Privacy policy

Last updated October 20, 2026

Quorum Council is run by Justin Wills LLC, a California company. This page says what the council keeps about you, why, who else sees it, and how to delete it. Questions: council@quorum.ceo.

What we collect

Your account

• Your email address, a display name (taken from your email unless Justin enters one) and, if you give it, your company.
• Your plan: beta allowance, credits or subscription, how many credits you have and your monthly allowance.

Signing in

• When you ask for a sign-in code we store your email, when it was sent, how many tries were made, and a one-way hash of the code and the sign-in link. We never store the code or link themselves. They work once, for 20 minutes.
• A signed cookie keeps you signed in to My councils for 30 days.

Connected apps

• When you connect Claude, ChatGPT or another app, we store the app's name and registration (its client id and the addresses it returns to), a record that you allowed it (when, and when it was last used), and one-way hashes of its access and refresh tokens. Access tokens last 1 hour and refresh tokens 60 days.

Councils

• The brief you or your app sends: title, decision, options, what you've tried, what you'd hate to be wrong about, context and who is on the other side. Your name and email are kept with it.
• Each seat's answer in each round, and the final report.
• For each seat: which model ran, start and finish times, token counts, how many web searches it made and what it cost.

Feedback

• Your answers to the two questions under a report, and any note you add, with the council's title and type.

Payments

• Your Stripe customer id, subscription id, status and renewal date, and for each payment: the Stripe event id, its type, credits added, the amount and the checkout session id. Card details go to Stripe. We never see or store them.

Logs

• Our host keeps standard request logs (IP address, page, time). Our own error logs hold short error codes, not your briefs.

How we use it

• To run your councils and show you the reports.
• To sign you in and keep your connected apps working.
• To charge you, when your plan has a price.
• To email you: sign-in codes, a thank-you after a purchase or new subscription, and a note when a council you started from an app is done.
• To fix problems and improve the council. Feedback answers go straight to Justin.

We don't sell your data, use it for ads, or use it to train models.

Who can see it

• You see your own councils in My councils and through your connected app.
• Councils you start yourself are in the vault. Their title, brief, every seat's answer and the report are encrypted in our database, and the admin page doesn't open them. Justin Wills, who runs the service, sees only each council's status, seats, model versions, timing and cost, which he needs to run it. If you want his help with one, tap Share with Justin on it in My councils, and Stop sharing to close it again.
• Councils Justin starts for you by hand, and his own, are not in the vault: he wrote the brief and reads the report before he sends it.
• Your answers to the two questions under a report go to Justin, with the council's title.
• Nobody else at Justin Wills LLC has access.

Who we share it with

• AI model companies. To answer a council, your brief (and in later rounds the other seats' answers) goes to the companies whose models sit on it: Anthropic, OpenAI, Google, xAI, Mistral (France), and Fireworks AI (US), which runs the open models from Alibaba (Qwen), DeepSeek and NVIDIA (Nemotron). Each handles it under its own API terms. Our OpenAI and xAI calls are set not to be stored by them, and the open models run on Fireworks' US servers, which keep nothing by default. None of it is used to train models. Some seats have a web search tool, so the model company may run searches based on your brief. The council_lineup tool shows the current seats and model versions.
• Stripe handles payments.
• Resend sends our emails, so it gets your email address and the email.
• Vercel hosts the site and runs the code.
• Supabase hosts the database.
• Google Fonts: our pages load fonts from Google, so your browser contacts Google's font servers.
• Access codes: when an email signs in for the first time, we check whether Justin Wills gave it a council code. That list also runs on Supabase.

We may also share information if the law requires it.

How long we keep it

• Councils you start from an app stay in My councils until you delete them, or until the time you set under "Delete my councils automatically" (7, 30 or 90 days after they finish). If your account is closed or switched off, they're deleted 30 days after delivery (straight away if that has already passed), or 90 days after they were started if they never finished.
• Councils Justin starts for you by hand are deleted 30 days after delivery, or 90 days after they were started if never delivered.
• Connected apps: expired codes and tokens are deleted a day after they expire, revoked connections 30 days after they're revoked, and unused app registrations after 7 days.
• Feedback is kept after the council is deleted, until you ask us to delete it.
• Sign-in records are kept as a security log until you ask us to delete them.
• Payment records are kept as long as tax and accounting rules require.
• Your account is kept until you ask us to close it or Justin removes it.

Deleting your data

• Delete a council with the Delete button in My councils, or ask your app to delete it (the delete_council tool). The brief, every seat's answer and the report are removed from our database right away. We can't pull back what was already sent to the model companies, which follow their own retention rules.
• To close your account, or to see, correct or delete anything else we hold, email council@quorum.ceo. We answer within 30 days.

Security

• The vault. Councils you start yourself are encrypted with AES-256-GCM before they're written to the database. The key is kept in the app's server settings, apart from the database, so a copy of the database alone can't be read. The council's server opens them when you read a report and when it sends your brief to the models.
• Files and links you attach. On the web page you can attach files or paste links. Each is read once into text (images stay images), encrypted, and kept with that council until you delete it. Links are read only if they are public; Quorum never signs in to your accounts. Attachments you don't use in a council are deleted within a day.
• The database itself is encrypted on disk by Supabase, and is reachable only by the council's own database role.
• Everything travels over HTTPS.
• Sign-in codes, links and tokens are stored only as one-way hashes. Card details never reach us; Stripe holds them.
• The email that tells you a council is done carries only a link, not its title or answer.

A council has to send your brief to the AI models in readable form for them to answer it, so the vault covers what we store, not what the model companies receive. See who we share it with above.

Other points

• Quorum Council is for adults. Don't use it if you're under 18.
• California residents can ask what we hold about them and ask us to delete or correct it, at council@quorum.ceo. We don't sell or share personal information for advertising.
• If we change this policy we update the date at the top. If a change is significant we email members first.

Justin Wills LLC · council@quorum.ceo · Terms of use · Docs