Privacy Policy — BizTracker

🔒 Short version: We collect only what we need to run the service. We never sell your data. We never share your business information with advertisers. You can export or delete your data at any time.

1. Who We Are

BizTracker is a business finance platform operated in the United States. We provide invoicing, expense tracking, mileage logging, and financial reporting for small businesses.

Privacy contact: privacy@biztracker.app

2. What Data We Collect

Account information (you provide)

Name and email — required to create your account
Business name and type — entered during signup
Password — stored as a secure hash. We never see your actual password.

Business data (you enter)

Data	Includes	Why
Invoices & Quotes	Numbers, amounts, dates, line items	Core feature
Customer info	Names, emails, phones, addresses	Document generation
Income & Expenses	Dates, amounts, categories, vendors	Financial tracking
Mileage	Dates, addresses, miles, GPS points	IRS deduction tracking
Business profile	Address, phone, logo, signature	Appears on documents
Receipt photos	Images you upload	Expense documentation

Technical data (automatic)

Device type and browser — to optimize the app
IP address — for security and fraud prevention
Login timestamps — for your security audit log
Anonymized usage patterns — which features are used (no personal data)

What we do NOT collect

❌ Your customers' card numbers (Stripe handles payments directly)
❌ Continuous location tracking (GPS only activates when you tap Start Trip)
❌ Contacts, calendar, or data from other apps
❌ Advertising trackers or analytics pixels of any kind

3. How We Use Your Data

Purpose	Data used	Basis
Provide the service	All business data	Contract
Account security	Email, IP, login times	Legitimate interest
Billing	Email, subscription status	Contract
Customer support	Account info on request	Legitimate interest
Fraud prevention	IP, usage patterns	Legitimate interest
Service improvement	Anonymized usage stats only	Legitimate interest
Legal compliance	As required by law	Legal obligation

We never use your data for advertising, AI training, or resale.

4. How We Protect Your Data

🔐 Encrypted in transit — TLS 1.2+ (same as banking websites)
🔐 Encrypted at rest — AES-256 encryption on all stored data
🏦 Google Firebase infrastructure — SOC 2 Type II and ISO 27001 certified
🔒 Complete data isolation — Firestore security rules ensure no user can access another's data
👤 Minimal staff access — only for verified support with your permission
🗑 Deleted on request — account data permanently deleted within 30 days of deletion request

5. Who We Share Your Data With

Provider	Purpose	What they receive
Google Firebase	Database & authentication	All app data (encrypted)
Stripe (optional)	Payment processing	Invoice amounts only — if you enable it

We never share with: advertisers, data brokers, social media platforms, other BizTracker users, or any third party for commercial purposes.

We may disclose data if required by a valid legal order. We will notify you unless legally prevented.

6. Your Rights

👁 Access

Get a copy of all data we hold about you

✏️ Correct

Fix inaccurate information in your profile

🗑 Delete

Permanently erase your account and all data

📥 Export

Download all your data in JSON format

🚫 Object

Object to certain types of processing

⏸ Restrict

Limit processing while a dispute is resolved

To exercise any right: Settings → Security in the app, or email privacy@biztracker.app. We respond within 30 days.

7. Cookies

We use only essential cookies required to operate the app:

Authentication token — keeps you signed in (Firebase session)
Local preferences — logo, signature, settings stored in your browser only (never sent to us)

We use no advertising cookies, no tracking pixels, no Google Analytics, no Facebook tracking of any kind.

8. Children

BizTracker is not intended for anyone under 18. We do not knowingly collect data from children. Contact privacy@biztracker.app to report any concern.

9. California & GDPR

California (CCPA): We do not sell your personal information. California residents have the right to know, delete, and opt out of sale (we don't sell). Contact us to exercise these rights.

European users (GDPR): Our legal bases are contract performance, legitimate interest, and consent. You may lodge complaints with your local data protection authority. We process data in the United States.

10. Data Retention

Active account data: Kept while your account is active
Deleted account: Permanently removed within 30 days
Backup copies: Purged within 90 days of deletion
Security logs: Retained 12 months for fraud prevention

11. Changes

We will notify you by email and in-app notice at least 30 days before any material changes. Continued use after the effective date means you accept the updated policy.

12. Contact

📧 Privacy: privacy@biztracker.app
📧 Support: support@biztracker.app
⏱ Response: Within 30 days (usually much faster)