Effective October 14, 2026
This Privacy Policy explains how we handle information when you use the iOS app (the “App”), visit our public website, or contact support. The App is designed as a local-first invoice maker and does not require a separate account.
The App lets you enter and store information used to create invoices, including:
This information is stored in the App's private container on your device. The App may create a local database backup before a database upgrade so that it can recover from a failed migration. The backup remains inside the App's container.
On iOS 17 and later, when iCloud is available, the App automatically synchronizes business details, clients, catalog items, and invoices through your private Apple CloudKit database. This private data belongs to your Apple Account, counts against your iCloud storage, and is not uploaded to Firebase, Amplitude, or servers operated by us. The App stores document content in a CloudKit encrypted field. Technical record metadata, such as a random synchronization identifier and timestamps, does not contain invoice content. On iOS 16 or when iCloud is unavailable, the App continues to work locally without synchronization.
When you export or share an invoice, iOS presents the system share sheet. Any transfer to another app, person, or service happens only through the destination you select and is then governed by that destination's privacy practices.
Release versions of the App use Amplitude to understand whether core screens and subscription flows work as expected. Debug builds do not send analytics.
The App sends event names describing actions such as opening a screen, creating or editing an invoice, viewing subscription plans, restoring purchases, the outcome of a purchase attempt, and whether iCloud synchronization was available or completed. A purchase event may include the App Store product identifier, and a plan-toggle event may include whether all plans were shown. We do not send invoice contents, business details, client details, logos, payment credentials, or generated PDFs to Amplitude.
Amplitude also records sessions and basic application lifecycle events. Its SDK may process a pseudonymous device identifier, a customer identifier, product interaction data, purchase-related data, and general device or app metadata for analytics. We have disabled automatic screen-view capture, element-interaction capture, network capture, IDFV collection, carrier collection, IP-derived location properties, remote autocapture configuration, and SDK diagnostics. We do not use this data to target you across other companies' apps or websites.
To measure our Apple Ads campaigns, the App requests attribution information through Apple's AdServices framework. Our backend associates the resulting campaign, ad group and keyword identifiers, when available, with a pseudonymous customer identifier, app usage and subsequent subscription payments. Apple may not provide attribution for every installation; we do not treat missing attribution as proof of a particular acquisition source. We do not collect the advertising identifier (IDFA).
Analytics is sent to Amplitude's United States data region. See the Amplitude Privacy Notice.
Subscriptions are offered through Apple's StoreKit and are processed by Apple. Apple handles your App Store account, payment method, billing, and refunds. Our backend verifies Apple's signed purchase records and receives subscription notifications, including renewals and refunds even when the App is not open. These records include pseudonymous app/customer and transaction identifiers, product identifiers, purchase and expiry dates, subscription status, price and currency. We use them for subscription support and to understand whether our acquisition campaigns recover their cost. We do not receive your Apple Account password, payment card or bank details. See Apple's Privacy Policy.
The App uses Firebase Authentication to create an anonymous technical identity without asking you to register or sign in. Firebase App Check and Apple's App Attest or DeviceCheck help validate app requests. The Firebase SDK may also send limited diagnostic and SDK metadata to Google. A random customer identifier is also supplied to Apple with purchases and to Amplitude so that initial purchases and later renewals can be associated consistently. A device Keychain identifier may remain after reinstalling the App. The backend uses Google Cloud Functions and Firestore in a European region; Firebase's authentication/security services and Amplitude may process data elsewhere under their respective policies.
Our public website contains product information and legal documents and is hosted on Firebase Hosting. Google may process ordinary request information, such as an IP address and browser or device metadata, to deliver and secure the site. See the Google Privacy Policy.
If you email support, we receive the address you use and any information you choose to include. Please do not send invoice contents, client details, or other confidential information unless it is necessary for your request.
You can view your synchronized business and invoice data in the App and export invoices as PDFs. You may ask us to delete support or analytics information associated with you. Because the App requires no registration and uses pseudonymous identifiers, we may need additional information to locate a record and may not always be able to connect a record to you. Deleting local invoice data does not automatically delete separately retained subscription or analytics records. We cannot access or delete content held only in your private iCloud database on your behalf.
Where applicable law requires a legal basis, we process information as necessary to provide requested services, based on our legitimate interests in operating and improving the App, with consent where required, or to comply with legal obligations.
We use Apple for private iCloud synchronization, subscriptions and Apple Ads attribution, Amplitude for limited analytics, and Google for authentication, app security, backend data processing and website hosting as described above. We may also disclose information if required by law, to protect rights or safety, or as part of a business reorganization subject to appropriate safeguards. These providers may process information in countries other than your own.
The App is not directed to children who are below the minimum age for consenting to the processing of personal information in their jurisdiction. We do not knowingly request personal information from children.
We use reasonable technical and organizational measures appropriate to the information we handle. No device, transmission method, or storage system can be guaranteed to be completely secure. You are responsible for securing your device and for choosing safe destinations when sharing invoices.
We may update this policy when the App or our practices change. The effective date above identifies the current version.
For privacy questions, access or deletion requests, or other support, email ios-app-support@pm.me.