Privacy Policy

Last updated October 5, 2026

Who we are

Invoic (invoic.dev) is run by Aedan Evangelista in the Philippines. For the details of your own account, we’re the personal information controller under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). For the details you save about your clients, you decide what goes in and what it’s used for; we store it and show it on your behalf. Questions about this policy, or about your data, go to support@invoic.dev.

What we collect

• Your account. Your email address and your timezone. If you sign in with Google, the ID Google gives your account and your verified email address. Nothing else: not your name, photo or contacts.
• What you save. Your business profiles (name, address, email, tax ID); your clients (name, email, billing address, and on the Paid plan a logo); your bank accounts (account holder, bank, account and routing numbers, IBAN, SWIFT and the like, and a private label); and your invoices, with their items, amounts, dates, notes, private names and, on the Paid plan, a payment QR image.
• Signing in. There are no passwords. Each sign-in code is stored only in scrambled (hashed) form, with the address it was sent to, a scrambled form of the IP address that asked for it, which lets us stop someone flooding an inbox with codes, and a scrambled form of a random key in the browser that asked, so only that browser can use the code. We never store your IP address itself. A signed-in browser holds a random key that we also keep only in scrambled form, with when it was made and last used. Each code we send, each sign-in and sign-out, each change of email address and each refused attempt is noted in our server log by account number or a scrambled tag, never with a code or your address. We don’t record your device, browser or location.
• Limits. Making a PDF, or getting ready to make one, is counted against a scrambled form of the IP address, account or link that asked, so no one can overload the site. A count is deleted once it’s a day old, by a clean-up that runs at most every 10 minutes while the site is in use.
• Your plan. Which plan you’re on, until when, and a record of any plan change we make by hand. When we change your plan or close your account by hand, we also note which of us did it, when, what changed, and your account number. That note stays after the account is deleted, so there’s always a record of who closed it.

We don’t collect card details (we don’t take payments online yet), and there are no analytics, ads or tracking of any kind, ours or anyone else’s.

Making an invoice without an account, or without saving it

An invoice made without an account lives in your browser tab, and it’s gone when you close the tab. When you download it, or finish an invoice without saving it, it is sent to our server once, to make the PDF. The file comes straight back to you, and we don’t keep the invoice or the PDF.

How we use it

• To sign you in and keep you signed in.
• To save your documents and details, and show them back to you.
• To show an invoice you’ve saved to whoever has its link.
• To apply your plan’s limits.
• To keep the service secure, such as limiting how many sign-in codes can be asked for.
• To answer you when you write to us.

We use your information because you asked us for the service, and to keep it secure. We never sell it, rent it or use it for advertising.

Your clients and shared links

When you save an invoice, we make a private link for it. Anyone who has the link can see the document: your business details, your client’s details, and your bank details and payment QR, since telling your client where to pay is the point of an invoice. Links are hidden from search engines and don’t expire, but you can turn a link off at any time, and deleting an invoice turns its link off too. We never email your clients; you pass the link on yourself.

Bank details on a document are read from your saved bank account each time it’s shown, so correcting a saved account also corrects the invoices you already shared with it. Please save only client details you have the right to use for billing them.

Bank details

Account numbers and the rest are stored as you typed them and shown to you in full, so you can check and correct them. They appear on the invoices you send, so we don’t describe them as secret, but they’re visible only to you, behind your sign-in, and to whoever you share the invoice with.

Who else handles your data

We use a few companies to run Invoic, and each gets only what it needs:

• Netlify hosts the site and the app, so every request passes through it.
• Neon runs our database, where everything you save is kept.
• Resend sends our emails: sign-in codes, and the notice when your email address changes.
• Google, only if you choose “Continue with Google”. Google handles that sign-in under its own privacy policy.
• Zoho Mail holds our support inbox, if you write to us.

These companies may store data outside the Philippines, for example in the United States. We use them because they protect what they hold, and we don’t share your information with anyone else unless the law requires it.

Cookies and browser storage

We only set cookies the site needs:

• Signed in: keeps you signed in, until 30 days pass without a visit, and never for more than 90 days after you signed in. It is removed when you sign out.
• Signed-in marker: holds only the value “1”, so invoic.dev can show a Dashboard link instead of Log in. It comes and goes with the one above.
• Google sign-in: only if you choose Google, and only for that sign-in: at most 10 minutes.
• Sign-in browser: a random key, set when you ask for a sign-in code, so the code works only in this browser. It lasts a day.
• Your choices: light or dark dashboard, icons or a list, and which clients’ folders you folded away. Each exists only once you make that choice, and lasts a year.
• Guide seen: holds only the value “1”, set when you finish or skip the “How Invoic works” tour, so it doesn’t start by itself again. It lasts a year.

Your browser also remembers that you have seen the cookie notice, and, until you close the tab, which documents you copied to paste. Because all of these are needed for the site to work as you asked, they don’t need your consent; we tell you about them anyway.

How long we keep it

• Your account and what you save: for as long as you have the account.
• An invoice you delete: 30 days in the Trash, where you can put it back, then deleted for good. You can empty the Trash sooner.
• Sign-in codes: 2 days.
• Signed-in browsers: until you sign out, or 30 days without a visit, and never more than 90 days.
• The counts behind our limits: a day, then deleted by a clean-up that runs at most every 10 minutes.
• Our notes of a plan change or account closure we made by hand: kept, even after the account is deleted.
• Emails to our support inbox: as long as we need them to help you.

Our database provider keeps short-term backups so we can recover from mistakes. Those roll off on their own schedule, so deleted data can remain in a backup for a short while.

Your rights

Under the Data Privacy Act you have the right to be told how your data is used, to see it, to have it corrected, to object, to have it deleted or blocked, to get a copy of it, and to be compensated for damage caused by its misuse. You can see and correct nearly everything yourself in the app.

For a copy of your data, or to have your account and everything in it deleted, write to support@invoic.dev from the email address on your account. Before we send a copy or delete anything, we reply to that address to check the request is really yours. We’ll do it, or tell you why we can’t, within 30 days. If you’re not happy with how we handled your data, you can complain to the National Privacy Commission at privacy.gov.ph.

Keeping it safe

Everything travels over HTTPS. Sign-in codes and signed-in browsers are stored only in scrambled form, and each account can reach only its own data. No system is perfect; if a breach puts your information at risk, we’ll tell you and the National Privacy Commission as the law requires.

Children

Invoic is for people 18 and over running a business or freelancing. It isn’t meant for children.

Changes

If we change this policy, the date at the top changes too. If a change affects how your data is used, we’ll say so on the site before it takes effect.