›Nothing on our servers. If you use the app without signing in, we don't save anything about you on our end.
›Your business details, only if you enter them. They stay inside your web browser on this device (just for the current tab) — close the tab and they're gone. They never reach us.
›A couple of random ID numbers in your browser. One is a device tag we keep in case we ever need it to prevent spam (today it isn't linked to anything about you); the other simply stops our usage counter from counting the same visit twice. Neither one identifies you personally.
›Anonymous usage stats. We use an analytics tool (called PostHog) to see things like which pages and buttons get used, so we can improve the app. This goes to PostHog's own servers in the United States, not ours. It never records your screen, and none of it is ever sold or given to advertisers.
What we collect — when you sign in
›Your business details (name, contact info, license number, payment terms, tax settings, and your logo if you add one) — so they appear on your invoices. Saved to your account, not just this device.
›Your invoices — customer names, amounts, and the text we transcribed from your voice — plus a copy of your business details as they were at the time. This is what lets us show your history and re-create the PDF when you download it again.
›Your email address. Signing in is handled by a specialist login service (called Clerk), so we never see or store your password.
›A short activity log — which invoices you made, when, and the total amount — so we can understand how the app is used. It never includes customer names or the line items.
What we don't keep
›Voice recordings. Your recording is held only while you're recording, and is permanently deleted the moment you finalize the invoice. It never gets saved to our database.
›The finished PDF file (for now). We save your invoice's information, not the PDF itself — the PDF is rebuilt from that saved information each time you download it. The numbers (amounts, customer, line items) are locked once you finalize; only the layout reflects the current version of the app, so a later download may look slightly different even though the figures are identical. (Saving the exact original file is on our list.)
›Screen recordings. We never record or replay what's on your screen, so the customer names and amounts on your invoices are never captured.
›Your IP address, in our app's own records. (The companies that host our servers and handle sign-in may note it briefly for normal security and to keep the service running.)
›Your data, sold or shared for ads/marketing. Ever.
Who can see your data
›You. Your invoices are private to your account — other users can't see them.
›Us. The small team building HandInvoice can access stored data to provide support and keep things running. That's normal for any online service — we'd rather just say so.
›A few trusted services we're built on. Like most apps, HandInvoice relies on outside services for specific jobs:
›OpenAI — the AI service that turns your voice into text. Your audio passes through it briefly to be transcribed, then isn't kept.
›Our database provider (MongoDB) — where your invoices and business details are stored once you're signed in. Nothing is stored there if you're not signed in.
›Our sign-in service (Clerk) — manages logging in (email and password, or "Continue with Google") so your password never touches our app.
›Our analytics tool (PostHog) — only sees anonymous things like page views and clicks, never your invoice details. The data is stored on PostHog's servers in the United States.
Your rights
›Delete any invoice anytime from your Invoices page.
›Deleted invoices stay in your trash for 30 days, then are permanently removed. You can restore them anytime within that window from the invoices page.
›Delete your account — email us at hello@handinvoice.com and we'll wipe your data. (Self-serve account deletion is on the roadmap.)
›Export your data — coming soon. Email us in the meantime.