Privacy policy

Your account

When you sign in, Quoin stores your email address, your name, the workspaces you belong to and your role in each, and when you last chose a workspace. We keep them until you leave a workspace or your account is deleted.

Each session is stored with the network address and browser it was opened from, and ends after 30 days. A sign-in code is stored encrypted and expires after 5 minutes. To slow down abuse, Quoin counts recent sign-in attempts by email address and by network address, and deletes a count after 24 hours without activity.

If you sign in with GitHub or Google, Quoin stores the account id and the sign-in tokens the provider issues, and uses them only to sign you in. Quoin has no passwords.

Your workspace

A workspace keeps its flags, rules, revisions, experiments and metrics, and an audit log of every change. Each audit row names who made the change: the member’s name, or their email address when they have not set a name. A row about inviting or removing a member carries that person’s email address.

The audit log is never edited. It is kept until the workspace is deleted for good, including rows that name a member who has since left the workspace or deleted their account.

Data your product sends

Quoin stores what your product sends it: the unit ids in exposures, exactly as sent and never hashed, and the events and identities you send.

Erasing one of your users

On request, Quoin deletes the rows it recorded about one unit id: its exposures, events and identities. If your product keeps sending that id, new rows are recorded. Backups and exports already taken are outside an erasure, and free-form event properties are not searched for the id.

Text a workspace member typed into a rule, a note or a revision, such as a unit id in a force rule, is the workspace’s own content. It stays until that member changes it, which makes a new revision while the old one keeps the text, and it goes when the workspace is deleted. A revision is never rewritten.

AI analysis

AI analysis is off unless a workspace admin turns it on, and Quoin does not offer it in production yet. When it is on, Quoin sends Anthropic a report’s aggregate arm counts and the analysis prompt: the hypothesis, the decision rule, the metric titles and the experiment and flag keys. It never sends a per-user row.

When feedback on an analysis is on, a vote is stored with the id of the member who cast it. No one reads the votes yet, and a vote is never sent to Anthropic.

Logs and cookies

Quoin’s structured logs carry a keyed hash of an email address, never the address itself. The app sets session cookies on its own address to keep you signed in; this site sets none.

Deleting a workspace

A deleted workspace can be restored for 30 days, then it and its data are deleted for good. Backups age out within our database host’s own history window.

Retention, governing law and contact