Privacy Policy

QuarryFi is operated by SmashedStudios LLC. This policy explains what information we collect, how we use it, and the choices available to you. QuarryFi is designed to collect development and tax-support metadata, not source code, file contents, private messages, or payment card numbers.

• Source code, code diffs, or file contents.
• AI conversation transcripts, prompts, or assistant responses from your editor.
• Screenshots, screen recordings, browsing history, or non-development personal files.
• Keystroke contents. Plugins send session/activity metadata only.
• Full payment card numbers, bank account credentials, Social Security numbers, or government IDs.

• Authenticate users, manage sessions, enforce admin access, and secure API routes.
• Connect authorized repositories and editor plugins to project and team-member records.
• Classify activity against R&D tax-credit criteria and generate support narratives.
• Calculate planning estimates for wage, contractor, owner, and R&E expense support.
• Run export readiness checks and generate supporting documents for your review and your tax professional.
• Process subscription billing through Stripe and provide account support.
• Detect abuse, troubleshoot sync/plugin issues, audit admin actions, and maintain platform reliability.

We do not sell personal information. We do not use your information for third-party advertising or cross-context behavioral advertising.

• GitHub: Authentication, repository authorization, installation metadata, and commit metadata.
• Google: Google sign-in when used, and Gemini AI classification of commit/activity metadata. We do not send source code.
• Stripe: Checkout, subscription management, customer portal, and payment processing. We do not receive or store full card numbers.
• Cloudflare: Hosting, Workers, D1 database, KV, R2 private object storage, and edge security infrastructure.

• Application data is stored on Cloudflare infrastructure using D1, KV, and private R2 storage.
• OAuth tokens are encrypted with AES-256-GCM. API keys are stored as SHA-256 hashes; plaintext API keys are shown only at creation.
• Session cookies are HttpOnly, Secure, SameSite=Lax, and expire after 24 hours.
• Mutating endpoints use CSRF protection and authenticated routes authorize access to the specific company, seat, project, export, or admin resource.
• Generated documents are stored privately and served through authenticated download routes rather than a public bucket.
• Admin/operator actions are audited. Admin access is limited by configured admin emails and managed delegate records.

• Session and temporary authentication state expire automatically, generally within 24 hours or after use.
• Development activity, compensation records, owner payment records, expense records, tax-support inputs, audit logs, and generated-document records are retained while your account is active because they support tax documentation and audit trails.
• Raw expense CSV files are not intended to be permanently retained after parsing. Structured expense records and import audit metadata may remain until deleted or account closure.
• Generated documents may remain in private storage until deleted, replaced, or removed through account deletion or a deletion request.
• Upon a verified deletion request, we will delete or de-identify account data within 30 days where feasible, unless retention is required for security, billing, legal, dispute, or tax-support reasons.

You may:

• Request a copy of account and company data associated with you.
• Request correction or deletion of inaccurate information.
• Revoke GitHub OAuth or GitHub App access through GitHub.
• Deactivate plugin API keys and remove team members or repository connections.
• Delete or update compensation, owner payment, contractor allocation, and expense records when the app allows it.

To exercise privacy rights, contact privacy@quarryfi.com. While QuarryFi is operating on the workers.dev preview domain, you may also contact smashedstudiosllc@gmail.com.

API keys are seat-scoped operational credentials. A valid plugin key can submit heartbeats and read the status summaries described above for its assigned team member.