Privacy and your data

Your books are the private record of your business. Here’s how Thalermark treats them.

Your data is yours to take

Settings → Import & export → Take a copy with you downloads every record in your workspace (invoices, estimates, expenses, bills, contacts, items, payment history, jobs, logged hours, mileage, and more) as a single ZIP, in spreadsheet-friendly CSV or exact-copy JSON, one folder per company. No lock-in, no asking permission.

One honest caveat: receipt images aren’t in that ZIP today. They stay in the app’s storage, so if you’re leaving, save the ones you need from their expense pages.

Nothing leaves unless you switch it on

Thalermark talks to outside services only where you’ve connected them:

• Card payments run on Stripe, under the Stripe account you connect.
• Invoice and reminder emails go out through an email delivery service, because they have to reach your customer’s inbox.
• AI features send the relevant snippet (a receipt image, an expense description, your cash-flow totals) to the provider you connected in Settings → AI, under your own key. A receipt goes as a shrunken copy, made in memory and thrown away; the full-resolution original never leaves your storage. Connect a local Ollama and nothing leaves your machine at all. Your key is stored encrypted and never shown again.
• Telemetry is opt-in and anonymous, always.

Self-hosting takes this further: every one of those is off until you configure it, and the data never touches infrastructure we run.

Inside your workspace

• Every change is recorded. Each invoice, expense, and contact keeps a History of who changed what and when. It’s your record, kept for you, and visible in the app.
• Roles limit your team. A viewer can look but not touch, an accountant sees the numbers but not your settings. What a role can’t do isn’t shown to it.

Deleting your profile

Settings → Profile has a delete. It removes you from every workspace you were part of, deletes your sign-in credentials and sessions, and frees your email address. Sign up again later and you’re a genuinely new person; nothing connects back.

One thing stays: your name on the History of the changes you made, shown as no longer on the team. Your teammates’ books have to keep saying who did what; that’s their record of their business, not a profile of you.

If you own a workspace that still has other people in it, deletion is refused and tells you which workspace: hand ownership to someone else first, or close the business. A workspace with only you in it doesn’t stand in the way.

Questions

Write privacy@thalermark.com. If you think you’ve found a privacy bug, treat it as a security issue and use the security channel instead.