1. Who we are

Aglamazo is a personal-finance and small-business bookkeeping application at aglamazo.com, operated by Yaakov Aglamaz (Israeli business ID 012680286). Privacy contact: support@aglamaz.com

2. The principle: your data stays with you

Aglamazo is local-first. Your financial data is stored in your own browser (IndexedDB), not on our servers. We operate no central database of your books. Data leaves your device only in the cases described below.

3. What data the app handles

Bank and credit-card transactions; financial documents (invoices and receipts, including supplier name, document number, amounts, VAT and business IDs); business details including partners and their profit-share percentages; Ypay payment-processor credentials (client id and secret, with separate sandbox and production pairs), stored locally only, on the business record on your device; and settings including API keys and categories.

4. Google permissions

drive.file is not access to your Drive: the app cannot see, read or delete files it did not create.

gmail.modify rather than read-only because the app marks receipts as handled, organizes them into labels, and sends documents at your request — all of which require write access. It does not read mail unrelated to receipts, and sends nothing without your action.

Limited Use disclosure

Aglamazo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail or Drive data for advertising, do not sell it, and do not transfer it to third parties except as required to provide the service, as described in section 5.

5. AI document processing — the most important section

When you upload an invoice or receipt, the document is sent to a third-party AI provider to extract its details.

• Google Gemini (gemini-2.5-flash) — primary.
• Anthropic Claude (claude-sonnet-5) — fallback, used only when the first extraction fails.

What is sent: the document itself — a PDF or image containing supplier name, your name or business name, business ID, amounts, VAT and a description of what was purchased. What returns are the extracted fields, stored on your device.

This is the only processing in which your financial content reaches a third party other than you, and it happens only when you upload a document or request extraction from mail.

What the providers do with the document — verified 2026-09-09

• Google Gemini — Aglamazo's key sits in a project with billing enabled (paid tier). Under Google's paid-service terms, prompts and files sent to the API are not used to improve their products; they are retained for a limited period solely to detect Prohibited Use Policy violations.
• Anthropic Claude — inputs and outputs are deleted within 30 days, and are never used for model training without express permission.

Sources: Gemini API billing and tiers · Anthropic API and data retention

6. Cloud backup

If you enable cloud backup, data syncs to Firebase Firestore under your own Google account. Google OAuth tokens are excluded from backups — held device-locally and stripped from every backup write, so one device cannot overwrite another's access.

7. Deliberate sharing

• Shared household — the backup is shared with a spouse via a per-business shared password; once enabled, they see the shared financial data.
• Business partners — a registered partner sees the settlement screen: income, expenses and profit split.

8. Analytics

The site uses Vercel Analytics for aggregate usage data (page views, performance). It does not collect the content of your financial data. No other analytics or error-reporting tools are integrated.

9. Retention and deletion

Data persists while it is on your device; clearing browser data deletes it. If cloud backup is enabled you must also delete the backup, and you may contact us to request deletion. Documents stored in your Google Drive remain yours and can be deleted directly from Drive.

A deletion is a deletion. A record you delete does not come back on the next sync.

10. Security

Data is held on your device under your browser's and operating system's protections; cloud backup is protected by your Google account; household sharing by a shared password. Anyone with access to your device or Google account can reach the data.

11. Your rights

Because the data is yours and held by you, access and correction are direct, through the app. For any question, deletion request or complaint: support@aglamaz.com.

12. Changes

We will update this page on any material change and note the date of the last update.

Last updated: 09/09/2026