Your records. Your control.

What the application stores

Your verified email and optional name, donation records, declaration records, private charities, company records, tax-year claim history, reminders, statement review candidates and personal payee mappings are stored to provide your tracker. Clerk handles sign-in. PostgreSQL stores application data. Uploaded receipts are held in private encrypted storage when that feature is configured.

Statements and optional AI processing

Statement files are scanned before processing. Original statement files are removed after processing; extracted review candidates, descriptions and your decisions remain in your account. CSV, OFX and QIF parsing does not require an AI provider. For PDF and image extraction, when enabled, you must expressly agree before extracted text is sent to OpenAI. This text can include sensitive financial and personal information. Requests disable stored responses, but provider processing and retention policies still apply. Do not upload another person’s financial records without their authority.

Who can see your records

Personal donation and declaration records are scoped to your account. Custom charities are private to you; shared directory charities can be seen by other users. Organisation workspaces contain separate donor, donation, declaration, document, membership, import, claim and audit records. Authorised staff can access those records according to their role. Name or email matches do not automatically link a charity donor to a personal account. Operational administrators may have access when maintaining the service.

Explicit sharing between workspaces

A personal user can grant a named organisation access to specific donation, declaration or receipt information for a stated purpose and expiry. This does not expose income, tax returns, other donations or personal relief estimates. Revocation or expiry ends access through the app; it cannot remove copies already downloaded by an authorised recipient. Recipients remain responsible for using and retaining information only for an appropriate purpose.

Export and deletion

Settings lets you export your account records and request deletion. Deletion removes your owned application records and queues encrypted receipt files for removal by the maintenance worker. Failed file removals are retried. Removal of your sign-in identity is also retried if the provider is temporarily unavailable. Copies in provider backups are subject to their retention policies.

Deleting a personal account does not automatically erase the charity’s financial or declaration evidence, claim snapshots, documents or audit history. Those records belong to the organisation’s separate workspace. A sole owner must transfer ownership before personal account deletion. Staff access can be revoked while necessary organisation evidence remains. The operator and each organisation must document their legal basis, retention periods and process for requests; no indefinite retention promise or fixed statutory period is made in this development notice.

Development status

This application is in development. The operator’s contact details, provider retention periods and final privacy terms must be published before a public launch. Do not use this development environment for sensitive production records.