Privacy Policy

Effective date: October 4, 2026

Who we are

BuckLoad is operated by Mayvand Khaliq, doing business as BuckLoad, Sacramento, California ("we", "us"). You can reach us at support@buckload.com.

What we collect

• Account details: your name, email address and password (stored only as a secure hash by our sign-in provider).
• Google or Apple sign-in: if you sign in with Google or Apple, they share your email address and, from Google, your name. We don't get your Google or Apple password.
• Your business records: the businesses, products, prices, sales, refunds, expenses, cash counts, mileage, contractor names, invoices, estimates, notes and settings you enter.
• Your customers' details: the names, email addresses, phone numbers and addresses you add for the people you invoice. You're responsible for having their permission to keep and use them for your business. If you scan a driver's license to fill these in, the photo is read on your device and isn't uploaded; only the name and address are kept, never the license number or birth date.
• Your personal budget: the spending, income, bills, reminders, budgets, savings goals, account balances and debts you enter, including transactions you import from a bank statement file. We never connect to your bank or see your bank login; only the file you choose is read, in your browser.
• Receipt files: photos or PDFs you upload. When you use "Read a receipt photo", the text is read on your device; only the photo you save and the details you keep are stored.
• Online payments: if a business connects Stripe so customers can pay invoices online, we keep the ID of its Stripe account and whether it can take payments, and for each online payment the amount, Stripe's fee, how it was paid (for example card or bank transfer) and Stripe's payment reference. Card and bank details are typed into Stripe's own page and go only to Stripe; we never see or store them.
• Square sales: if a business connects its Square account, we keep its Square account ID, business name and locations, and the access Square gives us to read its payments, orders and refunds (stored encrypted). For each Square sale we bring in, we keep the items, amounts, sales tax, tip, Square's fee, how it was paid (for example card or cash) and Square's receipt and payment numbers. We never see card numbers, and we can't charge anyone or move money in Square. Disconnecting stops this and asks Square to cancel our access; sales already brought in stay in your books until you delete them.
• Team and household details: the email addresses of employees or household members you invite.
• Reminder settings: whether you want reminder emails and your time zone, so they arrive at a sensible hour.
• Messages you send us: your name, email and message when you use the contact form on the Help page or email us.
• Error reports: if something breaks in the app, your browser sends us the error message, the page it happened on and your browser type, so we can fix it. Reports don't include your books, and we delete them after 30 days.
• Visitor statistics: we count page views with Cloudflare Web Analytics, which doesn't use cookies or track you across sites.
• Technical data: basic logs such as IP address, browser type and timestamps, kept by our hosting providers for security and troubleshooting.

How we use it

To run the service: sign you in, store and show your books, calculate your totals and reports, let your team or household work in your books, send account emails like confirmations, password resets and a welcome email, plus the bill reminders and monthly summary you've turned on, invite emails to the people you invite, and invoices, repeating invoices and payment reminders you choose to email to your customers (with replies going to you), keep the service secure, and contact you about your account. We don't sell your information, and we don't use your business records for advertising.

Who can see your data

• People in your company see what their role allows. Owners see everything in their company; employees see only the businesses and screens the owner gives them; an accountant the owner invites can read every business's books but change nothing. Everyone in a shared personal budget sees all of it.
• Anyone with the link to an invoice or estimate can see that one invoice: your business name and invoice details, the customer's name and contact details on it, and its lines and totals (never your costs). Links are long and random; only send them to your customer. When someone opens the link, we record when it was opened (not who opened it or from where) and show that to the business, so they know it was seen. If the business asks for a signature, the person signing gives their name and a drawing of their signature, which is saved on that invoice with the date and shown to the business.
• Our service providers process data for us: Supabase (database, sign-in and file storage), Netlify (website hosting and the contact form), Resend (sending emails), and Cloudflare (domain, email forwarding and visitor statistics). When a business turns on online payments, Stripe processes its customers' payments under Stripe's own privacy policy, and Netlify runs the small server functions that pass payment details between Stripe and BuckLoad. When a business connects Square, those functions also read its sales from Square.
• We may access account data when needed to provide support you ask for, keep the service secure, or comply with the law.

How long we keep it

We keep your data while your account is open. When an owner deletes their company or budget, its books and receipt files are deleted. When you delete your account, your login and everything you created are deleted; in a business or household someone else created, your entries stay with them. Backups held by our providers are removed on their normal schedule, typically within 30 days.

Your rights

You can see and download your data at any time (click your name, then Download my data), correct it in the app, and delete your account (click your name, then Delete my account). California residents have rights under the CCPA/CPRA, including to know, delete and correct personal information and to not be discriminated against for using these rights. To make a request, email support@buckload.com.

Cookies and browser storage

We don't use advertising or tracking cookies. The app keeps your sign-in and a few preferences, like which books you last opened, in your browser's storage so it works as expected.

Security

Data is sent over encrypted connections. Each company's records are separated by access rules enforced in the database. Receipt files are private and shown only through short-lived links. No system is perfectly secure, so use a strong password and don't share your login.

Children

The service is for businesses and adults managing their own money, and isn't meant for anyone under 18.

Changes

If we change this policy, we'll update the date above and tell account owners about important changes.