Privacy & your data — your work stays local

TakeoffQuote runs entirely in your browser. Your plan PDFs are rendered locally and your takeoff autosaves to this browser's own storage (IndexedDB + localStorage) about a second after every change — no TakeoffQuote account is required. Local storage is the default. Optional shared-folder sync is off by default; if enabled, it sends project files directly to your own cloud storage account that you choose and authorize. Close the tab and come back: your work is still there. Clear the browser's site data and it's gone, so export a backup for anything that matters.

What lives where

Your plan files — read and rendered in the browser; stored in this browser’s IndexedDB so the set reopens instantly. Local mode does not upload them to TakeoffQuote; optional shared-folder sync sends project files to the storage provider you authorize.
Your takeoff — shapes, conditions, scales, markups — autosaves to IndexedDB + localStorage about a second after every change; the toolbar ticks saving… / saved ✓.
Quote bindings and unit prices — your assembly choices, parameters, prices, and company name are kept in the same local storage, so the next project opens the Quote builder already configured.

“Client-only” describes rendering, measurement and quote generation in your browser. TakeoffQuote does not receive your plan files or takeoff data. If you enable optional shared-folder sync, project files, including PDFs and takeoff annotations, can cross the network directly to your chosen storage provider; its terms govern that storage. This does not add shared review sessions or a centrally managed price book.

What does cross it on takeoffquote.com is a count of fifteen product events — the canvas mounted, a plan imported and stored, a manual measurement created, a plan import failed, a quote workbook generated for download, checkout failed, a plan opened, a quote completed, the Pro gate shown, an upgrade clicked, checkout started, a key activated, a pricing path clicked, interest in a per-project pack, a click through to the app from one of our pages — so we can tell whether the paywall is working, which way of paying people prefer, and which pages bring people to the app. Each carries the event’s name — plus, where one applies, a single word from a fixed list (“monthly”/“yearly”, “sample”/“own” for whether the plan opened or imported was the bundled sample, “subscription”/“per_project”, a pack size of “5”, “10” or “20”, or a short name for one of our own pages, “other” for any page not on the list) — and nothing else: only fixed failure labels (read/unsupported/store or unavailable/network/response), no cookie, no identifier, nothing from your drawings. Our payment webhook separately counts a subscription paid for, a subscription canceled, a payment refunded, and a refunded subscription we could not cancel automatically, each with only “monthly” or “yearly”. The Privacy Policy spells out exactly what each one contains.

Product events are normally counted at most once per browser tab; plan imports and import or checkout failures count once per allowed label in that tab. These anonymous counts cannot link a person through the steps. A plan opened can be restored; a quote completed means priced lines were visible, not that a quote was newly finished. Quote workbook generated means a download was handed to the browser, not proof it was saved. Payment is counted once per subscription, not each renewal. Cancellation counts when active access ends, including pause or expiry. Refund counts the first approved refund per subscription, whether full or partial. A failure to cancel a refunded subscription counts each failed attempt requiring manual action, so a redelivery can count again.

If you email us at support@takeoffquote.com, that message reaches our support inbox (received by Cloudflare Email Routing, kept in Gmail) and is kept for 24 months after your request is resolved, then deleted — the Privacy Policy has the details.

Closing the tab, and the real boundaries

Closing the tab loses nothing — reload, close the browser, come back tomorrow; autosave has it. The boundaries that do matter:

Storage is per browser, per device. A different browser profile or a different machine is a fresh, empty workspace. Local work does not automatically follow you across devices. Export a backup to move it, or explicitly choose and authorize optional shared-folder sync for project files. Project-file sync does not automatically transfer browser-wide libraries.
Clearing site data clears your work. The browser’s “clear browsing data” for this site deletes the IndexedDB and localStorage that hold your takeoff.
Private/incognito windows typically discard site storage when the window closes.

Take it out of the browser

Export takeoff… writes 〈project〉.takeoff.json — the exact document autosave writes — to a normal file you can back up, archive for years, or hand to another estimator. Import takeoff… reads it back as an editable takeoff. Export one at every milestone; it’s the answer to every boundary above. The report and quote exports are likewise generated in the browser and downloaded straight to your disk.

Failure honesty

If a saved project ever fails to load, autosave pauses itself and a banner says so — a load failure never overwrites your saved work with an empty canvas. And if the app updates in another tab, the stale tab asks for a reload instead of writing over the newer one.

Supplemental Ahrefs page counts cover fixed public website addresses and the clean app entry, inside an isolated script-only frame. Only the public address and a fixed source category cross that boundary, never query strings, fragments, campaign names, the original referrer, or drawing content. Ahrefs also receives browser language and screen dimensions/pixel ratio, and its server receives the request. Its native referrer report is intentionally empty; source categories provide a limited comparison instead. These counts cannot establish unique people, activation or revenue. Product events and Paddle remain the original records. Internal browsers and unreadable browser storage suppress Ahrefs. See the Privacy Policy for the complete description.