Privacy Policy

Effective August 22, 2026

This policy explains how Easy Day Expense Tracker (“Easy Day,” “we,” or “us”) collects, uses, protects, and deletes information when you use the service. This is a deployment-ready policy template; the operator should have counsel review it and add its legal entity and mailing address before public launch.

Information we collect

We collect account and organization information, expense and income records you enter or import, billing state supplied by our payment processor, security and operational logs, and files you upload as receipts. Passwords are stored only as one-way hashes. Payment-card details are handled by Stripe and are not stored by Easy Day.

Google and Gmail data

Gmail Receipt Sync is optional and starts only when an organization owner or administrator requests it. The Google authorization request is limited to openid, email, and https://www.googleapis.com/auth/gmail.readonly. Easy Day cannot send, edit, move, label, or delete email.

When connected, Easy Day uses Gmail data only to perform the user-requested receipt synchronization feature: identify qualifying receipt or invoice messages currently labeled Inbox, extract conservative expense candidates for human review, avoid duplicates, retain a hashed provider identifier, and store supported receipt attachments privately. Spam, Trash, and messages no longer in Inbox are excluded at listing, History, and final-message validation.

• Google user data is not sold, rented, used for advertising, or used to build advertising profiles.
• Google user data is not used to train general-purpose artificial-intelligence or machine-learning models.
• Human access to Gmail-derived data is prohibited except when necessary for security, abuse prevention, legal compliance, or user-requested support, and is limited to authorized personnel.
• OAuth credentials are encrypted at rest and decrypted only in server memory. Receipt files are stored in private, organization-scoped storage and accessed through short-lived signed URLs after an authenticated tenant check.

Easy Day’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use information to provide expense tracking, review workflows, reports, billing access, account security, customer support, legal compliance, and service reliability. We do not use uncertain receipt values as approved financial records: Gmail imports enter a review state and require verified fields before approval.

Service providers and disclosure

We may use vendors such as hosting, database, private object storage, email delivery, payment processing, and Google APIs solely to operate the service. They receive only the information needed for that purpose under their applicable terms. We may also disclose information when legally required or to protect users and the service.

Retention, disconnect, and deletion

Organization owners and administrators can disconnect Gmail at any time. Disconnecting revokes authorization and clears stored credentials while preserving imported expense records and receipts. The separate “Delete Gmail Source Data” action deletes Gmail-derived private files and scrubs Gmail source metadata while preserving expense records. Deleting an imported expense first requires its private Gmail source data to be removed.

Other account records are retained while the account is active and as needed for legal, tax, fraud-prevention, backup, and contractual obligations. To request account-data access or deletion, contact the address below.

Security and tenancy

Easy Day uses authenticated, server-set cookies; organization-scoped authorization; role checks; encrypted Gmail credentials; private storage; short-lived signed receipt access; bounded sync leases; and audit-oriented synchronization history. No method of storage or transmission is perfectly secure.

Your choices

You may decline Gmail access and continue using manual entry, receipt upload, and statement import. You can revoke Easy Day in your Google Account permissions, disconnect it in Easy Day Settings, or request deletion. Organization owners control organization-level records subject to applicable law.

Children, changes, and contact

The service is intended for business users and is not directed to children under 13. We may update this policy and will change the effective date when we do. Material changes may also be communicated in the service.

Privacy or deletion requests: support@easydayexpensetracker.com.