Privacy Policy

What this covers

This policy describes what BalanceMCP collects, stores, and does with the data you put into it — your books, the transactions and entries in them, your account information, and the API keys you use to connect an AI assistant. It applies to the hosted product at this domain, not to any AI assistant or client you choose to connect to it, which has its own separate handling of whatever it sends and receives.

What we collect

You sign in with Google OAuth. We receive the identity information Google provides for that sign-in and use it to create and recognize your account — we don't separately collect a password.

Everything you enter as bookkeeping data — books, accounts, transactions, journal entries, and anything extracted from a statement you import — is stored so the product can do its job: showing you your books and running reports over them.

When you create an API key so an assistant can call BalanceMCP on your behalf, we store a cryptographic hash of that key, not the key itself — more on that under Security. Every tool call an authenticated key makes is recorded in an append-only audit log: which tool, a redacted version of its arguments, and whether it succeeded, tied to your account and the key used.

What we do not do

We do not sell your data. We do not share your bookkeeping data with third parties for advertising or marketing. There is no bank feed integration built yet, so no bank credentials or live transaction feed exists to share in the first place — statements come in because you or your assistant hand them over.

Who can see your data

Your books are visible only to your account. That is enforced at the database level through row-level security, not only by the application code above it — a query issued on your behalf simply cannot see another user's book, and the server refuses to run at all against a database connection that could bypass that enforcement.

Staff access to the underlying database exists for operating the service — for example, to investigate a bug you report — and is not a routine or automatic part of using the product.

How long we keep it

Your bookkeeping data is kept for as long as your account exists. The audit log is append-only by design: individual entries in it cannot be deleted, by you or by us, short of a change to the database itself. There is currently no age-based retention or automatic pruning of the audit log — it is a known gap, tracked as something to add before the log grows large, not a deliberate promise to keep every row forever.

Your choices

You can export your entire book — transactions, the full journal, and the chart of accounts — as CSV files at any time, and take that copy anywhere. You can revoke an API key at any time, which stops it from being used immediately. There is currently no self-serve account deletion in the product; if you want your account and data removed, that has to be requested and handled manually rather than through a button in the app today.

Compliance

We are not making a GDPR, CCPA, or any other specific regulatory compliance claim in this draft. That work — a proper legal basis analysis, a data processing record, and whatever a given jurisdiction requires — has not been done, and this document is not a substitute for it. If you operate under a specific privacy law and need contractual or documented assurances, ask before relying on this page.

Changes to this policy

If this policy changes in a way that matters — what we collect, who can see it, or how long we keep it — we'll update the date at the top of this page. Given the review notice above, expect this page itself to change once it has had professional review.