each customer's agreement at any time, you get an evidence packet if a customer disputes a charge, and the certificates are emailed to you when you delete your account. They include the IP addresses and browser details your customer agreed and confirmed from, because that is the proof card networks ask for.
• Our email and text-message delivery providers, only to deliver messages.
• Card networks, banks, regulators and courts, only through Stripe, when the law requires it, or to answer a dispute or complaint about an autopay charge.

We never sell this information or use it for marketing.

Keeping sign-ups honest. Autopay must be turned on by your customer, on their own device. To check this, we keep a keyed, one-way fingerprint of the IP addresses your QuoteIron app connects from, for 30 days. We compare it only with your customers' autopay sign-ups, and then delete it. It's never used for anything else.

How long we keep autopay records.

• When autopay ends, we remove the saved card from your Stripe account right away, wherever we still have access.
• 30 days after it ends, we remove your customer's email address from the agreement. From then on our records hold only a one-way, keyed fingerprint of it and a masked version (for example, j•••@gmail.com). We never keep invoice contents.
• We keep the evidence record for four years after the autopay agreement ends, even if you delete your QuoteIron account or disconnect Stripe. That's the agreed terms and their version, the page copy, the consent record, the card details above, the Stripe references, and the notice, charge, refund, dispute and stop-request logs. Laws on recurring payments require the business, and possibly us, to be able to prove the customer's consent and cancellation for years afterwards, and card networks and Stripe can ask for that proof long after a charge. If a record is part of an investigation or lawsuit, we keep it until that ends. After four years the record is deleted, including its encrypted IP addresses.

QuickBooks Online sync (Pro)

If you connect your own QuickBooks Online company, QuoteIron can send your customers, invoices and payments to it. It's one way, from QuoteIron to QuickBooks, and only for the records you choose to sync. Sending happens when you tap Sync now, or shortly after you change a record while you're connected.

• What we send to Intuit: your customers' names and the contact details you have for them (email, phone, billing address), the invoices you've issued with their lines and amounts, and the payments you've recorded against those invoices.
• How it travels: each batch is prepared on your device from your own business data and passed through our server to Intuit. We don't keep a copy of those records on our servers.
• What we store: the encrypted connection tokens, your QuickBooks company's ID and name, and, for each synced record, its QuickBooks ID and a one-way fingerprint we use to tell whether it has changed. Tokens are encrypted with a key kept separately from our database. We store no customer, invoice or payment details beyond those IDs and fingerprints.
• Disconnecting: in the app, open Settings → Money → QuickBooks and tap Disconnect. We revoke the connection at Intuit and delete the tokens. You can also remove QuoteIron's access from your Intuit account. Disconnecting stops future updates, and nothing already in QuickBooks is deleted.
• Intuit's terms: once data is in QuickBooks, Intuit's own terms and privacy policy govern it. We don't sell it.

If you're a customer of a business that uses QuoteIron

Who's who. Businesses use QuoteIron to send you estimates, invoices and reminders, and to take payments, including autopay if you turn it on. Your agreement and your payments are with that business. QuoteIron is its software provider, and you aren't a party to QuoteIron's terms. We never hold your money or see your full card number.

What we may have about you. Depending on what the business uses:

• your email address or mobile number, to deliver its documents and reminders;
• an encrypted copy of a document it sent you, which we can't read;
• if you confirm a recurring plan: a record of what you agreed to and when, including your device's IP address (encrypted). See Recurring invoices sent automatically.
• if you turn on autopay: the details below. See Autopay for the full list.

We don't use any of it for marketing, and we never sell it. When you view a document, we count views without recording who you are.

If you turn on autopay. You save your card on Stripe's secure page, and Stripe keeps it on the business's own Stripe account. QuoteIron never sees or stores your full card number or security code. To run autopay we keep:

• your email address, where your agreement, invoices, receipts and autopay notices go;
• your card's brand, last 4 digits and expiry date, whether it's credit or debit, and the references Stripe gives us for your card;
• a record of your agreement: the terms you saw, when you agreed and confirmed, the name you typed to sign, and the IP address (stored encrypted) and browser of the devices you used;
• a log of the notices we sent you, each charge and its result, any refund, and any request to stop.

Why. To charge only what you approved, on the schedule you approved; to send you the notices the law requires; to stop charges the moment you ask; and to prove what you agreed to and were told, if you, the business, Stripe, a bank or a regulator needs that proof. The business sees your card's brand and last 4 digits and each charge's status, and can get the record of your agreement, including those IP addresses, to answer a dispute or keep as proof.

How long. When autopay ends, your card is removed from the business's Stripe account wherever we still have access, and 30 days later your email address is removed from the agreement. After that we keep only a one-way fingerprint of it and a masked version, like j•••@gmail.com. We keep the record of your agreement, the card details above, and the logs for four years after autopay ends, because the law and the card networks require proof of consent and cancellation. Then they're deleted.

Your choices

• Stop autopay or end a plan anytime. Use the "Stop autopay" or "End plan" link in any email about the plan, or on your invoice page. It works instantly. If you've lost the emails, go to quoteiron.com/stop. You can also tell the business by phone, text, email or in person, and any automatic charge made after you told them is refunded in full.
• Stop reminder emails with the unsubscribe link, and stop texts by replying STOP.
• Ask us at [email protected] for a free copy of your agreement and the notices we sent you, or ask us to delete your information. We'll answer within 30 days. We'll delete everything we're not legally required to keep, and tell you what we must keep and why (the four-year autopay evidence record is one example).
• The business has its own records about you, for example in its app and its Stripe account. Contact it directly about those.

quoteiron.com/stop. If you enter your email there, we use it only to look up plans tied to that address and email you their stop links. We don't store the address. We keep a one-way fingerprint of it for up to 24 hours to prevent abuse. The page shows the same message whether or not a plan exists, so nobody can use it to find out whether you're a customer of a business.

Deleting your account and data

You can delete your QuoteIron account yourself, at any time — no request to file, no waiting period:

• In the app: open Settings → Account, tap Delete My Account, and confirm.
• On the web: go to quoteiron.com/account/delete, sign in with the one-time link we email you, and confirm.

Deletion is immediate and permanent, except for the plan-confirmation, autopay evidence and agreement records described below. Your account and sign-in credentials (passkeys, email link, and any Apple or Google sign-in link) are removed, any active subscription bought through our web checkout is canceled (a subscription bought through the App Store or Google Play has to be canceled in that store's subscription settings — deleting your account can't cancel it for you), your encrypted cloud backup and all of its history are erased from our servers, your share links stop working, and any reminders you scheduled are deleted. Deleting your account also cancels every invoice you scheduled to send automatically, erasing their held links and addresses, and ends every autopay agreement your customers have with you. Each of those customers is emailed that autopay has ended, and their saved cards are removed from your Stripe account wherever we still have access. Before deleting, we email you an export of your customers' autopay consent records to keep. A customer's opt-out fingerprint is kept even then, so anyone who opted out stays opted out. Your price book, clients, and documents on your own device are not touched — they're yours to keep or export first, and uninstalling the app removes them. Ad-click identifiers are kept with the visit to our download page, never joined to your account, so there is nothing of yours to delete there. Trouble deleting? Email [email protected] and we'll do it for you.

The records we keep are the plan confirmations and autopay evidence records described in Recurring invoices and Autopay: the minimum needed to prove consent, notices and cancellations. We keep them for four years after each plan or agreement ends, because the law and the card networks require it. They hold no invoice contents and no full email addresses.

Questions

[email protected] · QuoteIron is a product of 20M HODL LLC, St. Petersburg, Florida, USA.