Privacy Policy
Last updated: 10 October 2026
BusinessOS is built on a simple principle: your business data is yours. This policy explains, in plain language, exactly what we do and don't do with your information.
What we DON'T collect
- Your business data. Invoices, expenses, customers, revenue, bank details — all encrypted on your device before anything leaves. We literally cannot read it.
- Your invoice content. The customer names, amounts, and line items on your invoices are encrypted with a key derived from your password. Not stored in any readable form on our servers.
- Third-party tracking cookies. No Facebook pixel, no ad-tech, no cross-site tracking.
- Voice recordings. Voice invoicing runs entirely on your device via the browser's Web Speech API. No audio is ever transmitted.
What we DO collect
- Your account details — email, name, phone number, country, currency and chosen plan, as you enter them at signup. Used for sign-in, support and product updates, and visible to the BusinessOS team so we can help you. Never sold, never shared.
- Activity times — when you sign up, sign in, sign out and were last active, so we can support users and understand how the product is used.
- Anonymous website statistics — daily visit counts and answers to our optional “why are you leaving?” question. Not linked to any person.
- Your password (hashed). We store a one-way hash, not the password itself. Even we cannot recover it if forgotten.
- Basic operational logs. Server response codes, error logs, IP address on connection — retained briefly for debugging and abuse prevention.
- Anonymous usage analytics. Aggregated page views and feature usage to help us improve the product. Never linked to your business data.
How your data is encrypted
BusinessOS uses AES-GCM for symmetric encryption and PBKDF2 to derive an encryption key from your password. Cross-device cloud sync is on by default (you can turn it off in Settings): your data is encrypted on your device first, then only the encrypted bytes are uploaded. Our servers only ever see encrypted noise.
This is called zero-knowledge architecture. It means:
- If our servers are breached, an attacker gets encrypted bytes — not your data
- If we receive a subpoena, we can only hand over encrypted bytes
- If you forget your password, even we cannot recover your data (use a password manager)
Data sharing and selling
We do not sell, rent, trade, or share your data with third parties for marketing, advertising, AI training, or any commercial purpose. This isn't a legal promise — it's structurally impossible under our architecture, because we don't have your data in a readable form to sell.
Third-party services
- Firebase (Google) — used for authentication and encrypted cloud storage. Data stored via Firebase is always encrypted client-side before upload.
- Google Analytics — anonymous aggregate visitor stats (IP anonymized) on the website and app. Never sees your business data.
Your rights
- Access — download your data at any time from Settings → Export
- Deletion — delete your account at any time. Deletion is permanent and irreversible
- Portability — export data as CSV or JSON
- Correction — edit any record within the app
Cookies
We use only essential cookies required for the app to function (authentication session, user preferences). No advertising or third-party tracking cookies.
Children
BusinessOS is intended for use by businesses and professionals. We do not knowingly collect data from anyone under 16.
Changes to this policy
If we update this privacy policy, the new version will replace this page and the "Last updated" date will change. Material changes will be communicated by email.
Contact
Questions about privacy? Reach out through the app's feedback link or via our public profiles. Every message gets a reply.