Data security: what we do, and what you control

In transit & at rest

• Every connection is encrypted (HTTPS) and enforced by the server; there is no unencrypted version.
• Your session lives in an encrypted cookie that scripts in the browser cannot read (HttpOnly, Secure) — one essential session cookie only, no tracking or third-party analytics cookies.
• A strict content security policy: no inline scripts; the only outside script on the app's pages is the anti-bot check on the sign-in & sign-up forms.
• Receipt images & documents are kept in closed cloud object storage; view links are signed, given only to people who can open that receipt, and expire by themselves within an hour.
• A cloud database in the South-East Asia region; daily backups kept 14 days and monthly backups 90 days, encrypted.
• New passwords are checked against public breach lists using k-anonymity — your password is never sent; Google sign-in is available without a password.

Isolation per group — enforced by the database

• Every data row (receipts, expenses, claims, settings) is tagged with its group — family, company, association, firm. Your requests carry your identity and the database filters every row by group (row-level security); server tasks that need wider access check the group explicitly and are tested automatically.
• The platform owner sees only aggregate statistics (number of groups, usage) in the app — there is no screen or download for reading any group's receipts, and the database refuses it. Daily backups exist only for disaster recovery and cannot be opened through the app.
• Separation of duties in claims (checker ≠ approver) and the locking of filed years are enforced by database triggers, not only by buttons in the app.
• Every API call needs a valid session; writes are rejected when they come from another site (layered CSRF protection) and rate-limited per account.

Who sees what in your group

• Your receipts: you, the group admin, and members the admin gives the "see all receipts" permission (the default for roles such as spouse, treasurer or finance manager — the admin can switch it off). Ordinary members see only their own receipts.
• The shopping list & the household money picture: shared; your full tax profile (income, PCB, reliefs) is closed to admins & auditors unless you open it yourself (default: closed).
• Claim checkers, approvers & payers: the claims submitted for their decision, including that claim's receipt images (finance roles that also hold the "see all receipts" permission see every group receipt).
• Invited auditors & accountants: read-only — filed or locked records and closed years; they use no seat in the plan and cannot scan or change anything.
• In an organisation space, staff & committee members' personal tax is open to nobody. Receipts members send by email or Telegram are recorded under the sender's name.

What never leaves your device

• Bank, card & e-wallet statement files (CSV, Excel, PDF) are parsed in your browser — the file is not uploaded to the server; only the rows you confirm for import are stored.
• Social-media share cards are drawn on the device and contain no name, income, shop or date.
• The public calculators, relief finder & "Can I claim X?" pages send nothing — the computation happens in the browser.
• Receipt images you scan ARE sent to an AI service to be read; under the provider's terms, submitted content may be used to improve the provider's products. Manual entry sends nothing to the AI — you can stop using the AI features at any time.

Export, trash & delete — in your hands

• A full JSON backup & a ZIP audit pack (every receipt image, HK-4, summaries) can be downloaded any time — More → Data & recovery.
• Deleted receipts sit in the trash for 30 days (recoverable), then are deleted permanently; unprocessed receipt emails are deleted after 30 days.
• Delete my data: any user deletes their own data & account inside the app, immediately — no email, no form. Exceptions: receipts of a locked year (filed with LHDN) and approved claims pass to the group admin because the law requires tax records to be kept.
• Close the group: every member is deactivated immediately and all the group's data is permanently deleted after 30 days; export first.
• No ads, no data selling, no sharing with advertisers, data brokers or LHDN. Data is disclosed only when Malaysian law requires it.

Reporting a security weakness

If you find a weakness, tell us first, confidentially — through the in-app feedback form (More → Feedback, tick "Allow the owner to contact me") or the support email address listed in the Privacy Policy under "Contact us". We reply, fix and inform affected users; please allow a reasonable time before public disclosure. Do not test with other people's data.

Full documents

• Privacy Policy (PDPA) — including "Contact us" & account deletion — What is collected, where it is stored, for how long, your PDPA rights.
• Terms of Service — Plans, payments, dormant accounts, group closure.
• Service status — App components & a live check from your browser.

Document files: you decide whether a copy is kept

• EA/EC forms and payslips you upload are read for you to confirm — digital PDFs are read on your device without AI; the confirmed figures stay in the app, the file copy is kept as proof or deleted automatically once confirmed, following your default under More › Privacy & security › Document files (changeable for each file when uploading).
• Honest defaults: EA/EC forms are kept (LHDN can ask for proof throughout the record-keeping period), monthly payslips are deleted once confirmed; identity card, bank account, EPF/SOCSO and staff numbers on a document are never stored.
• Your files can only be seen and used by you — not the group admin, not an auditor, not the platform owner; every file's real content is checked on the server, and instructions written inside a document are not followed by the AI reader.

Accounts, money plan & MyInvois credentials

• Accounts & balances and the money plan are private: the group admin only sees records you mark “shared”, read-only.
• No online banking password, OTP or TAC is ever asked for — balances come from your records and the statement files you download yourself.
• Your MyInvois Client Secret is encrypted on the server and never shown again or returned to the browser.
• Quick notes made offline wait only on your device until they are sent.

My data: you see what is stored

• My data lists every type of data, with who can see it and how long it is kept
• Download all your data as one machine-readable JSON file
• Delete your own data & account at once, with no forms
• Device lock without biometric data — your face or fingerprint is checked by your device

Change history for every record

• Who changed what and when — old → new value of the changed details only
• Seen only by those who can see the record (the same database permission); auditors read-only
• Restore an old value through a normal save — year locks & role permissions respected
• AI-read text, files & MyInvois credentials aren’t kept; deleted automatically after the period in My data

An encrypted document vault on your device

• Passports, insurance policies, grants and warranties encrypted on your device with your own passphrase
• The server only stores encrypted bytes — the passphrase is never sent
• A one-time recovery code; no back door
• Reminders before expiry in the money calendar

Backup restore & two-step verification

• A backup file you downloaded from My data can be restored: the app shows what will be added, inserts only missing records with their original identifiers, and links receipt photos again if the file is still in your account.
• Turn on two-step verification: after your password, the app asks for a 6-digit code from the authenticator app on your phone. Ten one-time recovery codes are shown once only — we keep only their salted hashes.