Hexkeeper Privacy Policy

Hexkeeper (“the app”) is a bookkeeping app that helps Australian businesses keep a GST-coded ledger and prepare their Business Activity Statement (BAS). This policy explains what information the app handles, where it is stored, and the choices you have. It is written to be read, not to bury things in legalese.

Who we are

Hexkeeper is developed and operated by an independent Australian sole trader (“we”, “us”). For any privacy question you can reach us at the address at the end of this policy.

What information we handle

Account information. When you create an account we store your email address, which is used to sign you in and to send essential emails such as password resets and business invitations.

Business data you enter. The information you record to keep your books — your business name and (optionally) ABN, transactions (amounts, dates, categories, GST treatment, counterparties and notes), receipt images, and the bank-import lines you choose to accept. This is the core of what the app is for.

Subscription status. Whether your business is on a trial or a paid plan, and the plan’s tier and expiry. This comes from Apple; see “Payments” below.

Where your data is stored

Your account and business data are stored using Supabase, our database and storage provider, in a project hosted in Australia (the AWS Sydney region, ap-southeast-2). Receipt images are held in a private storage bucket belonging to your business.

Access is enforced at the database level: every record belongs to a business (“organisation”), and only signed-in members of that business can read or write its data. Members of one business cannot see another’s.

Bank import — what we don’t keep

When you import a bank statement, Hexkeeper shows the lines to you for review. Only the transactions you mark as business are saved into your ledger. Lines you skip are discarded and never stored. This is deliberate: the app is built so your personal spending never has to enter our system, and so your BAS figures only ever reflect transactions you explicitly marked as business.

Receipt scanning

When you scan a receipt, the text recognition (OCR) that reads the merchant, amount and date runs entirely on your device using Apple’s frameworks. The receipt image you choose to attach is uploaded to your business’s private storage so it’s available as evidence across your devices and to your team; you can delete it at any time.

Email

We use Resend to deliver essential transactional emails (sign-in confirmation, password reset, and business invitations). Only the recipient address and the message needed to deliver that email are processed. We do not send marketing email.

Payments

Subscriptions are purchased and managed through the Apple App Store. Apple processes your payment and manages billing and renewals — we never receive or store your card or payment details. We store only the resulting entitlement (your plan tier and expiry) so the app knows your subscription is active.

Analytics, advertising and tracking

Hexkeeper contains no advertising, no analytics SDKs, and no third-party trackers. If you download the app from the App Store, Apple may provide us with aggregated, anonymous statistics (such as download counts and crash summaries) that do not identify you.

How we use the information

We use the information solely to provide the app: to authenticate you, store and sync your books, generate your BAS figures and exports, send the essential emails above, and enforce your subscription. We do not sell your data or use it for advertising.

Your control over your data

• Export — export your business’s transactions, categories, accounts and lodgements as a file from Settings.
• Delete — delete individual records in the app, or delete your account from Settings. If you are the sole owner of a business, deleting your account removes that business and its data; if others are members, you’ll be asked to hand it over first.
• Access & correction — you can view and edit your data directly in the app, or contact us for help.

Data retention

We keep your data for as long as your account and business exist so the app can function. When you delete your account or a business as described above, its data is removed from our live database. Routine backups are retained for a short period and then expire.

Children’s privacy

Hexkeeper is a tool for businesses and is not directed at children. We do not knowingly collect information from children.

Changes to this policy

If this policy changes, we’ll post the updated version at this address with a new effective date.