Privacy Policy

Effective October 18, 2026 · Version 2026-10-18.2 · Android app: com.rollquote.app

RollQuote: Painting Estimate is operated by {{DEVELOPER_NAME}}. Developer identity is pending confirmation for this pre-release preview. This policy explains the app and this website. Contact support@rollquote.com with privacy questions or requests.

1. Estimates on your device

Estimates, customer fields, job transcripts, pricing settings and company details are stored in the app's local database. Terms acceptance (version and time), first detected Pro date and yearly-reminder status are also stored locally. We do not provide cloud synchronization of these records. Exporting or sharing sends a copy to the location or app you choose. Your operating system's backups and other apps may keep additional copies under their own settings and policies.

2. Text sent for AI drafting

Only when you submit a job description using Draft with AI, after the in-app Terms/Privacy disclosure and explicit agreement, are that text and a random app device identifier sent over HTTPS to our Cloudflare Worker. We forward the text to Google Gemini solely to structure your requested painting estimate into rooms, surfaces and preparation work. The app then calculates quantities and prices using your settings. We do not send your saved customer or company fields as separate AI inputs.

Please do not enter customer names, phone numbers, addresses or other personal information into AI job descriptions. There is no automatic personal-information filter. Anything you include in that text is sent for processing.

Routine AI drafting does not save the description or AI response in our server database or application logs. If you explicitly report a draft, we store the AI job you submit for review as described in section 9. Application logs record the description's length and SHA-256 hash, plus operational status such as an Integrity-check reason. This does not mean that all infrastructure providers have zero retention.

3. Google Gemini paid API

Our AI provider is the Google Gemini paid API, through a project with active billing. While that paid-service status remains active, Google's paid-service terms provide that prompts and responses are not used to train or improve Google's models or products. This assurance depends on maintaining active billing; we must stop AI processing or update this disclosure and obtain any required consent before switching to a different data-use regime. Google may retain prompts and responses for a limited period for security, abuse monitoring and legal obligations. Google's processing may occur internationally.

4. Voice input

Voice input uses Android's speech-recognition service. That service may process audio on the device or through its provider's servers, depending on your device and settings. RollQuote receives the recognized text and does not itself record or store raw audio. The resulting text stays local unless you submit it for AI drafting or share it.

5. Identifiers, quotas and network information

Our Cloudflare D1 database stores operational records and reports you submit, rather than synchronizing your estimate documents:

• devices: random deviceId (your Settings → Support ID), free/monthly usage, month key and credit balance, to enforce allowances.
• ledger: request/receipt identifiers, deviceId, time, changes and reasons (attempt, debit, refund, purchase or transfer), for abuse prevention and balance auditing.
• debit_accounts: debit identifiers and their current device owner, so a failed request is refunded correctly after a transfer.
• ip_usage: raw IP address, minute/day time buckets and request counters, for rate limiting. This table has no deviceId link.
• reports: report ID, deviceId, reason, optional note, submitted original AI job and time, to review flagged content.
• When billing is enabled, entitlements records app user IDs, Pro expiry and event time; rc_events stores receipt IDs, processing status and transfer participants where applicable, to prevent duplicate processing; device_aliases maps restored device IDs to the current owner.

Cloudflare receives request metadata, including IP addresses, and processes network and security data under its privacy policy. When Play Integrity is enabled, an attestation token will be sent with AI requests and verified through Google to assess app/device legitimacy and prevent abuse. This preview does not yet obtain or decode real Integrity tokens.

6. Security and purchases

App-to-backend and backend-to-Gemini traffic uses HTTPS. D1 is hosted by Cloudflare; administrative access uses protected credentials. Routine AI drafting does not retain input descriptions or original AI responses in our server database; reports you explicitly submit are stored for review. Application logs do not store the original input or AI response text. These measures reduce risk but cannot guarantee absolute security.

Real Google Play/RevenueCat billing is not enabled in the current pre-release. No real purchase is processed by the preview. We do not receive credit-card or bank details. Before enabling billing, we will update this policy to describe the active purchase-data processing.

The app currently has no Firebase Crashlytics or Analytics integration, and this website has no analytics or advertising scripts. Cloudflare may set security cookies to protect the website from abuse; they are not used by us for advertising. We do not sell personal information or share it for cross-context behavioral advertising. Data is disclosed to the service providers described here to operate the features you request.

7. Retention and deletion

Local records remain until you delete them or clear the app's storage. Uninstalling normally removes local app data; exports, shared copies and operating-system backups must be managed separately. Keep your own exports before clearing storage or changing devices.

Server quota, network-security and audit records have no automatic deletion schedule in the current version. They are retained for service operation, abuse prevention and applicable legal requirements. Email support with your Settings → Support ID to request access, correction or deletion of associated D1 records, including verified restored-device records. We verify ownership before acting; a Support ID alone is not proof of ownership. Raw IP counters are not linked to this ID, and some receipt markers lack a device link, so extra verified information may be needed to locate them. We explain any records we cannot identify or must retain for legal or security reasons; we do not promise deletion of unrelated shared-IP records. Deletion is handled manually, not by clearing local storage. Provider retention is governed by the linked provider terms.

8. Your choices and applicable rights

You may use manual estimating without submitting text to AI, decline microphone permission, and view or export saved quotes without a subscription. RollQuote currently does not meet the statutory business-coverage criteria for the California Consumer Privacy Act (CCPA); this is based on those criteria, not an exemption for individual developers. We voluntarily accept access, correction and deletion requests using your Support ID, without discrimination. Other mandatory rights under applicable law remain intact. Clearing local data does not by itself delete backend quota records.

9. Children, support and policy changes

RollQuote is intended for professional users aged 18 or older, not children. We do not knowingly collect children's information. The AI banner's Report action opens an in-app form. Submitting sends the latest original AI job, your chosen reason, any note you enter and your Support ID to us for review, stored in Cloudflare D1 with a report ID and time; it does not send a report to Gemini or use AI credits. Avoid sensitive customer details in notes. Reports have no automatic deletion schedule; you may request deletion using your Support ID. Email remains a fallback if submission fails or an older draft has no saved original response. We will post policy updates here with a revised effective date and provide any additional notice required by law.