Privacy policy.

Website analytics and cookies

We use privacy-configured PostHog analytics and Cloudflare infrastructure metrics to understand page use, referral sources, documentation navigation, and access-flow outcomes. Session replay is disabled. Analytics events do not include access-form field values. The browser creates a random identifier in session storage so events from one open tab can be understood as a short journey; it is removed when that tab session ends.

WorkOS authentication uses secure, HTTP-only cookies to complete sign-in and maintain your account session. These cookies are necessary to provide authenticated account and billing features and are not used for advertising.

Accounts and billing

WorkOS processes account identity and sign-in information. Stripe processes subscription, invoice, and payment information. Quoin stores the identifiers and billing status needed to decide whether an account has product access. Quoin does not receive or store full card numbers.

MCP property research

When you use the Quoin MCP server, Quoin processes the structured tool arguments needed to answer the request, such as a Washington, DC address or property account, bounded search filters, pagination values, and source references. We also process the WorkOS user identifier and limited operational metadata needed to authenticate, enforce access and rate limits, protect the service, and diagnose errors.

Quoin does not request or intentionally collect your AI chat history, raw conversation transcript, unrelated files, account passwords, OAuth tokens, or payment-card details through MCP tools. Tool results contain public property-record information, source provenance, and service limitations.

Access requests

When you submit the request form, Quoin stores your name, work email, company if provided, use case, submission source, and submission time in Airtable so we can review and respond. Airtable processes this information on our behalf. If the service is unavailable, the page offers a pre-addressed email instead and does not represent the form as submitted.

Service providers and recipients

Quoin shares information only as needed with service providers that operate the service: Cloudflare for delivery, security, compute, and operational logs; WorkOS for identity and sign-in; Stripe for billing; PostHog for privacy-configured website analytics; Airtable for access-request intake; and hosting and storage providers for the Quoin data service. We may also disclose information when required by law, to protect rights and security, or in connection with a corporate transaction. We do not sell personal information or share it for cross-context behavioral advertising.

Retention

Operational request and security logs are retained for no more than 30 days. Website analytics are retained for no more than 12 months. Completed Stripe webhook event records are removed after 90 days. Access requests are retained for up to 24 months. Account and entitlement records are retained while the account is active and for up to seven years afterward where needed for tax, accounting, disputes, security, or legal compliance. The marker that an account used its one-time trial may be retained for the life of the service to prevent repeated trial use. We may retain a minimal record longer where law requires it or to document a completed privacy request.

Infrastructure logs

Cloudflare and our hosting infrastructure may process IP addresses, user agents, request paths, timestamps, and security signals to deliver and protect the site. We do not intentionally place payment details, access-form values, or authentication secrets in application logs.

Your choices and rights

You may use browser privacy controls and contact [email protected] to request access to, correction of, or deletion of personal information associated with your Quoin account or sent directly to Quoin. You may also ask us to close your account. Depending on where you live, you may have rights to restrict or object to processing, receive a portable copy, or appeal a denied privacy request. We may need to verify your identity before completing a request and may retain information where required by law or legitimate security needs.