Privacy Policy Effective Date: 22/06/2026 Last Updated: 22/06/2026 Application: Invoice Application (“the App”) Publisher / Data Controller (where applicable): Albana Seferi
This Policy is drafted to comply with:
The UK General Data Protection Regulation (UK GDPR) as incorporated by the Data Protection Act 2018; The Privacy and Electronic Communications Regulations 2003 (PECR); The Apple App Store Review Guidelines and Apple App Privacy Details (“Nutrition Label”) requirements; The Google Play Developer Program Policies and Data Safety disclosures; HMRC record-keeping standards relevant to invoicing and accounting software. Architectural Summary (Plain English): The App is a device-only application. It does not transmit, sync, back up, or otherwise send your data to the developer, to any cloud server, or to any third-party service. All information you enter is stored exclusively on your device in an encrypted local database. The developer has no servers, no accounts, no telemetry, and no ability to access your data.
You, the user, remain the sole controller of all data you input, including any personal data of your clients, customers, or suppliers (“Third-Party Data”). Where you process Third-Party Data in the course of your business activities, you are independently responsible for compliance with UK GDPR and the Data Protection Act 2018, including providing your own privacy notice to your clients where required.
No Account, No Sign-Up, No Authentication The App does not require account creation or registration. The App does not offer or integrate third-party sign-in (no Sign in with Apple, no Google Sign-In, no Facebook Login, no Microsoft Account, no other federated identity provider). The App does not collect or store user account passwords. The App does not use biometric authentication (no Face ID, no Touch ID, no Android fingerprint authentication). No NSFaceIDUsageDescription is declared and no biometric APIs are invoked. There is no developer-side identity, no customer record, and no profile maintained anywhere off-device.
Information You Enter Into the App (Stored Locally Only) The App enables you to enter and store the following categories of information solely on your device. None of this information is transmitted to the developer or to any third party as a result of entering or storing it.
4.1 Your Business Profile First name and last name Business / trading name Contact email address Contact phone number Service address Business / trading address Registered company name (if a limited company) Registered office address (if a limited company) Company Registration Number (CRN) VAT registration number Bank account number Sort code or IBAN Bank name Payee name Company logo image These fields are used solely to render your information on invoices, estimates, and other documents you generate within the App. Bank details are stored as plain string fields for the sole purpose of being printed on invoice PDFs. The App does not connect to bank accounts, the Open Banking APIs, or any payment-initiation service.
4.2 Client / Customer Data (Third-Party Data) For each client you add, the App stores locally: Client name Company name Email address Phone number Billing address A soft-deletion flag enabling reversible deletion The App does not store VAT registration numbers or company registration numbers for your clients. You are responsible, as the independent data controller of your client data, for ensuring you have a lawful basis under UK GDPR Article 6 (typically legitimate interests or contract performance) for processing your clients’ personal data and for issuing your own privacy notice to them where required by Articles 13–14.
4.3 Invoice and Estimate Data Invoices: invoice number, issue date, supply date, due date, paid status, workflow status, tax percentage, discount (percentage and amount), subtotal, tax amount, grand total Estimates: estimate number, issue date, validity date, status, and the same financial fields Line items: description, quantity, unit price, tax percent Payment records: amount, date received, notes Invoice history: event type, timestamp, free-text detail.
4.4 Expense Records Amount Date Vendor name Category (selected from a fixed list of nine: Materials & Supplies; Software & Subscriptions; Travel & Transport; Office & Workspace; Marketing & Advertising; Professional Services; Equipment; Meals & Entertainment; Other) Free-text notes Optional receipt photograph (stored as a local image file path on the device).
4.5 Receipt and Logo Images The App allows you to capture or import images for two purposes only: Receipt photographs attached to expense records. Company logo image displayed on your invoices and estimates. Images are stored only in the App’s local data directory on your device. No optical character recognition (OCR) is performed at any stage; no OCR libraries or third-party OCR APIs are integrated. Images are never uploaded to any cloud service by the App.
Information We Do Not Collect To remove any ambiguity, the App and developer do not collect, transmit, or receive: Device model, OS version, app version, language, time zone, or IP address; Persistent advertising or tracking identifiers (no IDFA, no IDFV, no Android Advertising ID, no Firebase Installation ID, no Google Advertising ID); Geolocation data of any kind (no NSLocationUsageDescription, no Android ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION permissions, no Geolocation API calls); Crash reports, diagnostic logs, or telemetry; Analytics or usage events; Cookies or web beacons (the App is not a web app and does not embed web tracking). The App does not trigger Apple’s App Tracking Transparency (ATT) prompt because it performs no tracking; no NSUserTrackingUsageDescription key is declared and the AppTrackingTransparency framework is not used.
Device Permissions The App requests certain operating-system permissions strictly for the on-device functions described below. Each permission is requested in context, and the App functions to the maximum extent possible if you decline.
6.1 Camera Purpose: (a) Capturing receipt photographs for expense records; and (b) taking a photo to use as your company logo on invoices and estimates. iOS purpose string (NSCameraUsageDescription): “This app needs access to the camera to take photos.” Android permission: android.permission.CAMERA. Camera hardware is declared optional; the App functions without it.
6.2 Photo Library / Storage Purpose: (a) Selecting an existing image as your company logo; and (b) selecting existing receipt images for expense records. iOS purpose strings: NSPhotoLibraryUsageDescription and NSPhotoLibraryAddUsageDescription — “This app needs access to the photo gallery for picking photos.” Android permissions: READ_EXTERNAL_STORAGE and READ_MEDIA_IMAGES (as applicable to the Android API level).
6.3 Contacts Purpose: To allow you to import a client’s name, company, email, phone number, and postal address from your device address book when creating a new client record. This is a one-time, user-initiated read triggered by the “Import from Contacts” button. iOS: Uses the system contact picker (CNContactPickerViewController), which provides Apple’s own consent flow and limits disclosure to the single contact you select. Android permission: android.permission.READ_CONTACTS. Imported contact data is written to the local encrypted SQLite database and is not transmitted off-device. No other sensitive permissions are requested. The App does not use the microphone, calendar, reminders, motion sensors, health data, HomeKit, or background location.
7.1 Local Encrypted Storage All structured data is stored in a single SQLite database located at the App’s private application data directory (FileSystem.AppDataDirectory/InvoiceApp.db3), encrypted at rest using SQLCipher with AES-256. The database encryption key is a 256-bit random value generated on the device using a cryptographically secure random number generator (RandomNumberGenerator.GetBytes(32)). The key is stored exclusively in the platform’s secure storage: the iOS Keychain (backed by the Secure Enclave on supported devices) and the Android Keystore (backed by hardware-backed key storage where available). The key is app-generated and device-secured. It is not customer-managed in the enterprise sense, is never exported, and is never transmitted off-device. Media files (receipt and logo images) are stored within the App’s sandboxed application data directory and are protected by operating-system file-system sandboxing.
7.2 Backup Export Encryption When you choose to export a complete backup of your data (database plus media files) using the in-app data-management feature, the resulting archive is encrypted with AES-256-GCM using a key derived from a password you supply at the time of export via PBKDF2-SHA256 with 210,000 iterations. The same password is required, transiently, to decrypt the archive on import. Backup passwords are never stored by the App; they exist only in memory for the duration of the export or import operation. If you forget the backup password, the backup cannot be decrypted by the developer or by anyone else.
7.3 Access Controls Because there is no server, no developer endpoint, no remote administration capability, and no developer-side data store, no developer or third party can access your data remotely. Data security relies on: SQLCipher AES-256 encryption with a device-stored key; Platform application sandboxing on iOS and Android; Secure storage of the encryption key in Keychain / Keystore; The physical and logical security of your device (which you control via passcode, biometrics, and OS updates).
7.4 Network Activity The App contains no networking client code. There is no HttpClient, WebClient, RestClient, HttpRequest, or equivalent in the codebase. The App does not open sockets to remote hosts. As a matter of architecture, your data cannot leave the device by means of the App itself.
Third-Party SDKs and Services The App integrates only the following components, all of which operate entirely on-device and none of which transmit personal data externally: Component Function Network Behaviour Microsoft.Maui.Controls Cross-platform UI framework None initiated by the App CommunityToolkit.Maui UI helper components None Microsoft.Extensions.Logging.Debug Debug-only console logging (development builds) None; writes to local debug console only SkiaSharp / SkiaSharp.Views On-device PDF and image rendering None sqlite-net-sqlcipher / SQLitePCLRaw.bundle_e_sqlcipher Local encrypted database None There are no analytics SDKs, no crash-reporting SDKs, no attribution SDKs, no advertising SDKs, no push-notification services, and no third-party authentication providers integrated. No SDK transfers data outside the United Kingdom or the European Economic Area, because no SDK transfers data anywhere.
Sharing and Export of Data
9.1 Native OS Share Sheet When you choose to share an invoice, estimate, CSV report, or backup file, the App invokes the operating system’s native share sheet (UIActivityViewController on iOS, the Android Intent chooser on Android) via the MAUI Share.Default.RequestAsync API. You select the destination (for example, Mail, Messages, AirDrop, Drive, Files, a printer, or another installed app). The developer has no involvement in, and no visibility of, the destination you choose or the recipient you select. Once you hand a file to another app or service via the share sheet, that file becomes subject to the privacy policy and data-handling practices of the destination app or service, which are outside the developer’s control. You should review the privacy practices of any service to which you share data.
9.2 Direct Email or SMS The App does not send invoices or estimates directly via email or SMS through any developer-controlled gateway. All communication is initiated by you through your own apps and accounts.
9.3 Transient Cache for Exports PDF, CSV, and backup files are written to the operating-system-managed cache directory (FileSystem.CacheDirectory) for the purpose of being shared. The App deletes previous exports before generating new ones (CleanPreviousPdfs()), and the operating system additionally manages cache lifetime. No copies of exports are retained server-side, because there is no server.
Payments and In-App Purchases Any paid features of the App are processed exclusively through Apple In-App Purchase on iOS and Google Play Billing on Android. The App does not implement any independent payment processor and integrates no payment SDK. Your payment card details, billing address, and purchase history are handled solely by Apple or Google under their respective privacy policies. The developer receives only the aggregate, anonymised or pseudonymised transaction reports made available by Apple App Store Connect and Google Play Console.
Lawful Basis for Processing (UK GDPR Article 6) To the limited extent that any processing activity engages UK GDPR with the developer as controller (for example, App Store purchase data received from Apple or Google): Performance of a contract (Article 6(1)(b)) — to provide the App and any purchased features. Legitimate interests (Article 6(1)(f)) — to operate, support, and protect the App. These interests are limited and balanced against your rights and freedoms. For all data you enter into the App, you are the controller, and you must determine and document your own lawful basis for processing your clients’ and suppliers’ personal data.
Special Category Data and Automated Decision-Making No special category data (UK GDPR Article 9) is intentionally collected. The App’s data model is composed of business and financial fields. Free-text fields (expense notes, line-item descriptions, invoice history detail) exist; you should refrain from entering health, biometric, racial, ethnic, political, religious, philosophical, trade-union, genetic, sex-life, or sexual-orientation data into those fields. The App performs no automated decision-making, profiling, credit scoring, or machine-learning inference within the meaning of UK GDPR Article 22. Reporting features perform simple arithmetic aggregation of your own data on-device.
Children’s Data The App is intended for adult business users (sole traders, freelancers, and small companies). It is not directed to or designed for children under 13 (UK/US) or under 16 (in those EU Member States that apply the higher age threshold). The App has no features that would knowingly collect data from children. If you believe a child has used the App, you can clear all data instantly using the in-app erase function (see Section 15).
International Data Transfers The App performs no international data transfers. Because no data leaves the device by means of the App, UK GDPR Chapter V (international transfers) is not engaged. If you choose to share an exported file via a third-party service (for example, a cloud email or storage provider), any consequent international transfer is performed by that service under its own terms and is outside the developer’s control.
Your Rights and How to Exercise Them Under UK GDPR Articles 12–22, you have rights of access, rectification, erasure, restriction, portability, and objection in respect of personal data processed about you by a controller. Because the developer holds no personal data about you, these rights are exercised directly within the App in respect of the data you control:
Right of Access (Article 15): All your data is visible to you within the App at all times. You may export it as PDF (per invoice/estimate), CSV (revenue and reporting data), or as a complete encrypted backup archive (database plus media), via the native share sheet. There is no developer-held copy to request. Right to Rectification (Article 16): You may edit any record at any time within the App. Right to Erasure / “Right to be Forgotten” (Article 17): The “Delete All Data” function in the Data Management screen erases the entire local datastore. Specifically, this action: deletes all rows from every table; closes the database connection; removes the encryption key from secure storage; deletes the .db3 database file; and deletes all media files (receipts, logos) from the App’s data directory. A two-tap arm/disarm safety pattern with a 3-second auto-disarm timer prevents accidental erasure. Right to Data Portability (Article 20): The encrypted backup export and the CSV/PDF exports provide your data in commonly used, machine-readable formats. Right to Restrict / Object (Articles 18, 21): As you control all processing locally, you may simply cease to use any feature. Timeline: Erasure and rectification are instantaneous, performed on-device. There is no remote propagation delay because there are no remote copies. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, although the developer notes that, given the architecture described above, there is no developer-side processing for the ICO to investigate.
Data Processing Agreements (DPAs) Because the developer never receives, processes, accesses, or stores any user data or any third-party data entered into the App, the developer is not acting as a Data Processor under UK GDPR Article 28 in respect of such data. Accordingly, a Data Processing Agreement is not applicable and is not offered. Each user is the sole controller of the data they enter and is solely responsible for any onward processing arrangements with their own service providers.
Retention The developer holds no personal data and therefore applies no developer-side retention period. You determine retention of records on your device. The App retains data indefinitely until you delete individual records or invoke the “Delete All Data” function. For HMRC purposes, you should be aware of statutory record-keeping obligations (typically 6 years for VAT records under the Value Added Tax Act 1994 and at least 5 years after 31 January following the relevant tax year for Self-Assessment under the Taxes Management Act 1970) and retain your data accordingly. Uninstalling the App will, on most platforms, delete the App’s local data; you should export a backup before uninstalling if you wish to preserve records.
Security Incidents Because no data is stored or processed on developer infrastructure, a developer-side data breach affecting your records is not possible by the architecture of the App. In the unlikely event of a vulnerability in the App that could compromise on-device data (for example, an encryption flaw), the developer will issue a security update via the App Store and, where required by UK GDPR Article 33–34, notify the ICO and affected users. Users are responsible for the physical security of their devices, the strength of their device passcodes, and the timely application of operating-system updates.
App Store Privacy Disclosures
19.1 Apple App Privacy “Nutrition Label” Consistent with this Policy, the Apple App Privacy disclosure declares “Data Not Collected” across all categories, because no data is sent off-device to the developer. On-device permissions (camera, photo library, contacts) are disclosed in the App’s permission prompts and in this Policy but are not “collection” by the developer within Apple’s definition.
19.2 Google Play Data Safety Form Consistent with this Policy, the Google Play Data Safety disclosure declares no data collected and no data shared by the developer. The form additionally acknowledges: Data is encrypted in transit: Not applicable (no transit occurs). Data is encrypted at rest: Yes (SQLCipher AES-256). Users can request data deletion: Yes (built-in instant in-app erase). These declarations are kept consistent with this Policy at all times. If the App’s behaviour changes in any future release, both store declarations and this Policy will be updated prior to that release.
HMRC and Making Tax Digital Considerations The App is designed to assist users in maintaining digital records relevant to HMRC obligations, including invoices, estimates, expenses, and revenue reports. The App is not itself an HMRC-recognised bridging or filing solution and does not transmit data to HMRC. Where Making Tax Digital filing is required, you must use a separate HMRC-recognised service. CSV exports generated by the App can be used as an input to such a service via the native share sheet at your discretion.
Changes to This Policy The developer may update this Policy from time to time to reflect changes in the App, in applicable law, or in App Store requirements. Material changes will be notified via the App Store release notes and via an in-app notice on next launch following the update. The “Last Updated” date at the top of this Policy reflects the most recent revision. Continued use of the App after the effective date of an updated Policy constitutes acknowledgement of the updated Policy.
Contact For questions about this Policy, please contact: Email: invoiceappcustomersupport@gmail.com For privacy complaints in the UK, you may also contact the Information Commissioner’s Office (ico.org.uk).
Summary (Non-Binding Plain English) Your data stays on your device. The developer has no servers, no accounts, no analytics, no tracking, and no ads. The database is encrypted with AES-256; the key lives in your phone’s secure hardware. You can wipe everything instantly from inside the App. Sharing happens via your phone’s native share sheet — you choose where files go. No data is sent to the developer or to any third party by the App. This Summary is provided for convenience only; the binding terms are set out in Sections 1–22 above.