Privacy Policy

1. About this policy

This policy explains what personal information Zilda Expenses collects, where that information is stored, who else can see it, and what you can do about it.

Three names are used throughout, and they mean different things. Zilda Expenses is the service at www.zildaexpenses.com and whoever operates it. The Zilda Expenses Team is who you reach at the addresses in section 14. The application is the software itself, which runs in your browser and does most of its work there.

2. The short version

Zilda Expenses is built device-first. Your expenses, your logbook, your property and travel records and your receipt files are kept on your own device, in your browser’s storage. They are the primary copy, not a cache of something held elsewhere.

Three things qualify that:

Receipt images leave your device to be read. When you upload a receipt or invoice, the file itself is sent through the Zilda Expenses server to Anthropic, which reads the vendor, date, GST and total off it and sends those fields back. This is the one place your documents leave your device, and section 5 describes it in detail.
Where your receipts are kept is a choice, and it is the one choice that changes who can read them. Connect Dropbox and they are saved into your own account there: Zilda Expenses never holds the key and cannot read, list or delete anything in it. Choose hosted storage instead and they are kept by Zilda Expenses — encrypted by your browser first, so the storage provider cannot read them, but with the key held by Zilda Expenses, which therefore can. Section 6 sets out both.
If you sign in, your ledger records — the list of expenses itself, as opposed to the receipt files — are stored on the Zilda Expenses server so they can be synchronised between your devices. If you use Dropbox you can move that list into your Dropbox as well, and doing so deletes the copy on the server: section 6 sets out what changes and what it costs. Either way your receipt files are governed by the storage choice in the bullet above, not by this one.

Zilda Expenses runs no analytics, sets no tracking cookies of its own, and does no advertising or profiling of any kind. There is no marketing list and no mail on a schedule: the only email the application sends is the one you write in the contact form, and the sign-in emails are sent by Clerk on behalf of Zilda Expenses.

3. Where your information physically sits

There are three distinct places, and the difference matters:

Location	What is there
Your device — browser `localStorage` and IndexedDB	Every expense record, your vehicle logbook, investment property and travel records, your personal folders and what is filed in them, the history of changes to all of it, your settings and claim form template, your receipt and invoice files, and your Dropbox access token. This is always the primary copy.
The Zilda Expenses server — application hosting, a Postgres database and, for hosted storage, a file store. All in Sydney	Only if you sign in: your account identity and your ledger records. Never your storage tokens. Your receipt files too, but only if you choose hosted storage — that is the one setting that puts them here, and section 6 sets out what it means. Those files are encrypted by your browser before they are sent, and the key that opens them is held in the database rather than the file store, so the two sit with different companies.
Your own cloud storage — Dropbox, if you connect it	Your receipt and invoice files, in your account, under your control.

4. What Zilda Expenses collects

Several rows below say a thing is held in the Zilda Expenses database when signed in. For anyone using Dropbox that is a setting rather than a certainty: moving your expense records into your Dropbox deletes them from that database, and every row so marked then applies to your Dropbox instead. Section 6 describes the move. Nothing else in this table changes.

Information	What it includes	Where it is stored
Account identity	Your email address, display name, and an account identifier. Your password or social login credentials are held by Clerk, the identity provider, and never by Zilda Expenses.	Clerk; the Zilda Expenses database
Expense records	Date, vendor, description, amount excluding GST, the GST component, the total, ATO expense category, project allocation, a private free-text note, and any unresolved warning flags.	Your device; the Zilda Expenses database when signed in
Receipt and invoice files	The photograph or PDF itself. This is the most sensitive material the product handles. Where it is kept is the one storage choice you make, and the two options differ in who can read it — see section 6. Under hosted storage each file is encrypted by your browser before it is sent, so what is stored is sealed.	Your device; and either your own Dropbox, or Zilda Expenses’ own storage if you choose hosted storage
The key your data is sealed with	One encryption key for your workspace, created the first time you file something and never changed afterwards — it seals your receipt files under hosted storage and your expense records wherever they are kept. By default it is held in readable form, which is what makes section 6 say Zilda Expenses can open them, so it is listed here rather than treated as plumbing. Turn on end-to-end encryption and only a wrapped copy is held, which is useless without a passkey on one of your devices, the passphrase or the recovery key. Either way it is not derived from your account password and is unaffected by changing one.	The Zilda Expenses database — deliberately not the file store holding the files it opens
Forwarded email	For a receipt you email in: the attachments, the sender’s address, the subject, anything written in the message body, and the mail service’s assessment of whether the message was authentic, spam, or carried a virus. Kept until you bring the receipt into the app or throw it away, then deleted — see section 7.	Amazon Web Services in Sydney; the Zilda Expenses database holds everything except the attachments
Your forwarding address	A random identifier that decides which account a forwarded message belongs to. It is a credential — see section 7 — and is created only if you look it up.	The Zilda Expenses database
Forwarding addresses you have replaced	Each address you replace, kept for twelve months so that mail still being sent to it can be reported to you rather than disappearing. Nothing sent to a replaced address is ever imported; what is recorded about such a message is the date, the sender’s address and the subject, taken from the delivery notification without opening the message. Dismissing the notice clears those details.	The Zilda Expenses database
Receipt file references	The folder and filename a receipt was saved under, its size, its content type, and a cryptographic fingerprint of the file used to detect re-uploads of the same document. No file content.	Your device; the Zilda Expenses database when signed in
Vehicle logbook	Vehicle name, registration number, odometer readings, trip dates and the purpose of each trip in free text.	Your device; the Zilda Expenses database when signed in
Investment property records	The property’s street address, a nickname you give it, the date it became available to rent, and your ownership percentage.	Your device; the Zilda Expenses database when signed in
Business travel records	Destination, purpose, start and end dates, nights away, and notes.	Your device; the Zilda Expenses database when signed in
Personal folders	The names you give the folders in the personal section — a renovation, a warranties drawer — and which folder each receipt filed there is in. The receipts themselves are expense records and receipt files like any other, held and protected exactly as the rows above describe. A folder name is free text you wrote, so what it says is up to you; it is also used as the name of the folder your receipt files are saved under in your storage, where anyone who can see that account can read it.	Your device; the Zilda Expenses database when signed in; and, as a folder name, your receipt storage
Receipts you have read and not filed yet	A receipt that has been read and is waiting to be checked: what was read off it (the vendor, the date, the amounts, the lines), anything you have typed over that so far, where it was headed, and a coarse description of the device that read it, such as “your Mac”. It is not an expense and is in no claim, total or return until you file it. It is held like the rest of your ledger, so it reaches your other devices — which is the point of it: before this, a receipt read on a laptop did not exist on your phone. The document itself is kept in your receipt storage, in a folder called “Waiting to be filed”, and both the record and that copy are deleted when you file the receipt or throw it away.	Your device; the Zilda Expenses database when signed in; the document in your receipt storage
A history of what you have done	One line per change to your ledger, kept so you can find out what happened to a receipt — filed, moved, edited, deleted, thrown away, or brought in from your expense email. Each line holds the sentence describing it (which may name a vendor, an amount, a period, a folder or a project), when it happened, and a coarse description of the device it happened on, such as “your iPhone”. It is part of your ledger and is held exactly as the rest of it is. It is never sent anywhere else, is not analytics, and nothing about it is reported to Zilda Expenses or anyone else. The most recent 1,000 lines are kept and older ones are discarded.	Your device; the Zilda Expenses database when signed in
Cloud storage tokens	A Dropbox authorisation token, where you connect Dropbox. Obtained by your browser and held there. Never transmitted to Zilda Expenses. Hosted storage has no such token — your Zilda Expenses account is the credential.	Your device only
Settings and claim form template	Your preferences, and a mapping of your own claim spreadsheet so your existing form can be filled. This may include your employer’s column headings.	Your device; the Zilda Expenses database when signed in
Anything you send to Zilda Expenses	If you use the contact form, the subject, the reply address and the message you write. It is sent to the Zilda Expenses mailbox and nothing else — the application writes no copy of it, keeps no log of it, and has no database table for it.	The Zilda Expenses mailbox, at Zoho
Technical request information	The hosting provider records ordinary web request metadata — IP address, URL, timestamp and browser user agent — as any web host does.	The hosting provider

Several fields — particularly the private note on an expense and the purpose field in your logbook — are open free text. You can type anything into them, so what they contain is up to you. The private note is never included in an export, but it is stored.

Zilda Expenses does not ask for sensitive information as that term is defined in the Privacy Act, and the product has no field for it. Because you choose which receipts to file, a receipt may itself contain sensitive information — a medical invoice, for example. It is handled exactly as any other receipt is. Please do not enter sensitive details into free-text fields.

5. Reading your receipts

Everything in this section describes the default. There is a setting under Advanced security that reads receipts on your own device instead, and where it is on, none of what follows happens: no file is uploaded, nothing reaches Anthropic, and nothing crosses a border. It reads fewer receipts correctly, which is said where you turn it on. The reader itself is served by this site along with everything else, so switching it on makes no request to anybody: it is downloaded once and then it is on your device.

Reading a receipt with the default requires a model too large to run in a browser. When you upload a receipt or invoice:

The file is uploaded to the Zilda Expenses server.
The server forwards it to Anthropic’s Claude API, together with a fixed instruction describing what to look for on an Australian receipt, and today’s date so that a receipt showing only a day and month can be resolved to a year.
The extracted fields are returned to your browser for you to confirm or correct.

What is sent: the raw contents of the document, the fixed instruction, and the date.

What is not sent: your email address, your name, any account or user identifier, any filename, any information about your device, your IP address, and any previously extracted receipt. Each request is independent; nothing is carried between them.

What the server does: holds the file in memory for the few seconds the request takes, writes nothing to disk, makes no database call, and deliberately discards the provider’s error information rather than logging it, because such errors can contain the request contents. It then returns the fields and forgets the document.

Anthropic PBC is a company incorporated in the United States, so your receipt crosses the Australian border when it is read.

What Anthropic does with it. Anthropic’s published position for the Claude API, which is the arrangement your receipts are read under, is that the document the server sends and the answer it returns are not retained by default, and that data it does retain is never used to train its models without express permission. Zilda Expenses has given no such permission, and has no separate agreement that changes any of this.

There are two exceptions, and they are the ones worth knowing. Anthropic may keep a document where the law requires it. And if its automated trust-and-safety systems flag a request, it may keep that request and the response to it for up to two years. A receipt is unlikely to be flagged, but it is better said here than found in somebody else’s terms.

That is Anthropic’s position as published when this version of the policy was written, not a promise Zilda Expenses is in a position to make on Anthropic’s behalf. It is the reason section 6 exists: the surest way to keep a document out of all of this is not to send it, and receipts you file straight to your own cloud storage are never uploaded at all.

6. Where your receipts are kept

There are two places, and the difference between them is who can read your receipts. It is worth reading before choosing, because it is not a difference you can see from the outside afterwards.

Your own Dropbox. Receipt files are saved into your account, not a Zilda Expenses one. Authorisation is performed by your browser and the resulting access token is kept on your device — it is never sent to the Zilda Expenses server. The consequences are worth stating plainly:

Zilda Expenses cannot see, list, download or delete any file in your Dropbox, and no background process could, because nothing on the Zilda Expenses side holds the key.
Files stay in your account until you delete them. Zilda Expenses has no ability to delete them for you.
The app is registered for app-folder access, so Dropbox itself confines it to a single folder regardless of what the app asks for.
The permissions it asks Dropbox for are account_info.read (to show which account is connected), files.metadata.read, files.content.read and files.content.write — all four confined to that folder. Dropbox will not grant a token more than those, and one issued without a permission never gains it.

Dropbox is not a service provider to Zilda Expenses in this arrangement. Your use of it is governed by your own agreement with Dropbox and by its privacy policy.

Your expense records can go there too. The receipt files and the list of expenses are two different things, and by default only the files are in your Dropbox: the list — every vendor, date, amount, category, private note and receipt filename — is held in the Zilda Expenses database so it reaches your other devices. From the Storage page you can move that list into your Dropbox as well. It is written to a file beside the receipts, checked, and the copy in the database is then deleted.

After the move, Zilda Expenses holds your email address, your name, your account identifier and which workspace you are in. Not your expenses, not what you spent, not where, and not what you wrote in a private note.
Signing in on a new device will show nothing until you reconnect Dropbox on it. There is no copy on the Zilda Expenses side to populate it from, which is the point of the move and also the whole of its cost.
Your receipts and your expense records then both depend on that one Dropbox account. If you lose access to it, Zilda Expenses cannot recover either.
It can be moved back at any time, from the same page. Nothing is carried up automatically when you do — the device you move it back on sends what it holds.

Hosted storage. If you choose this instead, receipt files are kept by Zilda Expenses. There is nothing to connect and no second account to have — being signed in is the credential. What that costs is the part to be clear about:

Each file is encrypted in your browser before it is sent. What leaves your device is already sealed, and nothing but sealed bytes is ever written to the file store. Amazon Web Services, which operates that store, cannot read your receipts, and neither could anybody who obtained a copy of what is in it.
Zilda Expenses can read your receipts. The key that opens them is deliberately not kept with the files — it is held in the Zilda Expenses database, which is a different company in a different account, so no single provider holds both halves. But Zilda Expenses holds it, and hands it to your browser when you sign in. So Zilda Expenses can open any of those files. This is the only arrangement in this product where anybody other than you can, and it is the whole difference between it and Dropbox.
The sealed files are stored in Sydney, in Amazon Web Services, and reach it directly from your browser on a link that is signed for one file and expires within minutes. They are not routed through, or kept by, the part of the server that reads receipts.
Each account’s files are addressed under an identifier taken from your signed-in session, never from anything your browser sends. One account cannot request another’s files, however the request is formed.
There is no separate password and no recovery code for these files, and the key is not derived from your password. Changing your password, or resetting a forgotten one, therefore neither locks you out of your own receipts nor puts them further out of anybody else’s reach — it is a sign-in credential and the key is not. Access follows your Zilda Expenses account, so deleting the account is what removes them — see section 11.
Receipts you email in are the exception to the first two points. They are delivered to the file store by the mail service rather than sent from your browser, so there is nothing in the path that could seal them, and they sit there readable until you bring them into the app or throw them away. Section 7 sets that out.

End-to-end encryption, if you want the key out of Zilda Expenses’ hands. Everything above describes the default, where Zilda Expenses holds the key and can therefore open what it stores. From Storage you can turn on end-to-end encryption instead. What is then kept is the key encrypted — under a passkey on a device of yours, under a passphrase, and under a recovery key shown to you one time — and none of those three is ever sent to Zilda Expenses or stored by it.

A passkey is the option most people should take. The fingerprint, face or PIN a device already asks for unlocks the key, so there is no second password to invent or remember. The secret it derives is held inside the device’s own authenticator, which will not release it to this website or to anything else. Where a passkey is synced by a password manager — iCloud Keychain, Google Password Manager — that manager holds an encrypted copy, which is what lets the same passkey work on your other devices.
After it is turned on, a copy of the Zilda Expenses database is a copy of wrapped keys. Your expenses, your receipts, your vendors and your private notes cannot be read from it by Zilda Expenses, by anybody who obtains it, or by anybody who compels its production.
There is no reset. Lose every device you have added, forget the passphrase and lose the recovery key, and the data is gone permanently. Zilda Expenses cannot recover it, and no support request can change that — it is the same property that makes end-to-end encryption worth turning on.
You are asked once on each device rather than on every sign-in: after that, the device keeps what it needs in a form the browser will use and will not read back out.
What it covers, and what it does not. It covers what is inside a receipt and an expense record. It does not cover the facts around them, because a sealed file still has to be stored and found: that a record exists, roughly how large it is, and when it arrived. Nor does it cover your email address or which workspace you are in, which are listed in section 3 and are held in readable form.
The limit of any encryption done in a browser. It runs in code served by this website, so a future version of that code could capture the key at the moment your browser unwraps it. This is true of every service that encrypts in a browser, including those that do not say so — an application installed from a store is signed, and the same copy is checked by everybody, whereas a page is fetched fresh on every visit. It is stated here because a claim of total secrecy would be a stronger claim than the architecture supports, and section 5 already describes the other place your documents are visible.

Nothing moves between the two. Choosing hosted storage does not copy what is already in your Dropbox, and choosing Dropbox does not remove what hosted storage is holding.

7. Receipts you email in

You can forward a receipt to Zilda Expenses instead of uploading it. This is the one way into the product where something arrives without you being here, so it works differently from the rest and the differences are worth knowing.

Your forwarding address is a credential. Each account gets its own, and it is the only thing that decides which account a message belongs to — the “from” address on a message can be written by anyone and is not relied on. Anybody who knows your forwarding address can put a receipt into your account, so it should be treated like a password. It is created the first time you look at it rather than when you sign up, and you can replace it at any time from Settings; the old address stops working immediately.

An address you replace is watched for twelve months. Mail sent to it is never imported — that is the whole point of replacing it — but it is no longer discarded in silence either, because the usual reason to replace an address is that it leaked, and whether anything is still being sent there is the thing you would want to know. The date, the sender’s address and the subject are recorded from the delivery notification, without the message being opened, and shown to you on the Expense email page. Dismissing that notice clears them. After twelve months the replaced address is forgotten and mail to it goes back to being dropped without a word.

An emailed receipt passes through Zilda Expenses, whatever storage you chose. This is the important one. Section 6 says that with Dropbox nothing on the Zilda Expenses side can read your receipts. That remains true of everything you upload — and it is not true of anything you email. A forwarded message is delivered to Amazon Web Services in Sydney, stored there, and opened by the Zilda Expenses server so the attachments can be found. Until you bring a receipt into the app, it is sitting in Zilda Expenses’ own storage and can be read by it. It is also the one thing in that store which is not encrypted before it arrives: section 6 says receipts are sealed in your browser, and a forwarded message never passes through your browser, so nothing in its path can seal it. Anything you email in is held in the clear until you deal with it.

What arrives is kept, briefly. The stored message includes the whole of what was sent: the attachments, the sender’s address, the subject, anything written in the body, and the mail service’s assessment of whether the message was authentic, spam, or carried a virus. Once you have brought the last receipt out of a message into the app — or thrown it away — the stored message is deleted.

Nothing emailed is filed on its own. A forwarded receipt becomes a draft waiting to be checked, exactly as a photograph you upload does. It is not in any claim, any total or any return until you have looked at it and said so.

Messages the mail service judges to be spam, or finds a virus in, are held rather than opened. They are listed so a supplier’s invoice caught by mistake is not lost silently, and their contents are not fetched unless you ask for them.

If you would rather this did not exist for your account, simply never look up your forwarding address — without one, mail sent to Zilda Expenses for you has no account to resolve to and is discarded.

8. Who else handles your information

Who	What they receive	Why
Anthropic PBC (United States)	The receipt or invoice file, and a fixed instruction. Nothing that identifies you. Nothing at all if you have turned on reading receipts on your own device — see section 5.	Reads the document. This is the core function of the product unless you have chosen to read receipts on your own device instead.
Clerk	Your email address, name, authentication credentials and session cookie. Clerk also sends the emails that sign-in depends on — verification, password reset, and invitations.	Manages sign-in and accounts.
Vercel	Hosts the application and sees ordinary request metadata.	Application hosting.
Neon	Everything held in the Zilda Expenses database, as listed in section 4 — including, for anyone using hosted storage, the key that opens their receipt files. The files themselves are not here; they are with Amazon Web Services. Splitting the two is deliberate and section 6 explains what it does and does not achieve.	Database hosting.
Amazon Web Services	Two separate things. Your receipt and invoice files, but only if you choose hosted storage — nothing at all if you use Dropbox or keep them on your device, and encrypted by your browser before they are sent, so what Amazon Web Services holds is sealed and it cannot read it. And any message you forward to your Zilda Expenses address, in full, whichever storage you chose — that one arrives unsealed, because it is delivered rather than uploaded. Both are held in Sydney.	Stores receipt files for hosted storage, and receives forwarded email. The key that opens a sealed receipt is not kept here — it is in the database, which is why sections 6 and 7 say Zilda Expenses can read what is in this store and Amazon Web Services cannot.
Zoho	Any email you send to Zilda Expenses — whether written in your own mail app or in the contact form — and the reply to it, including anything you choose to put in a privacy request.	Hosts the Zilda Expenses mailbox. Australian data centre.

Zilda Expenses does not sell your personal information, and does not disclose it to anyone else except where required to by law.

9. Cross-border disclosure

Your receipt and invoice files are disclosed to Anthropic in the United States when they are read (section 5).

Everything else Zilda Expenses holds itself stays in Australia. The application servers run in Sydney, the database is hosted in Sydney, and the file store used by hosted storage is in Sydney. Email you forward to your Zilda Expenses address is received in Sydney and stored there — the receiving service was chosen in that region for this reason. An expense record you save while signed in is written to, and read from, a database in the same city as the server that handled the request.

Your account identity — your email address and your name — is held by Clerk, which offers no choice of hosting region; it is held in the United States. Email you send to Zilda Expenses, including anything you write in the contact form, is held in Zoho’s Australian data centre.

The hosting provider answers each request from whichever of its locations is nearest the person making it, which for someone outside Australia is outside Australia. That location passes the request to Sydney to be handled; what it sees in passing is the request metadata described in section 4 — an address, a URL, a timestamp — and not the contents of your ledger.

Being stored in Australia is not the same as being held by an Australian company. Anthropic, Vercel, Neon, Clerk and Amazon Web Services are all overseas companies, and an overseas company may be subject to the laws of the country it is established in even where the data itself sits here. Where Zilda Expenses discloses personal information to an overseas recipient, it takes reasonable steps to ensure the information is handled consistently with the Australian Privacy Principles.

10. Cookies and device storage

The application sets no cookies of its own. Clerk sets a session cookie when you sign in; that is the only cookie involved. There are no analytics, advertising or tracking cookies.

The application stores information in your browser’s localStorage and IndexedDB. This is not a cookie, but it is storage on your device, so the full list is set out here:

Key	What it holds
`zilda.state.v2`	Your entire ledger — expenses, periods, vehicles, logbook, properties, trips, personal folders, the history of what has happened to the workspace, and settings. The primary copy of your data.
`zilda.documents`	An IndexedDB database holding your receipt files, so an expense can be reopened offline.
`zilda.dropbox.tokens`	Authorisation tokens for your own cloud storage. Never transmitted to Zilda Expenses.
`zilda.relied.on`	Which of storage and end-to-end encryption you have switched on in this browser, and the date you did — nothing about the accounts themselves. Kept so the app can tell you when one of them stops working, rather than carrying on quietly without it. Cleared for a thing when you switch that thing off.
`zilda.dropbox.pkce`	Short-lived values used while connecting a storage account, then discarded.
`zilda.sync.base`	A record of what the server last held, so only changes need to be sent.
`zilda.device.owner, zilda.ledger.carried`	Which account last used this browser, so that a second person signing in on a shared device starts clean rather than seeing the first person’s ledger.
`zilda.storage.provider, zilda.storage.hosted, zilda.storage.mirror, zilda.theme, zilda.notes.shown, zilda.nav.folded, zilda.upload.holding, zilda.upload.pin`	Interface preferences: whether Zilda’s own storage is switched on, which cloud is tried first when both are, light or dark, a dismissed hint, which lists in the sidebar you have folded away, whether receipts wait in a stack rather than being confirmed one at a time, and which section or project everything you add is currently being filed to.
`zilda.grouped.work, and one per other section`	Whether a table is grouped by category or by project.

Earlier versions of the application stored the same information under different names. Those are carried across and the old names deleted the first time you open the updated application.

You can clear all of this from within the application, and your browser can clear it too. Clearing it removes your only copy of any data not synchronised to the Zilda Expenses server or saved to your cloud storage.

11. How long information is kept

On your device. Your data stays until you clear it, either from within the application or through your browser. There is one automatic deletion: if a different account signs in on a device someone else was using, the previous person’s ledger, storage tokens and stored receipt files are erased from that browser.

On the Zilda Expenses server. Your ledger records stay for as long as you have an account. When you ask for them to be deleted, they are deleted within 30 days. Deleting a workspace removes its expenses, periods and entries together.

What that does not include, said plainly: there is no automatic deletion for an account that simply stops being used. If you stop using Zilda Expenses and never say so, your records stay on the server until you do. One line to privacy@zildaexpenses.com is enough, and it is the same address for asking what is held in the first place.

With Clerk. Your account record is held by Clerk until it is deleted there. That is a separate deletion from the one above, and any deletion request is handled across both.

In your own Dropbox. Receipt files there remain until you delete them. Zilda Expenses cannot delete them for you.

In hosted storage. Receipt files kept by Zilda Expenses are deleted with the expense they belong to, and the rest go when the account goes. There is no separate password on them and no recovery code: access follows your Zilda Expenses account, so asking for the account to be deleted is what removes the files. The same 30 days applies as above.

Documents sent for reading. See section 5.

A note on retention generally: the purpose of this product is to substantiate expenses, and the ATO expects records to be kept for five years from the date you lodge. Aggressive deletion would work against what you are using the product for. The position taken here is that you control your own records, and that Zilda Expenses holds as little as possible.

12. Accessing, correcting and deleting your information

Most of your information is on your own device, where you can view, edit, export and delete it directly at any time.

For information held on the Zilda Expenses server, you can ask for a copy, ask for it to be corrected, or ask for it to be deleted, using the details in section 14. The Zilda Expenses Team will answer within 30 days. If a request for access or correction is refused, you will be told why in writing.

13. Security

With Dropbox, receipt and invoice files are never stored on the Zilda Expenses server — there is nothing there to take. With hosted storage they are, and a compromise of Zilda Expenses would reach them. That is the trade section 6 describes, and it is the reason Dropbox is the default.
Your cloud storage credentials are never sent to Zilda Expenses, so a compromise of the Zilda Expenses systems could not be used to reach your Dropbox.
Documents sent for reading are held in memory for the duration of the request and are not written to disk or logged.

No system is completely secure, and information you send over the internet always carries some risk. If a data breach occurs that is likely to result in serious harm, the Zilda Expenses Team will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

14. What Zilda Expenses does not do

No analytics, telemetry or product usage tracking of any kind. The history described in section 4 is not an exception to this and is worth saying plainly: it is written for you, kept in your own ledger, and never sent anywhere. Nobody at Zilda Expenses receives it, it is not aggregated, and no product decision is made from it.
No advertising, tracking pixels or third-party marketing scripts.
No marketing email, no newsletter, and no mail on a schedule. Your monthly export is a file you download, not something sent to you. The application sends exactly one kind of email — the message you write in the contact form, to the Zilda Expenses Team — and the sign-in emails come from Clerk on behalf of Zilda Expenses.
No background processing of your data. Everything happens while the application is open.
No payment information is collected or held.
No profiling, scoring or automated decision-making about you. The model reads a document; it does not assess you.
No user’s data is visible to any other user. There is no sharing and no invitation flow.

15. Contact and complaints

For any question about this policy, or to make a request about your information: privacy@zildaexpenses.com

If you are not satisfied with how the Zilda Expenses Team has handled your enquiry or complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001.

16. Age

Zilda Expenses is intended for people managing their own work expenses or tax records. It is not directed at children, and Zilda Expenses does not knowingly collect information from anyone under 18.

17. Changes to this policy

Zilda Expenses may update this policy. The current version is always available at https://www.zildaexpenses.com/privacy, and the date at the top shows when it last changed. If a change materially affects how your information is handled, you will be told before it takes effect.

The security page covers the same ground in less detail and more plainly, including the one place receipts leave your own cloud.