Privacy at FirmQuote
FirmQuote is a course prototype. Do not put sensitive client information in a quote.
What is stored
Quotes store the client and project names, brief, deliverables, exclusions, optional pages/forms/CMS/timeline details, optional GST particulars you enter (business name and address, GSTINs, SAC code and tax rate), an optional advance amount, payment link and (India only) UPI ID, and whether you marked the advance or change-order payments received, price, revisions, responses (including the name a client types to accept) and dated history in a Turso database. If you add a client email, it is stored with the quote and used only to send that client a one-time approval code through our email provider (Resend); the client page shows it masked. To limit abuse, a hashed form of your IP address is kept for up to a day when you create a quote. The private editor key is stored with the quote; after opening an editor link, the browser keeps it in a 30-day HttpOnly cookie. Keep the original editor link safe for access on another device. A client link exposes the quote to anyone who has that link.
Campaign labels
We keep only approved source, medium and campaign labels from the first tagged link in your browser tab, using session storage until the tab closes. When you create a quote, those labels are saved separately to count which channels lead to quotes. We do not store full URLs, referrers, client details or a device identifier for attribution. The free calculators and email templates run in your browser; their inputs are not uploaded or stored.
Who can act
Anyone with a client link can read and respond to that quote. The app does not verify client identity. Anyone with the private editor link can edit an unaccepted quote. Do not send that editor link to clients.
Current limits
This prototype does not offer an account. From the private tracker, an editor-link holder can download the quote, its history and change orders as JSON. An editor-link holder can permanently delete that quote and its history from the tracker. Its approval record is not a legal signature or proof of identity. Avoid real-client use until access and deletion controls are added.