Privacy Policy

On your device first: QuoteMaster is a mobile app. Your clients, quotes, invoices, jobs and figures are stored on your phone, in a database on that device, and work there with no internet connection at all.

End-to-end encrypted when it leaves: Backups and team synchronisation pass through our servers, but the contents are encrypted on your device before they are sent, with a key we never receive. We hold the file; we cannot read what is in it. A quote you share by link is encrypted too, described under Your Customers' Data.

What we can actually see: The account details you give us: your email address, your subscription status, and the technical records needed to run the service, such as when a device last synchronised and how much AI usage an account has had. If you take card payments through us, we also hold the payment record that matches a payment to your invoice (the invoice reference, amount, status and the paying customer's email address). If you use text messages sent through us, we see the phone number and text of each message. If you send us feedback, we read it. If you switch on "Share anonymous assistant totals" in Settings, we also receive a set of totals for the last 30 days, held against your account (see The AI assistant). That is the whole list, apart from the enquiry email and online acceptance links described under Your Customers' Data.

What we never do: We do not sell, rent or trade your data or your customers' data, and we do not use it to train AI models. Anthropic, who provides the AI model, states that it does not train its models on data sent through its commercial API. We do not build a profile of you for advertising.

These are Android permissions on your own phone, asked for when a feature first needs them. The rest of the app works if you decline, and you can withdraw any of them later in your phone's settings.

Camera: The app opens your phone's own camera app to photograph receipts and job photos that you choose to take, so it does not hold a camera permission itself. The images stay on your device unless you back them up or share them, or you use the assistant to read a receipt or turn a photo into a materials list. In that case the image is sent to Anthropic as it is: photos are not masked, so do not photograph anything you would not want read.

Storage: To save the documents the app produces so you can share or print them.

Location (optional): Only if you use route planning, to work out the order of the day's jobs from where you are. It is not tracked or recorded. The app also declares the NFC permission for Tap to Pay, a way to take a card payment by tapping the customer's card on your phone. Tap to Pay is not available yet and nothing uses NFC in this release. When it is released, Stripe's software will read the card, and card details will go to Stripe and never reach us.

Microphone (optional): Only if you use dictation. Where your phone can recognise speech on the device, the audio does not leave it. On other phones Android sends the audio to the phone's speech service, which is Google's on most Android phones, to turn it into text. QuoteMaster does not record or keep the audio.

Notifications (optional): Only if you turn reminders on, so the app can remind you about a job tomorrow or an invoice going overdue. The reminders are worked out on your device; their contents never leave it. Separately, you can switch on alerts for things that happen on our side, such as a new enquiry, a quote being opened or accepted, or a payment arriving. Those are sent through Google's Firebase Cloud Messaging: Google sees an anonymous device token and a generic message such as "Payment received", never a customer's name, address or an amount. You can turn each alert off in the app's notification settings.

The names, addresses and phone numbers in your app belong to your customers. In data protection terms you are the controller of that information and we are a processor acting on your instructions: you decide what goes in. Backups, team syncs and quotes shared by link reach us in a form we cannot read. Quotes shared from older versions of the app, before links were encrypted, are held readable until they expire plus 7 days. Enquiries arriving from your public enquiry page are the other exception, described below.

The AI assistant: Where the assistant works on text, the app masks on your device, before anything is sent, the names, addresses, phone numbers and email addresses of the customers already in your app, and any email address, UK phone number or postcode it recognises by its shape. A name that is not in your app can get through, so do not type into the assistant what you would not want Anthropic to read. The request then goes to Anthropic. Photos are the exception: they are sent as they are. Anthropic states that it does not train its models on commercial API data, and may keep a request for up to 30 days. We keep a record of how much you used, not what you asked. Separately, and off unless you turn it on in Settings, the app can send us totals only: how many replies, how many failed, the average reply time, thumbs up and down, and how many actions you confirmed, edited or declined. They contain no messages, notes, names, amounts or photos, we use them to see whether the assistant is working, and switching the option off stops further sends. If you add your own Anthropic key, requests go from your phone straight to Anthropic and do not pass through us.

Email enquiries: If you forward customer enquiries into the app, that email passes through our mail providers and is held briefly until your phone collects it, then removed from our side. The same goes for an enquiry typed into your public enquiry page: the sender's name and email address are held with it, and the message is encrypted on our server until your phone collects it. This is the one place our server holds the key, because the message arrives from the open web and not from your phone. That page uses Cloudflare Turnstile to check that a person is filling it in, which sees the visitor's IP address and browser details.

Online acceptance links: If you send a customer an online acceptance link, the quote (your business name, the customer's name, the line items and prices) is encrypted on your device before it is uploaded. The key is in the part of the link after the # sign, which browsers do not send to us, so our server holds only a copy it cannot read. We see the quote's shape (how many lines it has and which are optional, but no names or amounts) so we can check the customer's choices. Anyone who has the full link can open the quote, so send it only to the person it is for. You can switch the link off at any time. The encrypted copy is kept until the link expires plus 7 days, then deleted. When the customer accepts, their name, signature and choices are encrypted in their browser with the same key and passed to you. We record when the link was opened and accepted, and the customer's IP address and browser, and pass these to you as a record of the acceptance.

Your responsibility: You are responsible for having a lawful basis for the customer information you store, and for answering your own customers if they ask what you hold about them. The app can export their records so you can.

End-to-end encryption: Backups and team synchronisation are encrypted on your device before they leave it. The key is derived on your device and is not sent to us, so a backup we hold is unreadable to us and to anyone who obtained it from us.

Account security: Passwords are stored only as salted bcrypt hashes, never in a readable form. Sessions use signed tokens. All traffic between the app and our servers is over HTTPS.

On the device: The app's data sits in your phone's private app storage, which other apps cannot read, and you can add a biometric lock in Settings.

Honest limits: No system is perfect. If we ever became aware of a breach affecting your personal data we would tell you and the ICO without undue delay, as the law requires.

See and export your data: Everything in the app is readable in the app, and quotes, invoices and records can be exported at any time.

Data ownership: You retain full ownership and control of all data created and managed through QuoteMaster.

Account deletion: You can delete your account and the encrypted backups we hold for it on our delete account page, or ask us to do it if you cannot sign in. Deleting the app alone does not remove the backup, so use that page if you want it gone.

Crash reports: They are on by default. In the app, go to Settings, then Diagnostics, and switch off "Send crash reports". Nothing is sent after that and any report still waiting on your phone is deleted.

Correction and objection: You can correct your account details at any time, and you can ask us to restrict or stop processing them, understanding that we may then be unable to provide the service.

GDPR and the UK GDPR: For the limited personal data we hold about you, meaning your email and subscription, we rely on the contract between us as the lawful basis. You have the right to complain to the Information Commissioner's Office if you think we have handled it badly.

While you are a customer: Your encrypted backup is kept so you can restore it to a new phone, and is replaced as newer backups arrive.

After you leave: Account records are kept while a subscription or a legal obligation requires it, such as the records we must keep for tax, and encrypted backups are removed on request or when the account is deleted. Stripe keeps its own payment records, as the law requires of it.

Crash reports: When the app crashes or hits an unexpected error it sends us a short report: the error text, the app version and the phone's system type. Before it leaves the phone, names, addresses, phone numbers, emails, amounts and any quoted text are removed, and it holds no customer records. If you are signed in the report is tied to your account. We use reports only to find and fix faults. We keep them for 90 days, and they are deleted straight away if you delete your account.

Enquiry email: Held only until your device collects it.

Deletion: In the app or on the delete account page it takes effect straight away. If you ask us by email, we finish within 30 days.

Your customers' details stay on your phone unless you share a quote by link or use a feature that needs them, such as an email or text sent through us. Their names, addresses and phone numbers are encrypted on your device before a backup or a team sync is sent, with a key we never receive. Wherever our servers happen to be, what sits on them is a file we cannot open. A quote you share by link is held as a copy we cannot read, as described above.

Our servers are in the United States. The account details we can read, meaning your email address, your subscription status and the technical records needed to run the service, are held on servers in Oregon, and our email, payment, AI and security providers operate internationally.

How that transfer is covered. Sending personal data out of the UK is only lawful with proper safeguards. Our hosting provider is certified under the UK Extension to the EU-US Data Privacy Framework, and our providers' data processing terms also carry the UK Addendum to the standard contractual clauses, which applies if that framework ever ceases to be available.

Each of these has its own privacy policy, and each sees only what it needs to do its job. The data processing page lists them all with what each receives and where.

Stripe: Subscription payments and AI credit purchases, and, if you enable it, card payments from your own customers. Card details go straight to Stripe and never reach us.

Anthropic: The AI assistant, with the customers in your app and any email address, UK phone number or postcode masked on your device first. Photos are sent as they are.

Postmark and Brevo: Email in and out, for enquiries and replies.

Google (Firebase Cloud Messaging): Delivers the alerts you switch on. It sees an anonymous device token and a generic title, never customer details. Google's speech recogniser on your phone also handles dictation, if you use it.

Cloudflare Turnstile: Checks that a person is filling in an enquiry form on a page you share.

Your own email account (Google or Microsoft): Only if you connect one, so that email can be sent as you.

The SMS Works: Sends text messages you ask us to send through the app. It receives the phone number, the text and your business name as the sender. Its own technical overview says its servers run on Amazon Web Services in the UK and that its data stays in the UK, and its terms make it our processor, acting only on instructions. It also offers an optional AI feature that would pass message text to OpenAI in the United States, which QuoteMaster does not use. By its published default it archives delivery records after 90 days and holds them 7 years unless asked to delete them.

ntfy: A notification service that alerts our team when feedback arrives. It receives only a content-free "new feedback" alert, with no personal data: not your account email address and none of your feedback, and only if you send feedback. It is run by ntfy LLC, a United States company, and does not publish where its servers are. Its privacy policy says messages are kept for 12 hours and then deleted, and that IP addresses are used to limit abuse. We have not found a data processing agreement or a transfer safeguard from ntfy, so the safeguards described above are not confirmed for it.

Services your phone calls directly: postcodes.io and OpenStreetMap Nominatim (a client postcode, to fill in an address), Open-Meteo (a place, for weather), WhatsApp (only when you tap a link to send a message there), and Google Fonts and jsDelivr (which receive your phone's IP address when the app opens, to load fonts and icons).

Render: Hosting for our servers, in the United States (Oregon). Certified under the UK Extension to the EU-US Data Privacy Framework.

Cloudflare: Sits in front of our servers to keep the service up and block attacks. It handles the encrypted connection, so it passes your requests through, and serves from whichever of its locations is nearest you.

Google Play: Distribution of the app itself. QuoteMaster is not created by, affiliated with, or supported by Google LLC.