Privacy

Esta traducción al español es informativa. Si hay alguna diferencia, la versión en inglés es la que rige.

Last updated: September 26, 2026

The short version: without Pro, your invoices never leave your device. With Pro, they're encrypted on your device before they sync, so we can't read them. What we can read is your account — your email, your plan, the letterhead your documents print and, once account syncing has been on for your account, the count of your free documents — and you can see, export or erase your account any time.

• The tools run in your browser. Signed out, nothing you type into a document is sent to us — your browser's network tab will show it. Without Pro, your invoices, estimates, amounts, and the job photos and notes you keep with each document stay in your device's own storage and are never sent to us. If you sign in, your letterhead does travel, and we can read it: your name, company, contact, license, logo, profile picture, tax settings, template and color, and your payment handle — so a second device sets itself up. On Pro, your invoices, estimates and job notes, your customer list and your saved prices travel only encrypted (see below). Your job photos stay on your device.
• If you create an account, your account record holds exactly: your email address, when you joined, whether a subscription is active, and — so your setup follows you between devices — your letterhead: your name, company, contact, license, logo, profile picture, payment provider and handle, tax rate, state and county, print template, accent color, black-and-white setting and language; on Pro, your customer list and saved prices, encrypted on your device before they sync, which we can't read; and — once account syncing has been on for your account, so your free documents are counted across your devices — one fingerprint for each free document your account has counted, including those a device counted while signed out and added when it signed in, with the time we recorded it. View, export, or delete that record any time at /account — deletion is instant and total.
• So you can see who is signed in as you, we also keep a short security record: for each signed-in device, the browser or app and the operating system it reports and the city or region your network resolves to, plus a list of your last 30 sign-ins and security changes. Your IP address is never attached to your account or shown to anyone — it is used for a few minutes, as a counter, to stop somebody hammering the sign-in and password-reset endpoints, and it expires on its own. All of it is shown to you at /account — a security log you can't read protects nobody — and all of it is deleted with your account. Sign a device out and its record is removed immediately.
• Your spare key is made on your device and never sent to us. If you make one, we keep only a one-way check made from it — enough to let it reset your password once, and nothing that could open anything — and it is deleted with your account.
• Your 2 free documents are counted on your device — and, while account syncing is on for your account and you are signed in, on your account instead: 2 across every device you sign in on, and signing in on another device adds that device's count to your account's rather than starting it again. Your account page shows which applies to you. For each free document your account counts — including those a device counted while signed out and added when it signed in — your device computes a fingerprint from the key that names the document (its kind, number, date and customer, or a template pad's design and kind) and sends only that. We keep that fingerprint and the time we recorded it, and nothing else: not the key, not the amount, not the customer's name, not a line of the document. That count only ever goes up, and it is deleted with your account. Signed out, no account is needed at all: the count stays in your browser, and clearing your browser data clears it along with your saved documents.
• In the iPhone app the same rules hold: without Pro, your documents, job photos and notes are stored only on that phone — and inside the backups your own Apple account makes, which we never see. On Pro, with end-to-end encryption on, your documents, notes, customer list and saved prices are encrypted on the phone before they sync, exactly as in the browser. Your job photos stay on the phone. Your letterhead, logo and profile picture sync with your account as they do in the browser, so the app and the website agree. Signing in on the phone also adds a sign-in for that device to the security record above, shown in your device list beside your browsers, kept 31 days after it was last used or until you sign it out. If you buy Pro through the App Store, Apple tells us only that the subscription exists and when it renews; Apple keeps your payment details.
• No third-party analytics, no trackers, no ad networks — nothing here reports to anybody else. We do keep one first-party count of our own: which page was opened, the site that linked to it, and the language, with no cookie and nothing identifying you. The only cookie is one essential session cookie, set when you sign in and removed when you sign out.
• Payments are processed by Stripe; we never see your card number. When you buy, our server checks your checkout session with Stripe to issue your license — that check uses only the session reference, not your payment details.
• Email, stated completely. We send transactional email only: a verification link when you create an account or change your address, a reset link when you ask for one, and a security notice when your password or email changes. These are delivered by Resend, which processes the recipient address and message for delivery — your invoice contents are never in any email we send. Messages you send through the support form are delivered as email to our monitored support inbox ([email protected]) so a person can reply; include only what you're comfortable sending. We send no marketing email. If that ever changes it will be strictly opt-in, with one-click unsubscribe, and never a condition of using the tools.
• Getting paid by your customers never involves us. Your payment link or handle is saved with your account, alongside the rest of your business profile, so it prints on every device you sign in on; the scan-to-pay code itself is drawn in your own browser — not fetched from an image service, which would hand your payment address to a third party. Your customer pays you directly through your own payment app; that money never passes through us and we never learn whether an invoice was paid.
• Clearing your browser data erases every document, photo and note the tools saved here. Without Pro, we have no copy of any of it. On Pro, the documents, notes, customer list and saved prices that already synced stay in your account, encrypted, and come back once you open your documents on this browser again with your passkey or your spare key; job photos do not. Your letterhead comes back the next time you sign in, and so does your free-document count while account syncing is on for your account.
• How long we keep it. Your account record, your letterhead and your free-document fingerprints: until you delete the account. On Pro, each encrypted document, with the earlier versions kept beside it (we see only their sizes and when each was added, changed or deleted), stays until you delete that document or your account, or choose Start over, which sets the encrypted copies aside for at least 30 days and then deletes them. Nothing is removed because time passed or because you stopped paying: if you stop paying, your devices can still open your documents and you can still delete them, and we still can't read them. When you delete a document, a signed deletion marker with its time stays for the life of the account, so a device that was away for months still learns it was deleted. Deleting your account deletes the key copies first, then everything else we hold.