Skip to content

Your data

Your books are on your computer, not ours.

Handing your takings to five students you have just met is a reasonable thing to hesitate over. So here is the whole picture, including the parts that are less flattering to us.

Where your data lives Your ledger and every calculation stay inside the browser on your device. Nothing is held on our server unless you switch cloud sync on yourself. If you do, a snapshot of your books is stored against your workspace key and sent over TLS, which means we could read it; switching sync off deletes it. Your device Browser storage, works offline Sales & expenses every transaction Customers names, emails, sales Recipes & costs supplier pricing Invoices issued and paid All the maths runs here Forecast, margins, segments, computed in the page, offline. Nothing is sent by default No amounts, customers or transactions leave this box. optional only if you switch it on Our server Empty until you ask it not to be Sync is off unless you turn it on nothing is stored here by default If you do turn it on a snapshot is held against your key, sent over TLS, so we could read it Turn it off and it is deleted
The dashed line is the point. Nothing crosses it unless you switch on sync, and we say plainly what happens when you do: the snapshot sits in our database, readable by us, until you turn it off again.

The short version.

If you read nothing else on this page, read these five lines.

  • Everything you type goes into your own browser's storage. It never leaves your device on its own.
  • Every calculation — the forecast, the margins, the segments — happens in the page in front of you. It works with the internet unplugged.
  • There is no account, no password and no email address required to use the tools.
  • Cloud sync is off. If you turn it on to use a second device, a copy of your books is stored on our database — and we could read that copy.
  • You can export everything to CSV at any moment, and delete all of it from one button.

Where each thing actually sits.

"Local-first" is a phrase people use loosely. In this case it is literal: the tools are a web page that keeps its database inside your browser, the same way your browser remembers which sites you are logged into.

That has a consequence worth understanding. Your books are tied to that browser on that computer. Clearing your browsing data can erase them, and they will not appear on your phone by themselves. Which is what sync is for, and why sync involves a trade-off rather than being on by default.

Stays on your device, always
Every sale and expense, your customers and their contact details, your recipes and supplier costs, your invoices, and every figure computed from them.
Goes to our server only if you switch sync on
A snapshot of the same books, sent over an encrypted connection and stored against a workspace key that only you hold. It is not encrypted in a way that locks us out: an administrator with database access could read it. We are telling you that rather than calling it "encrypted" and letting you assume otherwise.
Never collected at all
Payment details, because there is nothing to pay for and no payment code left in the software. There are no advertising trackers and no third-party analytics on this site or in the tools.
Yours to take at any time
Every table exports to CSV, which opens in Excel, Numbers or Google Sheets. This is deliberate: if the project ended tomorrow you would lose the analysis, not the data.
Gone when you say so
Switching sync off removes the stored snapshot. Clearing the app's data in settings removes the local copy. Neither needs our involvement or a support ticket.

One exception, named.

The website checker has to reach the internet, because its whole job is to go and read a page. When you use it, our server fetches the address you gave it, along with that site's robots.txt and sitemap, and hands the result back to your browser to be scored.

We do not store the address, the page, or the result. It is a request that passes through and is gone.

What we are not.

We are five students, not a security department. Nobody here has been through a SOC 2 audit and we are not going to pretend otherwise on a page about honesty.

What we can say is that the architecture does most of the work: there is no central pile of small-business ledgers to breach, because by default there is no central pile at all. The safest data is the data nobody collected.

If you find something wrong, please tell us at security@hdhict.com and we will fix it and say so publicly.

Try it without giving us anything at all.

Open the demonstration restaurant and look through every screen. No account, no email, nothing recorded.

Open the demo