Privacy
Effective June 2026
What we store
Your account email and a salted password hash; the invoices, contracts, clients, expenses, and tax settings you create; receipt photos you upload; and e-signatures collected on your documents. Data lives in Cloudflare's network (D1 database, KV session store, R2 file storage).
What we never see
Card numbers or bank details — payments happen entirely on your own payment processor's pages. We don't sell data, run ads, or use third-party analytics trackers.
Cookies
One cookie: your sign-in session. It's HTTP-only and expires after 30 days or when you sign out.
Who can see your documents
Pay and signing pages are reachable only through unguessable links you choose to share with your clients. Receipts and exports are visible only to your signed-in account.
Transactional email (invoice delivery, password resets) is sent through Resend using the address you provide for your client. Nothing is added to marketing lists.
Deletion & export
Year-end CSV exports are available from the dashboard. To delete your account and all its data, contact the operator of this InvoWav instance.