Tiksort (“we”) is built so that the contents of your email are never stored by us, and with Gmail or Outlook never even reach us. This policy explains exactly which data is processed, where, and why. Questions: privacy@tiksort.com.
Who we are
Tiksort is a service of an Israeli business (sole proprietor). Full business details appear on invoices and are available on request. Privacy contact: privacy@tiksort.com.
Access to your Google account
Only with your consent, Tiksort requests:
- Read-only Gmail access (gmail.readonly): to find receipts, invoices and payment confirmations in your browser. We cannot send, delete or change emails.
- Google Drive, only files the app creates (drive.file): only if you choose to save your package to Drive and share it with your accountant. We cannot access your other files.
- Basic profile information (name and email address): to sign you in.
The Gmail access grant is kept in your browser’s memory for a short time only and is not stored on our servers. You can revoke access at any time in your Google Account settings.
Access to your Microsoft account (Outlook)
If you connect an Outlook, Hotmail or Microsoft 365 mailbox, Tiksort requests, with your consent, read-only mail access (Mail.Read) and basic profile information. The grant is kept in your browser’s memory only, mail goes directly from Microsoft to your device, and you can revoke access at any time in your Microsoft account settings.
Other mailboxes (IMAP) and our relay
If you connect another mailbox (for example iCloud or Yahoo) with an app-specific password, your browser reaches your mail provider through a relay service we run on Cloudflare. The relay only passes the connection between your browser and the mail server, encrypted on both legs. While in transit it passes through the relay’s memory, but it is neither stored nor logged, and neither is your password. The password is kept in your browser’s memory until you close the tab. Access is read-only: nothing is deleted, moved or marked as read.
Documents you add yourself
Photos and files of receipts you add by hand are stored only on your device, together with the details you enter.
What stays on your device
Email contents, attachments and the data extracted from them (vendor, date, amount) are processed and stored only in your browser, in your device’s local storage. They are not sent to our servers. The same goes for the business number you enter for the VAT checks (for a sole trader, it is their ID number): it is kept on the device only and never synced. You can delete them at any time from Settings or by removing the mailbox from the device.
What we store on our servers
So that your account and preferences work on every device, we store (with our infrastructure provider Supabase, in the European Union):
- Account details: email address, display name, language, and your accountant’s email address if you enter it.
- Your preferences: per-vendor decisions (for example a vendor’s name or domain and that it is “business”), rules you create, and amount corrections. Per-document corrections are stored with a one-way hash of the email’s identifier, not its contents.
- Your subscription status.
- Aggregate usage data (for example how many documents a scan found), without contents.
- Feedback you choose to send us.
- Technical error reports, with nothing from your emails (see below).
Sharing your progress with your accountant (your choice)
If you choose to share your progress with your accountant, our server keeps their email, your name and email, and for each tax year numbers and dates only: how many documents each month, how many are ready and what is left, and when you last scanned and made a package. Your accountant sees them only when signed in to Tiksort with that same (verified) email. Email contents, vendor names, amounts and files are never shared. You can stop at any time in Settings, and it is then deleted from the server.
Google user data: Limited Use
Tiksort’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising, or use it to train AI models, and no one at Tiksort reads your emails (they never reach us).
Payments
When paid plans launch, payments will be processed by Paddle.com, acting as Merchant of Record. Paddle is responsible for processing payments and issuing invoices. We never see your card details.
Card statements
If you open a card or bank statement in the app, it is read and kept only on your device, to match charges with receipts. It is never sent to us or anyone else, and card numbers in it are not read. You can remove it from your device at any time.
Error reports
When something in the app fails, it sends us a technical report so we can fix it: the type of error, the screen, the last steps taken in the app (such as "scan started"), the app version, the browser and operating system, and the account identifier. Reports never include email content, subjects, addresses, names, amounts or file names: these are removed on your device before sending, and again on our server. Reports are kept for 90 days, then deleted, and only we can access them. Short alerts about new problems, with no personal data, are posted to our private team channel on Discord. You can turn them off at any time in Settings → Feedback.
Cookies and local storage
This website uses no tracking or advertising cookies. The app uses your browser’s local storage to keep you signed in and to store display preferences and scanned data.
Sharing
We do not sell or rent personal information. Information is shared only with infrastructure providers needed to run the service (storage and authentication, the IMAP connection relay, and in the future payment processing), or when required by law.
Retention and deletion
Server data is kept while your account is active. You can delete your account at any time in the app’s Settings, which deletes the server data immediately; or email privacy@tiksort.com and we will delete it within 30 days. Data on your device can be deleted by you at any time.
Your rights
Under Israel’s Protection of Privacy Law, 1981, you may access the information about you and ask us to correct or delete it. Contact privacy@tiksort.com.
Security
All connections are encrypted (HTTPS). Server data is access-controlled so that each user can see only their own data. We keep the minimum necessary.
Age
The service is intended for people aged 18 and over.
Changes
If we change this policy we will update the date at the top of the page, and give advance notice of material changes.