Invoice privacy

Local work

Document previews and PDF generation run in your browser. Business details, customer details, logos and line items are not uploaded during ordinary local editing or generation. Saving on this device writes an editable record to browser storage. Device backups include these details; keep them private. Clearing browser data removes local saved records and local numbering.

Time tracking

Timers and time entries stay in browser storage. Explicit cloud timesheet saves upload customer names, projects, descriptions, rates and dates. Running timers are never uploaded. Creating an invoice while connected saves the draft and marks the selected cloud entries invoiced together. PDF and CSV timesheets are generated locally.

Expenses and receipts

Expense records and original receipt attachments stay in this browser. Reports and ZIP archives are generated locally. Archives contain customer details and original receipts; keep them private. There is no expense cloud synchronization. Adding expenses to a local invoice does not upload them; explicitly saving that invoice to the cloud uploads its line items, but not receipt attachments.

Projects and job sheets

Project details, customer names, checklists, budgets and links to local records stay in browser storage. Project backups and job sheets are generated locally and may contain internal business details. Project backup imports do not upload files. Deleting a project removes its links, not the original time, expenses, receipts or documents. Projects do not sync to your cloud account.

Optional account features

Connecting your Emberkit account uses its session cookie. Explicit cloud saves upload the selected invoice or quote details and logo, customer, or service to our database. Records are private to the authenticated account and have no public sharing URL. Opening an item retrieves it to your device. Server storage limits apply even when generation is unlimited.

When connected, a download sends its document count, a random request ID and a SHA-256 fingerprint to record monthly usage and handle retries. It does not send the generated PDF or source details for this usage request. Retry fingerprints are retained for 31 days, then removed in scheduled batches; monthly usage totals are separate. Without an account, the usage counter is stored in this browser.

Deletion and cancellation

You can delete local and cloud copies independently. Cancelling a paid plan does not delete saved cloud records; you can still read and delete them. Deleting your shared Emberkit account removes its invoice records, numbering and usage data from the application database. Provider backups may retain copies for their normal backup lifecycle.

Providers

Vercel serves application files and may log IP addresses, page requests and browser information. Stripe processes subscriptions and billing details. Customer invoices, line items and logos are not sent to Stripe. This release does not email customers or collect their payments.

Contact support with privacy questions.