Privacy Policy

This policy covers the Track Your Invoice website, web application and iOS app (together, the “Service”). It is written to describe what the software actually does, rather than to cover every hypothetical — if something here does not match your experience of the Service, please tell us at support@trackyourinvoice.com.

What we collect

We collect three kinds of data, and nothing else:

• Account data — your name, email address and a one-way hash of your password (we never store the password itself). Optionally a phone number, and your company name and domain if you create a company workspace.
• Data you enter — expenses, invoices, clients, payments, bank details you choose to show on invoices, warranty dates, and any notes you add. This is your business records; you put it in, and it is yours.
• Receipt images — photographs or files you upload or capture with the camera, and the text extracted from them.

We do not collect your location, your contacts, your device identifiers for advertising, or your browsing outside the Service. We do not sell data, and we do not use your data to train any machine-learning model of our own.

Receipt scanning uses a third-party AI provider

This deserves calling out plainly rather than burying in a list. When you scan a receipt, the image is uploaded to our private storage and then sent to OpenRouter, which routes it to a large-language-model provider that reads the merchant, date, total and tax off the image. That means a receipt image leaves our infrastructure and is processed by a third party in order to produce the extracted fields you see in the app.

If you would rather that did not happen, do not use the scan feature — expenses can be created and edited entirely by hand, and the rest of the Service works normally without it.

Who processes your data

We use a small number of processors. Each one only receives what it needs to do its job:

• Cloudflare R2 — stores receipt images and company logos. The bucket is private; images are served through short-lived signed links, never public URLs.
• OpenRouter — receives receipt images for text extraction, as described above.
• Resend — sends transactional email: invoices and payment reminders to your clients, sign-up verification codes, and payment confirmations. Your clients’ names, email addresses and invoice details are included in those messages because that is what the message is.
• Stripe — processes subscription payments. Card details go directly to Stripe and never reach our servers.
• Intuit QuickBooks — only if you explicitly connect it, and only to sync the records you choose to sync. Disconnecting stops it.
• Google Analytics — on the public marketing pages only. The signed-in application, the sign-in pages and the public invoice view are deliberately untracked.

Our servers and database are hosted in Europe. Some processors above operate internationally, so your data may be processed outside your own country.

Why we are allowed to hold it

For account and business-record data, the basis is performance of a contract — we cannot run an invoicing service without holding your invoices. For transactional email, the same. For marketing analytics, the basis is legitimate interest in understanding which pages bring people to the product, and you can block it with any standard content blocker without affecting the app.

How long we keep it

For as long as your account exists. When you delete your account, your personal data, expenses, invoices, clients and receipt images are removed. Some records may persist briefly in encrypted backups and in our email provider’s delivery logs before ageing out.

Deleting your account

You can delete your account and its data yourself, without contacting anyone:

• iOS app — Settings tab → Account → Delete account.
• Web — Settings → Account → Delete account.

Deletion is permanent and takes effect immediately; we cannot restore a deleted account. If you would rather we did it for you, email support@trackyourinvoice.com from your account address.

Your rights

If you are in the UK or EU, you have the right to access, correct, export, restrict, or erase your personal data, and to object to processing. Most of these you can exercise directly in the app; for anything else, email us and we will action it. You can also complain to your data protection authority — in the UK, the Information Commissioner’s Office.

Security

Traffic is encrypted in transit with TLS. Passwords are hashed with bcrypt. Receipt storage is a private bucket reachable only through expiring signed links. Each company’s records are scoped to that company on every request.

No system is perfectly secure. If you find a vulnerability, please report it to support@trackyourinvoice.com rather than disclosing it publicly, and we will work with you on it.

Children

The Service is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If we change this policy materially, we will update the date at the top and, for changes that affect how your data is used, email you before they take effect.

Contact

support@trackyourinvoice.com