Privacy
If someone sent you an approval link
The page shows a copy of the estimate or invoice they published. When you open it, we store a one-way hash of your IP address, your browser's user agent, and the time — enough to tell the sender their document was opened, not enough to identify you from our records.
If you approve and sign, we additionally store the name you type, an email address if you give one, the signature you draw, a fingerprint of the exact document you signed, your IP address and your user agent. That set exists so the signature can be shown to mean something later: without it, a signature proves nothing about what was agreed or by whom.
If you request changes instead, we store your comment and nothing else.
How long it is kept
Approval links expire on a date the sender chooses, at most a year out. An expired link that nobody signed is deleted, snapshot and all, thirty days later. Records of who opened a link are deleted after ninety days.
Signed documents are kept while the sender's account exists, because the signature and the document it belongs to are the record of an agreement between you and them. To have one removed, ask the business that sent it — it is their record, and they can revoke the link at any time.
If you use Plain Estimate to send documents
Your estimates, invoices, clients and prices are stored in your own browser and are not sent anywhere. Two things leave your device, and only when you choose them: a document you publish to an approval link, and — if you create an account — whatever syncs between your devices.
Signing in is through Google, so we never see a password — there is nothing here to guess or to leak. An account stores the email address Google confirms, a display name, and whatever you sync. What is synced is encrypted before it is written down.