Privacy Policy

Last updated: February 20, 2026

Overview

Invoix.Xyz is designed with privacy at its core. Your invoices, client data, and business information are stored locally on your device (desktop app) or in your personal browser storage (web app). We do not sell, share, or monetize your data.

What We Collect

Email address — only if you sign up for an account (web app) or join the waitlist.
OAuth tokens — if you connect Gmail or Outlook for email sending. Tokens are AES-256-GCM encrypted at rest and stored on our backend.
Basic analytics — we may collect anonymous usage metrics (page views, feature usage) to improve the product. No personal data is included.
IP address — temporarily processed for rate limiting and abuse prevention. Not stored long-term.

What We Don't Collect

Your invoice content, line items, or financial data
Your client names, addresses, or contact details
Your business information or logo
Payment card details (payments are handled entirely by LemonSqueezy)
The content of emails you send through the Service

Cookies & Local Storage

The desktop app and web app use browser local storage (not cookies) to persist your invoices, settings, and preferences on your device. This data never leaves your device unless you explicitly use the email or export features.

The web app may use essential cookies or local storage tokens for authentication purposes. We do not use advertising or tracking cookies.

Data Storage

Desktop app: All data is stored locally on your machine in the app's data directory. Nothing is sent to our servers unless you explicitly use the email sending feature.

Web app: Invoice data is stored in your browser's local storage. Account authentication and encrypted OAuth tokens are managed through our backend infrastructure.

Data Retention

OAuth tokens — stored for as long as the email integration remains connected. Deleted immediately when you disconnect from Settings.
Waitlist emails — retained until the product launches publicly, after which they are deleted unless you create an account.
Account data — retained for as long as your account is active. Deleted upon request.

Third-Party Services

Supabase — authentication and encrypted token storage (web app)
Google OAuth / Gmail API — Gmail email integration (only if you connect it)
Microsoft OAuth / Outlook API — Outlook email integration (only if you connect it)
LemonSqueezy — payment processing for desktop licence purchases
Vercel — web app and landing page hosting
Microsoft Azure — backend API hosting

Each third-party service has its own privacy policy. We encourage you to review them. We only share the minimum data necessary for each service to function (e.g., your email address for authentication, OAuth tokens for email sending).

Google API Limited Use Disclosure

Invoix.Xyz's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Gmail access to send invoices on your behalf when you explicitly trigger the send action.
We do not read, scan, or store the contents of your inbox or sent emails.
We do not use Gmail data for advertising, market research, or any purpose other than sending your invoices.
We do not transfer Gmail data to third parties except as necessary to send the email.
Your Gmail data is never accessed or reviewed by anyone at Invoix.Xyz.

International Data Transfers

Our backend infrastructure is hosted on Microsoft Azure and Supabase, which may process data in the United States or other regions. By using the web app's email integration features, you consent to your encrypted OAuth tokens being transferred to and processed in these regions. All transfers are protected by encryption in transit (TLS) and at rest (AES-256-GCM).

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate personal data.
Erasure — request deletion of your personal data and account.
Data portability — export your data using the built-in export/backup feature in the app.
Withdraw consent — disconnect email integrations at any time from Settings.
Objection — object to processing of your personal data for specific purposes.

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

Desktop app data is entirely under your control and can be deleted by uninstalling the application or clearing the app's data directory.

Children's Privacy

Invoix.Xyz is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or website. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Reach out at hello@invoix.xyz.