Privacy Policy

QuarryFi is operated by Smashed Studios LLC, a California limited liability company. This policy explains what information we collect, how we use it, and the choices available to you. QuarryFi is designed to collect development and tax-support metadata, not source code, file contents, private messages, or payment card numbers.

The account Service is offered only to businesses organized and principally operating in the 50 states or District of Columbia for US federal R&D support. Public educational pages remain globally readable, but QuarryFi does not direct ads, account offers, activation, or checkout to people or businesses outside the supported US territory.

• Source code, code diffs, or file contents.
• AI conversation transcripts, prompts, or assistant responses from your editor.
• Screenshots, screen recordings, browsing history, or non-development personal files.
• Keystroke contents. Plugins send session/activity metadata only.
• Full payment card numbers, bank account credentials, Social Security numbers, or government IDs.

• Authenticate users, manage sessions, enforce admin access, and secure API routes.
• Connect authorized repositories and editor plugins to project and team-member records.
• Classify activity against R&D tax-credit criteria and generate support narratives.
• Calculate planning estimates for wage, contractor, owner, and R&E expense support.
• Run export readiness checks and generate supporting documents for your review and your tax professional.
• Resolve one effective QuarryFi plan across Stripe and supported marketplace billing providers and provide account support.
• Measure public-site visits, signup source, preview-account creation, and activation readiness using first-party attribution.
• Triage support requests, draft operator-facing summaries, and route issues to the right administrative workflow.
• Detect abuse, troubleshoot sync/plugin issues, audit admin actions, and maintain platform reliability.

We do not sell personal information. We do not use your information for third-party advertising or cross-context behavioral advertising.

• GitHub and GitHub Marketplace: Authentication, repository authorization, installation and installer metadata, Marketplace plan events, and commit metadata.
• Google: Google sign-in when used, Gemini AI classification of commit/activity metadata, and AI support-ticket triage. We do not send source code.
• Stripe: Checkout, subscription management, customer portal, and payment processing. We do not receive or store full card numbers.
• Cloudflare: Hosting, Workers, D1 database, KV, private R2 object storage, traffic analytics, and edge security infrastructure.
• Support email provider: Delivery and receipt of messages sent to or from QuarryFi support addresses. Message content is used to answer the request and maintain the support record.

• Application data is stored on Cloudflare infrastructure using D1, KV, and private R2 storage.
• OAuth tokens are encrypted with AES-256-GCM. API keys are stored as SHA-256 hashes; plaintext API keys are shown only at creation.
• Session cookies are HttpOnly, Secure, SameSite=Lax, and expire after 24 hours.
• Mutating endpoints use CSRF protection and authenticated routes authorize access to the specific company, seat, project, export, or admin resource.
• Generated documents are stored privately and served through authenticated download routes rather than a public bucket.
• Admin/operator actions are audited. Admin access is limited by configured admin emails and managed delegate records.

• Session and temporary authentication state expire automatically, generally within 24 hours or after use.
• Identifiable first-party marketing events expire after 90 days and are deleted in bounded scheduled batches after non-identifying daily campaign totals are recorded. Aggregate totals may be retained longer because they contain no user ID, company ID, landing path, or referrer host.
• Marketplace browser continuation state expires after 30 minutes. Unclaimed installation records expire and are deleted after seven days. Minimal webhook delivery metadata is deleted after 30 days.
• Unused promotion reservations expire after 30 minutes and released reservation records are deleted after 30 days. Promotion redemption and forfeiture records may be retained for up to seven years after the last related billing activity to enforce one-time eligibility, handle billing disputes, and maintain financial records.
• Billing-notice delivery metadata is deleted after 400 days. It is used only to avoid duplicate notices, retry limited failures, and document renewal transparency.
• Development activity, compensation records, owner payment records, expense records, tax-support inputs, audit logs, and generated-document records are retained while your account is active because they support tax documentation and audit trails.
• Raw plugin heartbeat rows are retained for up to 400 days, then removed in bounded batches after compact source labels are preserved on derived activity blocks. Derived activity blocks, classifications, heartbeat counts, and linked commit evidence remain while the account is active so tax-support history is not silently erased.
• Support tickets and support messages are retained while your account is active so we can troubleshoot, audit support actions, and preserve customer-service context.
• Raw expense CSV files are not intended to be permanently retained after parsing. Structured expense records and import audit metadata may remain until deleted or account closure.
• Generated documents are stored privately and normally removed after 30 days. When paid access ends, existing documents receive a 30-day recovery window before removal.
• Downgrading does not silently delete historical evidence, projects, compensation, expenses, or tax-profile records. Resources above Free limits are archived or paused until you delete them, choose what remains active, restore Core, or request account deletion.
• The company owner may start account closure at the bottom of authenticated Settings after a recent sign-in and exact typed confirmation. Closure immediately disables active plugin API keys, contributor setup, repository tracking, GitHub installations inside QuarryFi, new activity collection, and normal workspace access.
• Account closure creates a 14-day recovery window. During that window, the owner can download the authenticated export and restore only the tracking resources and access paths that were active when closure began. Closure-state records retain opaque resource IDs, timestamps, provider status, and support workflow identifiers needed for recovery and deletion verification; they do not duplicate tax-support content.
• For a supported direct Stripe subscription, QuarryFi attempts to schedule cancellation at the end of the current billing period. Marketplace and other originating providers may require the owner to cancel there. Failed or externally required billing actions do not restart data collection or cancel the closure request.
• After the recovery window, we will delete or de-identify account data within 30 days of the verified request where feasible, including company-linked raw marketing events and legal-acceptance records. We may narrowly retain records required for billing, fraud prevention, security, a legal hold, or an active dispute, and will record the retention reason. Provider systems and encrypted backups may retain data until their normal deletion cycles complete; restored backups must reapply the deletion.
• After verified deletion, we may retain a de-identified completion receipt containing timestamps, counts, provider receipt identifiers, and exception codes, but not tax records, tokens, support-message bodies, or direct account identifiers. Non-identifying aggregate campaign totals may also remain.

You may:

• Request a copy of account and company data associated with you.
• Request correction or deletion of inaccurate information.
• Revoke GitHub OAuth or GitHub App access through GitHub.
• Disconnect a marketplace integration to stop new collection. Existing evidence and generated documents remain until you delete them or request account deletion so tax-support history is not silently destroyed.
• Deactivate plugin API keys and remove team members or repository connections.
• Delete or update compensation, owner payment, contractor allocation, and expense records when the app allows it.
• Close the company account from the bottom of Settings and restore it during the displayed recovery window.

To exercise privacy rights, download the authenticated account export, use Close account at the bottom of Settings, or contact privacy@quarryfi.com. We verify requests using the authenticated account or information reasonably necessary to match the request. We do not discriminate against a customer for making a privacy request.

API keys are seat-scoped operational credentials. A valid plugin key can submit heartbeats and read the status summaries described above for its assigned team member.

We use a session cookie (qf_session) for authentication. It is HttpOnly, Secure, SameSite=Lax, and expires after 24 hours.

During Marketplace setup, we use a short-lived HttpOnly, SameSite=Lax continuation cookie (qf_marketplace_claim) for up to 30 minutes. It contains an opaque claim identifier, not a GitHub token.

We may use a first-party attribution cookie (qf_attribution) for up to 90 days to remember landing path, referrer host, and UTM fields for signup and activation reporting.

QuarryFi does not ship a Meta Pixel, Conversions API, advertising-platform browser cookie, advanced matching, retargeting audience, or advertising-platform conversion event at launch. We do not send browser or server conversion events to advertising platforms.

California residents may ask to know, access, correct, or delete personal information associated with them, and may ask about categories of collection, use, and disclosure. QuarryFi voluntarily honors verified requests as described here without representing that every California privacy statute applies to Smashed Studios LLC or to every business customer.

QuarryFi does not sell personal information or share it for cross-context behavioral advertising. Because those activities are not performed, there is no sale or advertising-sharing opt-out signal to process. We still honor Global Privacy Control as a user preference and will reassess this section before introducing any advertising technology.

Submit a request through Settings or email privacy@quarryfi.com. An authorized agent may submit a request, but we may require proof of authority and direct verification with the person concerned. We aim to acknowledge and complete requests within the periods required by applicable law.