01Who we are
InvoiceOak: Invoice Maker ("InvoiceOak", "the app") is published by Barrens Soft, the studio name of Daniel Yankov, an independent solo developer ("we", "us"). For the personal data described in this policy we are the data controller.
Contact for anything privacy-related: apps@barrenssoft.com.
02The short version
- Your invoices, quotes, clients, items and business details are stored on your device. We do not receive them.
- We use Google Firebase for a sign-in account, crash reports, usage analytics and remote configuration, and Google AdMob for ads in the free version.
- Analytics never include invoice contents, and amounts are only sent as rough ranges. You can switch analytics off in Settings.
- You can delete your account and the app's data at any time in Settings → Account → Delete account.
03Data stored only on your device
The app is offline-first. Everything you enter to run your business is kept in a local database (SQLite) on your phone or tablet:
- your business profile (name, address, tax and registration numbers, bank details, logo, invoice settings);
- your clients and their details;
- your items and prices;
- invoices, quotes, proformas, credit notes, payments and reminders.
This data is not uploaded to us or to Firebase. There is no cloud sync at the moment. Your logo is chosen through the system photo picker and stays on the device.
Planned: optional cloud sync. We plan to offer optional sync through a backend hosted in the EU. Data would only be uploaded if you switch sync on. We will update this policy before that feature is released.
Because the data lives on your device, uninstalling the app or losing the device can erase it. Use the backup and export features (see section 6) to keep your own copies.
04Data processed through third-party services
To run the app we use the following services from Google (and the app stores for purchases). They process limited data on our behalf or, where stated, as independent controllers.
| Service | What is processed | Why |
|---|---|---|
| Firebase Authentication | A random user ID created anonymously on first launch. If you choose to link your account with Google, Apple or email and password: your email address (and, for Google or Apple sign-in, the identifier from that provider). | To give you an account that can be linked, restored and deleted, and to restore purchases. |
| Firebase Crashlytics | Crash reports and diagnostic data: device model, OS version, app version, stack traces, and a crash-report installation ID. Our logging removes email addresses, IBANs and tax-ID patterns before anything is sent. | To find and fix crashes and errors. |
| Firebase Analytics | App usage events (for example "invoice issued" or "paywall shown"), the app-instance ID, device and OS information, approximate country (derived from the IP address, which is not stored by us). No invoice contents, client names or item names are sent; amounts are only sent in broad ranges (buckets). | To understand which features are used and improve the app. You can turn this off in Settings → Privacy & display → Share usage analytics. |
| Firebase Remote Config | An installation ID and basic device and app information, used to fetch configuration values. | To adjust app settings and features without an app update. |
| Google AdMob (free version only) | Advertising ID (where available and permitted), IP address, device information, and ad-interaction data. | To show banner ads on list screens and optional rewarded videos. See section 5. |
| Google Play Billing / Apple App Store | Purchase and subscription status. Payment details are handled entirely by Google or Apple. | To sell and restore InvoiceOak Pro and Remove ads. We never see or store your card or payment details. |
Google's privacy policy: policies.google.com/privacy. How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites. Apple's privacy policy: apple.com/legal/privacy.
05Advertising and consent
The free version shows banner ads on the Documents, Clients and Items list screens and offers optional rewarded videos (for example, to unlock an extra invoice). Ads are never placed on the documents your clients receive. Buying InvoiceOak Pro or Remove ads turns ads off.
- EEA, UK and Switzerland: before any ad is requested, we ask for your consent using Google's User Messaging Platform (UMP), a certified consent tool. If you do not consent, only non-personalised ads (or no ads) are shown. You can change your choice at any time in Settings → Privacy & display → Ad privacy options.
- iOS: the app asks for permission through Apple's App Tracking Transparency prompt before the advertising identifier can be used for tracking. If you decline, the identifier is not available to us or to AdMob.
- Android: you can reset or delete your advertising ID in your device's Google settings.
06Permissions and device features
- Email: when you email a document, the app opens your device's own mail app with the PDF attached. The message is sent by your mail app and provider, not by us.
- Printing: printing uses your operating system's print service, or a Bluetooth receipt printer that you pair in Settings.
- Bluetooth: the Bluetooth permission is requested only when you set up a receipt printer, and is used only to find and connect to printers. The app does not request location access and does not use Bluetooth to locate you.
- Photos: used only when you pick a logo; the image stays on your device.
- Backups and exports: backup ZIP files, CSV exports, PDFs and e-invoice XML files are created on your device. Where they go is up to you: they are shared through the system share sheet to the app or place you choose.
07Your clients’ personal data
When you enter details about your clients (for example a name, address, email or tax number) and issue documents to them, you are the controller of that data under the GDPR and similar laws. It stays on your device and we do not receive it, so we are not a processor of it either. You are responsible for having a lawful basis to process it and for keeping it for as long as your tax or accounting rules require.
08Legal bases (EEA and UK)
- Performance of a contract (Art. 6(1)(b) GDPR): providing the app, your account, and your purchases.
- Legitimate interests (Art. 6(1)(f)): crash reporting, remote configuration, security, and usage analytics to improve the app. You can object to analytics at any time by turning it off in Settings.
- Consent (Art. 6(1)(a)): personalised advertising and the related use of device identifiers, collected through the consent message. You can withdraw consent at any time in Settings; this does not affect processing that took place before.
- Legal obligation (Art. 6(1)(c)): where we must keep or disclose data by law.
10How long we keep data
- On your device: until you delete it, delete your account, or uninstall the app.
- Firebase Authentication account: until you delete your account in the app or ask us to delete it.
- Crashlytics crash reports: kept by Google for up to 90 days.
- Analytics: event data is kept for no longer than 14 months, the maximum retention setting of Google Analytics for Firebase.
- Advertising data: retained by Google under its own policies.
- Emails you send us: as long as needed to answer you, and then deleted within a reasonable time unless we need them to establish or defend legal claims.
11Deleting your account and data
In the app, go to Settings → Account → Delete account. This deletes your Firebase account and wipes the app's local data on that device. It cannot be undone, so make a backup first if you want to keep your documents; tax rules in many countries require you to keep issued invoices for several years.
You can also ask us by email to delete your account and any data we can link to you: apps@barrenssoft.com. Deleting the app does not cancel a subscription; see the Terms of Use.
12Your rights
Depending on where you live, and in particular under the GDPR, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing, including processing based on legitimate interests and any processing for direct marketing;
- data portability;
- withdraw consent at any time;
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In Bulgaria this is the Commission for Personal Data Protection (cpdp.bg).
To exercise a right, email apps@barrenssoft.com. Because we do not know who you are unless you link an account, we may need your account email or user ID to find your data. We reply within one month.
13Children
InvoiceOak is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
14Security
Data sent to Firebase and AdMob is encrypted in transit. Data on your device is protected by your device's own security (screen lock and storage encryption), so keep your device locked. Backup files you export are not encrypted by the app; store and share them carefully.
15Changes to this policy
We will update this policy when the app or the law changes, including before any cloud sync feature is released. The effective date at the top shows the current version. If a change is significant, we will also tell you in the app.
16Contact
Barrens Soft (Daniel Yankov) · apps@barrenssoft.com
See also our Terms of Use.