Privacy policy
Tiny Accounts holds your bookkeeping records. This page says exactly what is stored, where it sits, who else can touch it and how to get rid of it.
Who is responsible
The controller of your personal data is [PLACEHOLDER - data controller name], [PLACEHOLDER - registered address] (company number [PLACEHOLDER - company registration number]). For anything in this policy, including access and deletion requests, write to [PLACEHOLDER - support contact email].
What we collect
Only what the product needs to work. There is no tracking profile, no ad network.
| Data | Why |
|---|---|
| Email address | Identifies your account and is how you sign back in. Guest accounts get a generated address (anonymised_…@tiny-accounts.com) and no real email is asked for. |
| Password hash | Stored as a bcrypt hash. The plain password is never written to the database or to logs. |
| Currency preference | Formats amounts in the app and in exports. |
| Transactions | Amount, income or expense, category, optional note, date, and whether the entry came from a recurring rule. This is the service. |
| Recurring rules | Amount, frequency, start and end dates, so repeat payments appear on time. |
| Invoices | Your own business details and your client's (name, address, city, email, phone), line items, tax rate, totals and notes. Entered by you, used to build the PDF. |
| Usage analytics | Page views and a signup event, only if you accept analytics in the cookie banner. See the cookies and storage page. |
We do not ask for a payment card, a phone number, a date of birth, a tax number or a bank connection. Any such details that appear in an invoice are there because you typed them in.
Legal basis
- Performance of a contract — your account, transactions, recurring rules and invoices. Without them there is no service.
- Consent — product analytics. Off until you accept, and withdrawable at any time from the cookies page.
- Legitimate interest — keeping the service secure and available (server logs held by our hosting providers).
Where your data is held
- Supabase (Postgres database) — stores every record listed above. The database has row level security enabled with no public policies; only the application server can read it, and every query is filtered by your user id.
- Vercel (application hosting and, with consent, Vercel Analytics) — serves the app and processes request metadata such as IP address in the course of delivering it. Vercel Analytics is designed not to use cookies or to build cross-site profiles.
Both are processors acting on our instructions under their own data processing terms. Hosting region and any resulting international transfer: [PLACEHOLDER - governing jurisdiction] — confirm before launch.
What we do not do
Your figures are not sold, not rented, not shared with advertisers or data brokers, and not used to train machine learning models — not by us, and not under any arrangement we have with a processor.
Security
- Traffic is served over HTTPS.
- Passwords are hashed with bcrypt and never stored in plain text.
- Your session is a signed JSON Web Token kept in your browser's local storage and sent as an Authorization header. Anyone with access to your device and browser profile can use it, so sign out on shared machines.
- Database access from the browser is blocked at the database level; the server holds the privileged key and filters every read and write by account.
No system is perfect. If you find a security problem, please report it to [PLACEHOLDER - support contact email] (or emmett@frogleapsoftware.io) before disclosing it publicly.
How long it is kept
Account data is kept until you delete it. Deleting your account removes your user record and cascades to every transaction, recurring rule, invoice and invoice line item belonging to it, immediately and without a grace period. Backups held by our hosting providers roll off on their own schedule.
Your rights
Depending on where you live you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a portable copy. In this app:
- Access and portability — Export in the month header produces a CSV of your transactions for any date range; each invoice exports as a PDF.
- Correction — every record is editable in the app.
- Erasure — Delete account in the account menu, bottom of the sidebar. It is immediate and irreversible.
- Withdraw consent — the analytics choice can be changed at any time on the cookies page.
You also have the right to complain to your local data protection authority ( [PLACEHOLDER - governing jurisdiction] ).
Children
Tiny Accounts is a business bookkeeping tool. It is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, write to [PLACEHOLDER - support contact email] and it will be deleted.
Changes
If this policy changes in a way that affects how your data is used, the date at the top of this page changes with it and the change is announced in the app before it takes effect.