Privacy
What happens to your data
Where your work is kept
This changed in September 2026. Until then nothing you priced ever left your browser. Now, when you are signed in, your work is copied to your account as well — which is what lets you open the same job on another computer, and what stops a cleared browser taking your estimates with it.
- Signed in — jobs, estimates and the lines in them, your clients' names and addresses, the measurements you take off a plan, supplier price lists, your business details and site diary, and since October 2026 your purchase orders, progress claims, recorded costs, change orders and schedules, are stored on our servers as well as in your browser.
- Not signed in — nothing is uploaded. A trial lives in one browser, and clearing that browser's data deletes it permanently.
- Drawings too, up to 25 MB a plan. Open a job on another machine and the plan comes down with it. A plan larger than that stays on the computer that opened it, and Quote60 says so when you add it rather than failing quietly later. One drawing is kept per job: adding a new one replaces the old.
- Each signed-in account keeps its own separate set in the browser, so two people sharing a computer do not see each other's work.
- When the same estimate is changed on two machines, both versions are kept and you are asked which one should stand. Nothing is overwritten without you choosing it. Orders, claims, costs and schedules changed on two machines are combined: each order, claim, cost or task changed on one machine keeps that change, and where both changed the same detail the later edit stands.
What we do hold
Who you are, what you pay for, how much of the AI allowance you have used, and — since September 2026 — the work itself for anyone signed in.
- Your work — jobs, estimates and every line in them, your clients' names and addresses, the measurements taken off a plan, suppliers and their price lists, purchase orders, progress claims, job costs, change orders, schedules and site diaries. Stored so you can reach it from more than one machine. We can technically read it; we do not, other than when you ask us to look at something and tell us so.
- Work you deleted — deleting a job hides it and stops it syncing. The record is kept for 90 days so a deletion made by mistake can be undone, and is then destroyed automatically along with its measurements and, when drawings sync, the plan itself. Ask us sooner and we will destroy it sooner.
- Account — your user id from our sign-in provider, your email address, your customer id from our payment processor, and the dates the record was created and changed.
- Subscription — which plan, its status, whether it is set to cancel, and when the current period ends. This mirrors the payment processor; it is not a second opinion.
- Usage — a count of AI actions per feature per billing period, so an allowance can be enforced and an unexpected bill can be explained.
- Usage log — one row per AI call recording which feature, which model, how many tokens, and whether it succeeded. It records no prompt and no estimate content.
What we never see
- Your card number. It goes from your browser to the payment processor; it does not pass through this site.
- Your password. Our sign-in provider holds it; we receive only a signed token saying you are who you say you are.
- The inside of your drawings. A plan is stored as the file you gave us and handed back the same way; nothing here opens it, reads it or looks at what is on it.
Who else handles your information
Six companies process data on our behalf.
- Clerk — sign-in and passwords. Holds your email address and sends verification and password-reset mail.
- Stripe — payments. Holds your name, email, billing address, card details and invoice history.
- Cloudflare — hosting and the database. Serves every page, and stores the work described above. Keeps standard server logs, which include IP addresses.
- Resend — the email this site sends itself: an invitation when you add someone to your team, a notice to us when you ask for a demo, and your subscription confirmation. It receives the address the message is going to and the message itself. Verification and password-reset mail comes from Clerk instead.
- Contentsquare (which owns Hotjar) — session replay and heatmaps. Records how pages are used: which pages you visit, where you click and scroll, and what the screen showed, so we can see where the site is confusing or broken. It never receives what you type into a form field, and email addresses and card numbers on the page are blanked out before anything is sent. Inside the app — your jobs, estimates, orders, claims, costs and schedules — all the text on screen is blanked too, so your clients' names, addresses and prices are never recorded. Signed-in sessions are labelled with an account number, not your name or email.
- Anthropic — the AI behind Chalk. What goes depends on which part you ask for,
and nothing goes unless you press the button.
- Checking an estimate sends the lines of that estimate: descriptions, quantities, units and rates, plus the job name and whether it is priced in imperial or metric.
- Drafting an estimate or an assembly sends what you typed or answered (for an estimate, your answers to the scope questions), plus the floor area and unit system of the job. If you add sketches or photos to a draft, they go too. A photo can show the inside of your client's home, and a page of plans usually carries the site address, so pictures are sent only after you agree, the first time, per job. If you add none, no picture ever leaves your browser.
- Reading a drawing sends the sheet itself — the image of the page you are looking at. A drawing usually carries the site address and often the client's name and the architect's, so this is one of the two places where more than line items leaves. You are asked to agree the first time, per job, and told plainly what is being sent. If you never press it, no drawing ever leaves your browser.
- Live chat on this site sends the messages you type into it, and the conversation so far, so Chalk can answer. We do not store what you write; we keep a count of messages against a scrambled form of your connection's address, to stop one visitor using it all.
Cookies and similar
No advertising cookies. Contentsquare sets analytics cookies to tie the pages of one visit together for session replay and heatmaps, as described above. Our sign-in provider sets what it needs to keep you signed in. Where you first arrived from — a search, an ad, a social media post or another link — is kept in your browser for up to 30 days and, if you create an account, stored with it, so we can tell which channels bring builders to Quote60. It is never used to show you ads.
The mobile check for a free trial
The free trial is one per business. To start one, the account owner gets a 6-digit code by text from our sign-in provider, Clerk. Once the code is entered we keep only a scrambled code made from the number (a one-way hash), so a second trial on the same number can be recognized — the number itself is then removed from the account. The browser also keeps a random id, in a cookie and its local storage, so a second trial from the same computer can be recognized too. Neither is used for marketing, and we never text ads.
We send what an account requires: verification, password resets, receipts and notices about your subscription. Getting-started emails are separate, are opt-in at sign-up, and can be stopped without affecting the account.
If you ask for a demo
The form on the contact page sends us your name, business, email, phone, the trade you picked and whatever you write in the message. It is stored on our server as well as emailed to us — if the email fails, the request is still there and you are not quietly ignored, which is what used to happen.
The network address you send it from is recorded only as a one-way hash, so the form can recognize repeat submissions without us keeping the address itself. You do not need an account to use the form and asking for a demo does not create one.
Write to hello@quote60.com and we will delete the request.
Getting a copy, or getting it deleted
Most of your data is already on your machine and is yours to export or delete. For what we hold, write to hello@quote60.com and we will send a copy or delete it. Deleting an account removes the account, subscription and usage records; the payment processor keeps invoices for the period the law requires.
Shared computers
Because your work is stored in the browser, signing out does not erase it — it hides it behind your account. On a machine other people use, that is worth knowing.
Who to contact
Quote60. hello@quote60.com · +1 631 784 3330