Privacy Policy

Who we are

DeFogger is a business management app for growing businesses. It brings financial and management clarity, so you can run your business efficiently. DeFogger is operated by FinThinkers (SMC-Private) Limited, a company incorporated in Pakistan. When we say “we”, “us” or “DeFogger” we mean FinThinkers (SMC-Private) Limited and the people who run the app for it. If you have any question about your data, contact us at privacy@defogger.app.

What we store

Only what you need to use the app:

• Your account details. Your business name, your chosen sign-in code, a scrambled version of your PIN (we never store your PIN in plain text), your country, and the phone number you gave us so we can reach you about your plan. From October 2026, if you choose to add one, also your email address, once you have confirmed it with a code (see “Your email, and the emails we send” below).
• Where your business is, and your billing details. From October 2026, for a business in Pakistan, we keep the province or territory you choose at sign-up. You choose it with one tap; we never guess it from your phone or your internet connection. It decides the sales tax on your DeFogger bill. If you choose to add them (Settings → Account → Billing details), we also keep your city, your business address, your NTN, your sales tax number, your tax office and whether you are registered for sales tax. All of these are typed by you, and every one except the province is optional. We use them only on the bills we send you. You can change or clear them at any time. They are deleted with your business.
• Which devices may open your business. From October 2026 a new phone or computer opens your business only after you (or an Admin you name) say yes. For each device we keep: a plain description of it (something like “Chrome on an Android phone”), the name you gave it, who may use it, who said yes and when, when it was last used, and a scrambled copy of the key it uses (never the key itself). While a device waits for your yes, we also keep the short code it shows on its screen. If you take a device away, we keep that it was taken away, and when. It is not a location and not a phone number. Starting your books fresh keeps only your own devices; deleting your business deletes them all.
• Your DeFogger invoices. From October 2026, when you choose a plan we make an invoice: its number, the plan, the price, the sales tax (if any, and the tax rule it was worked out by), the total, the day to pay by, and a copy of your billing details as they were that day (your business name, code, licence number, province, and any city, address, NTN or sales tax number you added). An invoice never changes after it is made, so later changes to your billing details do not change an old invoice. Each invoice has its own page with a long, unguessable link, so you can open it from the email or the app, or send it by WhatsApp. Anyone who has that link can open the invoice, so send it only to people you choose. Like your payments, invoices are FinThinkers’ own accounts: they are kept after your business is deleted, then closed, and their links stop working.
• “I have paid”. When you tell us you have paid an invoice, we keep the reference you typed and, if you add one, the screenshot of the payment (made smaller on your phone first). Only we see it, to find your payment. While we check, your business stays open for up to 3 days, and we note that day. If we cannot find the payment, we tell you why, by email and in the app. The screenshot is never part of our backups, and it is deleted with your business.
• What you paid us. From October 2026, when you pay for DeFogger, we write down the payment exactly as it reached us: the amount, how you paid, any reference you gave, the day, and the receipt number we gave it. These are FinThinkers’ own accounts, so they are kept even after your business is deleted. Then they are closed: no longer shown with your sign-in code, and never shown to anyone else. We never see or keep your card or bank account details. Today you pay us by bank transfer. If we offer payment by card in the future, you will type your card details on the bank’s own secure page, and the bank tells us only whether the payment went through, its amount and its reference.
• Your books. The sales, purchases, payments, expenses, stock, customers and suppliers you enter as you use the app. From August 2026 a sale also records the time of day it was rung up, alongside the date, so you can see when your counter is busiest. From September 2026 the same is true of a payment, a return and a credit handed back. This is so that a day on a customer’s statement reads in the order it actually happened, and the running balance beside each row is a figure the account really stood at. Also from September 2026, a purchase, a goods receipt, a purchase return and a correction to a supplier’s bill record the time of day in the same way, so a supplier’s statement reads in the order it happened too. From October 2026 that time also keeps its second, so two entries made in the same minute still read in the order they happened; papers still print the minute only. It is the time only, on entries you were already making.
• A note of the tax returns you tell us you have filed. If you mark a tax period as filed, we keep the period, the figures you declared, the day you marked it, and the reference number from the tax office if you choose to type one in (you can leave it blank). It is how the app can warn you later that your books no longer match what you filed. We never send anything to a tax authority, and we never file anything on your behalf.
• How you have set the app up. Your trade, your currency, your tax settings, which features you have switched on, and the words your business uses (what you call a pack, how you measure length, what you call a delivery charge, what you call a running account). These travel with your business so every device you sign in on looks the same.
• What you pay your staff. From October 2026 your books can also hold each staff member’s pay and the advances they owe back, under that person's name, so the app can take an advance off the next pay. It is part of your books and goes only where your books go.
• Loans and your own money. From October 2026 your books can also hold the loans your business takes: who lent it (for example a family member or a bank), how much, and what you paid back. They can also hold the money you or a partner put into the business or take back, under that person's name. It is part of your books and goes only where your books go.
• A bank or wallet statement you choose to load. From October 2026 you can load the statement your bank or wallet app gives you, to check your account at the day’s close. A spreadsheet (Excel or CSV) is read on your device and never leaves it. A PDF or a picture of the statement is sent to our own server only so its words can be read (a picture is first made smaller on your phone, which also removes its hidden details), and it is not kept and never sent to any other company. A charge or a move you then record from a statement line becomes part of your books like any other entry.
• A supplier’s bill you choose to photograph. From August 2026 you can take a picture of a supplier’s bill and have the app read the rows off it instead of typing them. The picture is sent to our own server, read there, and never sent to any other company. No browser can read words out of a picture, which is the only reason this step leaves your phone at all; everything else about importing happens on your device. It needs an internet connection, and if you would rather not send a picture, typing or a spreadsheet works exactly as before.
• A small copy of that bill, kept with the purchase it recorded. When a photographed bill becomes a purchase in your books, we keep a shrunk copy of the picture (a fraction of the size your camera produced) alongside that purchase, so you can show the original if your supplier ever disagrees with what was delivered or charged. It is deleted automatically after three years. It stays inside your own business’s books. No other business, and nobody outside DeFogger, can see it. You can switch this off in Settings → Data, and then photographs are read and thrown away at once. Bill photos are not included in the nightly backup: they are evidence, not accounts, and the backup carries your books.
• What a supplier’s bill calls your products. From August 2026, when you photograph a supplier’s bill and correct a line (“this supplier’s COLCH 0.5 is my Colchicine 0.5mg Tab 100s”), we keep that one correction with your business so the next bill from the same supplier fills itself in. It is the supplier’s wording and your own product. It holds no price, no quantity and nothing about the bill itself. Every correction we reuse is shown on screen with a forget button beside it, and forgetting removes it straight away.
• What selling costs you, if you tell us. From August 2026 you can say what taking money a certain way costs you (a card machine’s cut, for example) and what percentage a staff member earns as commission. Both are optional and blank until you fill them in. They are rates, not payments: we do not pay anyone, and we do not keep any record of wages, salaries or what anyone was actually paid. The app uses them only to work out which of your own products carry the delivery and commission costs you have already recorded, so you can see what each product really leaves you. A staff member’s commission rate is visible to you as the owner and to anyone you have given Settings access.
• Product photos you choose to add. If you put a photo on a product's counter tile, we keep a small copy of that photo with your business so it shows on every device you sign in from. Photos you don't add don't exist; deleting one in the app deletes our copy.
• Which of your devices is issuing bills. From August 2026, so that two devices in one business can never print the same bill number, we keep a short note of which device is currently the counter: a random name the app makes up for that device, a plain description of it (something like “Chrome on Windows”), how many bills it has not sent us yet, and a changing key it uses to prove it is still the same device. That note says nothing about you, your staff or your customers. It is not a location, not a phone number and not a name. It is kept only while it is in use, it goes when you start your books fresh, and if you never use a second device it is barely ever written at all.
• Which of your devices made each entry. From late September 2026 every entry in your books carries the made-up name of the device that recorded it, which of your counters it was recorded under, and that device’s own running count (its first entry, its second, its third…). There is one reason: it is how we can tell that an entry is missing (a sale rung up on a phone that broke before it sent it) instead of never knowing it existed, and how the app can say at the end of a day whether every device’s entries have arrived. It is the same made-up device name as the note above, never a location, a phone number or a person, it says nothing about your customers, and it goes when you start your books fresh.
• What your bank or wallet held before you started, and what you find in it at closing. From late September 2026, if you want the app to tell you what an account should stand at, you can type what it held before you began using DeFogger. The app then adds every payment that has gone through that account since and shows you the figure; at closing you may type what your bank app actually shows, and both figures are kept with that day's close. We never connect to any bank. There is nothing to log in to, we cannot see your statements, and nothing is fetched from anybody. It is your own figure, typed by you, kept with your own books. If you never type one, none of this is ever written. It goes when you start your books fresh, and it is deleted with your business.
• Who was signed in when each entry was made. From late September 2026, if your business uses the app lock and your people sign in with their own PIN, every entry carries the name and number of the person who was signed in at the time. It is stored with the entry, it reaches your other devices exactly as the entry does, and the name is kept as it was on the day, so an entry still says who made it even after that person has left and been removed from your staff list. It is there because business owners ask for it: at the end of a month you can look at a row in your books and see who recorded it. It is a record, not a lock. Nobody is ever stopped from working, and if nobody is signed in the app writes no name rather than guessing one. If you do not use the app lock, none of this is ever written. It says nothing about your customers, it goes when you start your books fresh, and it is deleted with your business.
• Which devices you have allowed to be a till. From September 2026, once your business has more than one counter, a device has to be allowed before it can give out its own numbers. When you allow one, we keep that with your books: the device’s made-up name, its plain description, the name of the person who allowed it, and the date. Unlike the note above, this one is kept for good. It is what stops the same device being asked again, and it is there so you can look back and see which machines were allowed and by whom. It is the same kind of record as the staff name already written on a bill. You can see the list in Settings. It goes when you start your books fresh, and it is deleted with your business. If your business has one counter, none of this is ever written.
• A list of the numbers your documents have been given. From September 2026 we keep, alongside your books, a note of every number your bills, receipts, return notes, correction notes, credit notes, quotations, orders and vouchers have used, and which of your counters issued each one. It is how a device that has been offline for a week knows where to carry on from instead of handing a second customer a number somebody already has, and it is how we can tell you if two devices ever did print the same one. It is only the numbers and the dates. It holds no customer, no product, no amount, and nothing that is not already in the books you entered. It goes when you start your books fresh, and it is deleted with your business.
• If you collect samples: the sample’s number and the time it was taken. From September 2026, a lab or clinic can switch on sample collection. When a sample is actually drawn, the app gives it a number (S-000001), prints it and its barcode on the paper the patient holds, and keeps that number and the time of the draw with the bill in your books, so the tube can be matched back to the right visit. It is the same information the bill already carries (the visit, the tests billed, and a number), plus the time of day it was drawn. What a technician later reads off the machine is covered separately below. It is switched off for every trade except a lab, so if you do not collect samples none of this is ever written. It goes when you start your books fresh, and it is deleted with your business.
• If you charge tax: your customer’s tax number and address. From September 2026, where your business charges tax, you can record a customer’s registration number and address on their record. There is one reason: a tax invoice has to name who the goods went to, and a registered buyer needs those details on the paper to claim the tax back. Both are optional, and a business that charges no tax is never asked for either. They are kept with that customer in your books, they print on that customer’s own invoices and credit notes, they go when you start your books fresh, and they are deleted with your business.
• If you collect samples: your patient’s date of birth and sex. From September 2026 a lab can record these on a customer. They are needed for one reason only: a normal range for a blood test is different for a man and a woman, and different for a child and an adult, so without them the app cannot show the right one. Both are optional, and nothing is ever refused for want of them. They are kept with that customer in your books, they go when you start your books fresh, and they are deleted with your business.
• If you collect samples: the readings your technician types, and your own normal ranges. From September 2026 a lab can record the result of each test on a visit: the figure itself, its unit, who typed it and when. It is kept with your books and it reaches your other devices exactly as a bill does, so a bench computer and a counter computer show the same thing and a broken laptop does not take a patient’s results with it. Your normal ranges are stored the same way. They are yours, typed by you. We never supply a figure of our own, because a normal range depends on the kit and the method your own lab uses. This is health information, and we hold it only to run your lab. We keep no diagnosis and nothing a doctor wrote. The app has no place to put either. It is switched off for every trade except a lab, so if you do not collect samples none of it is ever written. It goes when you start your books fresh, and it is deleted with your business.
• When you close a day: what you counted in the drawer, and what you decided about any difference. From September 2026 you can count your cash at the end of a day and sign it off. We keep, with your books: the day, what the books expected to be in the drawer, the figure you counted, the difference between the two, how much you kept back for tomorrow, the day’s own sales and cost totals, the time, and the name of the person who closed it. If the drawer did not agree, we keep what you decided about it: fixed, accepted, or carried forward. We also keep the reason you typed, if you typed one (you can leave it blank). It is what makes the figure worth anything later: a difference somebody dealt with on the night is a fact, and a difference nobody wrote down is an argument a month afterwards. It is your own business record, in the same way a bill is. A close cannot be changed once made. Anything that needs correcting is recorded afterwards as its own entry. It goes when you start your books fresh, and it is deleted with your business.
• Who approved a close. From late September 2026 a day close and a month close say who approved them: the owner signed in and closed it himself, or the owner’s PIN was typed at the counter, or the owner said yes on his own phone, or, if your business has set no owner PIN, that it was simply written down. We keep the owner’s name and which of those it was. The PIN itself is never kept. It is checked on your own device and then thrown away; it is never written into your books and never sent to us. It goes when you start your books fresh, and it is deleted with your business.
• When you close a month: what was checked, and what you decided. From late September 2026 you can close a whole month once every day in it has been closed. We keep, with your books: the month, the list of checks (was the cash counted every day, did each bank agree, was stock counted, was anything left unreviewed), which of them the books proved by themselves, which ones you checked or accepted yourself, and the reason you typed if you typed one, the month’s own totals as they stood that day, the time, and who closed it. Like a day close, it cannot be changed afterwards. Anything found later is shown beside it, never written over it. It goes when you start your books fresh, and it is deleted with your business.
• Money you move between your own accounts. From late September 2026 you can record cash taken out of the drawer and paid into the bank, or money moved from one of your accounts to another. We keep the two accounts, the amount, the day, a note if you type one, and who recorded it. It is your own money moving between your own accounts, kept like any other entry in your books. We never move any money ourselves, and we never connect to any bank. It goes when you start your books fresh, and it is deleted with your business.
• If you check a bank account against its statement. From late September 2026 you can load the statement file your bank lets you download (a CSV or Excel file), or tick your own entries against your bank app, and the app shows you what agrees and what does not. The statement file is read on your own device and is never sent to us or to anybody. What is kept with that day’s close is: how you checked the account, how many of your own entries matched, which of your own entries are still waiting to show at the bank (so the next check can look for them), any difference left over, the balance the bank showed for that day, and the statement’s first day, last day and number of lines. If the bank shows something your books do not have, we keep how many such lines there were, their total, and the reason you type, if you type one. Nothing else from the file is kept: not the bank’s own lines, not their descriptions, not your account number, and not the running balance. It goes when you start your books fresh, and it is deleted with your business.
• Anything you send us on purpose. If you tap “Tell us something” and write to us, we keep your message and your business name so a person can read it and reply.
• A note when you ask us for help. If you message or call us with a question, we write down which business asked, a line about what you needed, and roughly how many minutes it took. It is how we learn what people find hard, and how we work out when we need more people answering. It is written by us, not taken from your phone, and it never includes anything from your books.
• Words our importer could not read. When you bring in a spreadsheet and it uses a column heading or a measure word we don’t recognise (something like “B.No” or “tola”), the app can tell us that word on its own, so the next update reads your file without asking you anything. Only the word. Never a product, a price, a quantity, a recipe, a customer or a supplier. Nothing is sent unless you say yes. The first time there is such a word, the app shows it to you and asks; if you say no, it remembers your answer and does not ask again. You can change your answer at any time in Settings → Help & feedback.

Why we store it

• To run the app and show you your own books on any device you sign in from.
• To back it up and keep it in sync, so your books are safe across a refresh, a lost phone or a new device.
• To support you if you ask us for help with a problem.
• To manage your plan (your onboarding, your subscription, renewals and payments).
• To keep your bill numbers straight across your devices, so a phone and a counter PC in the same business can never hand two customers the same bill number, and so you are told about it if they ever do. Once your business has more than one counter, that also means keeping a record of which devices you have allowed to be a till, and who allowed each one.
• To let you see who recorded an entry, if your people sign in with their own PIN, so an owner looking at a row in the books a month later can see who made it. We never use it for anything else, and we never look at it.
• To tell you what a bank or wallet should be holding, if you have typed what it held to begin with, so you can compare it with your own bank app at closing. We never connect to any bank.
• To show you whether your bank agrees with your books, if you check it against its statement, and to remember which of your entries the bank has not shown yet, so the next check looks for them instead of asking you again.
• To let you close a month on figures you can trust, and look back later on what was checked, what was accepted, and who approved it.
• To make the app read your files better, and only ever from the words it failed to understand, never from what those files are about.
• To show you what a product really leaves you, by dividing the costs you have already recorded across the products that caused them. This never adds money to your books and never changes a bill.
• To match a sample tube back to the right patient, if you collect samples, so the number on the tube can be scanned and land on the visit it belongs to, rather than on somebody else’s.
• To put the right particulars on a tax invoice, if your business charges tax. This is the only reason a customer’s registration number and address are kept, and why they appear on that customer’s papers and nowhere else.
• To show your technician the right normal range, if you collect samples. This is the only reason a patient’s date of birth and sex are needed, and why a reading is kept with the visit it belongs to.

Who can see your data

• You, and any staff members you choose to invite into your own business.
• DeFogger staff, only with your permission. From October 2026, nobody at DeFogger opens your books unless you allow it. You allow it when you ask for help (one tick in Tell us something) or under Settings → Help → DeFogger support: for 1, 3 or 7 days, look only or look and fix, confirmed with the owner's PIN if your business uses PINs. We can then help while you are busy or asleep. Each visit lasts at most an hour, and records who came, why, and every entry they made. Each entry is marked "DeFogger support". You see every visit under Settings → Help, and you can end access at any time. The one exception: in a real emergency, when you cannot give permission (for example your books will not open at all), the owner of DeFogger may look (only look, for 30 minutes). It is written down as an emergency and shown to you. Our console is built to show only how a business uses DeFogger, never its actual sales, customers or prices.

Each business is walled off from every other. One business can never see another's data.

What we never do

• We never sell your data.
• We never share it with other companies or use it for advertising.
• We never use your numbers for our own purposes.

Keeping it safe

Your data travels over an encrypted (HTTPS) connection, your PIN is scrambled before it is stored, and each business's books are kept separate and private. No system is perfectly secure, but we take reasonable steps to protect your information.

The keypad PINs of your people, and the owner's. From October 2026 a PIN typed on the keypad is kept only as a slow, salted scramble that your own device makes; the PIN itself never reaches us. We keep that scramble so a phone or computer you have let into your business can check a PIN, even with no internet. From 8 October 2026 the owner's keypad PIN is kept the same way, and it no longer travels inside the books or the backup file.

Wrong PINs are slowed down. From late September 2026, if a PIN is typed wrong several times in a row, the next try has to wait a little, and the wait grows the more it happens. To do this our server remembers, for up to a day and only in its working memory, the business code that was tried and the internet address the tries came from. It is never written into your books or into any file, and it is forgotten after a quiet day or whenever the server restarts. Our server's own log notes how many wrong PINs a business code has had in a row. It never notes the PIN that was typed, and never the address. We do the same for the number of new businesses created from one connection, so nobody can flood the service.

Wrong PINs at the counter are limited too. From October 2026, after five wrong staff or owner PINs in a row on one device, that device makes the next try wait, and the wait grows. The count and the time the wait ends are kept only in that device's browser. They are never sent to us and never in your books. The right PIN clears them.

The owner can say yes on his own phone. From October 2026 an owner can set up their own phone so that a big discount, closing the day, a new till and the other things that needed his PIN are approved there, with a fingerprint or screen lock, even with no internet. The fingerprint never leaves the owner's phone; the phone only says whether it matched. What we keep is the phone's public key (a code that can check the owner's signature but cannot make one, and is not a secret), with the name given to the phone and the day it was set up. Each approval travels in your books with the action it allowed: what was asked, by whom, at which counter and when, and the owner's signature. Our server checks every signature again when the action arrives and keeps what it found (good, or why not) so the owner can read it. All of it is deleted with your business. Starting your books fresh does not remove the public key. It only remembers which phone is the owner's.

The owner's backup codes. When the owner sets up their phone, the app makes ten backup codes and shows them once, to be written down. A code lets the owner say yes when the phone is lost or not at hand. We never keep the codes themselves. We keep a scramble of each one, made slowly on purpose so it cannot be worked back into the code; every device of your business holds the same scrambles, so a code can be checked with no internet. Each code works once, and we keep which ones were used. A wrong code counts towards the same wait as a wrong PIN. Making new codes replaces the old ones. All of it is deleted with your business.

Your email, and the emails we send. From October 2026 you may add an email address in Settings → Security, or right after you sign up. It is optional; nothing in the app needs it. We send a 6-digit code to it, and it counts as yours only once you type the code back. We keep only a scramble of the code, for 10 minutes; the code itself is never kept and never written to our logs. Once confirmed, we send to that address: security notices (a device signed in, wrong PINs were tried, the PIN was changed, an owner phone was added or taken away, new backup codes, the books were erased or put back), emails about your plan (it started, it was renewed, it ends soon, it ended), your invoices, a note if we could not find a payment you told us about, receipts for what you paid, and a short reply when you write to us from the app. It can also reset your sign-in PIN if you forget it (Forgot PIN? on the sign-in screen); an address confirmed less than a day ago cannot do that yet. If the address is changed or removed, the old address is told. The first time your business confirms an email, we add 7 free days to your plan, once, and we note the day we did it. Our emails come from auth@defogger.app and go out through our email provider, Hostinger. So Hostinger's mail servers carry each one: the address it goes to and its words, including a code or the amount on a receipt. Nothing else from your account or your books goes with them. For each email we keep a short record (what kind it was, the address, when, and whether the mail server took it) for 180 days, so we can answer “did my receipt go?”; a code is never kept in it. Your email is never used for adverts and never given to anyone else. Deleting your business deletes the email, its codes and that record.

Asking the owner from far away. From October 2026 a counter can send its question to the owner's phone through our server: what is asked, by whom, at which counter and when, the same words it shows on its own screen. We keep it for ten minutes, or until the owner answers or the counter withdraws it, with the owner's yes or no. If the owner asks to be rung, his phone gives us an address at its own notification service (Google's for Chrome on Android, Apple's for an installed app on an iPhone), and we send an empty ring to it. The ring carries nothing (not your business's name, not the question), so that company learns only that a notification went to that phone. Stopping the rings removes the address. All of it is deleted with your business.

Changing your PIN signs every device out. Each device that signs in to your business carries a key. When your PIN is changed, that key is replaced, so a lost phone, or anyone who knew the old PIN, can no longer reach your books. Each of your own devices simply signs in again with the new PIN. Nothing on them is lost: entries not yet sent wait on the device and go up once it signs back in.

Start fresh can be undone for 30 days. From October 2026, when a business erases its own books with Start fresh, our server no longer destroys them on the spot. It keeps the erased entries for 30 days, out of reach of every device, and then deletes them by itself. The reason is simple: a phone that is signed in to your business can press Start fresh, and books erased by mistake, or by someone who should not have, must be able to come back. Only the owner of DeFogger can put them back, and only while your business has recorded nothing since. Everything this page says "goes when you start your books fresh" is kept in that copy for those 30 days. Deleting your business at your request removes the copy at once.

A business we close is kept for 30 days. From October 2026, when we close a business (a test business, or one that has stopped), it stops working at once: no device can sign in or send. Its books are kept whole for 30 days, so a mistake can be put back, and then they are deleted by themselves. The record of what you paid us is not deleted with them: it is our own accounts (see “What you paid us”). If you ask us to delete your business, we close it and delete it at once instead.

Help without opening your books. If you are locked out (a forgotten PIN, or a staff lock nobody can open), we can reset your PIN or turn off the staff lock without looking at your books. We do it only after calling you back on the phone number on record, we write down why, and you are told under Settings → Help.

What our own staff do is written down. From October 2026, every change made to your business from our owner console (opening it with your permission, changing its licence, recording a payment, resetting its PIN, closing or deleting it) and every Start fresh is recorded in a history that cannot be edited. It says which of our staff did what, to which business, and when. It never holds your PIN, a password or a key, and nothing from your books.

Our own staff sign in with a second step. From October 2026, every person who uses our console signs in with a password and a 6-digit code from an authenticator app on their own phone, and a console session ends by itself after an hour without use. So a lost or borrowed staff phone cannot reach your business.

We also keep our own safety copies of the service, so your books can be restored if something goes badly wrong at our end. Those copies deliberately leave out the sign-in keys, so even if such a copy fell into the wrong hands, it could not be used to get into your books. Only the owner of DeFogger can make one.

A locked copy is made every night, by itself. From October 2026, every night and whenever we update the service, our server makes a safety copy of every business's books and locks it before it leaves (it is encrypted). The locked copy is kept in a private store on GitHub, a service for keeping software, run by Microsoft. The key that opens the copies is not kept there. Only the owner of DeFogger holds it, so neither GitHub nor anyone who reached that store could read your books. We keep one copy a day for 30 days and one a month for 12 months; older copies are deleted by themselves.

From time to time we practise the recovery, because a backup nobody has ever restored from is a hope, not a plan. That means loading a safety copy into a temporary, separate system, checking the books come back correctly, and then destroying that system. It is done by the owner of DeFogger alone, the temporary copy is never open to anyone else, and it is deleted as soon as the check is finished. Your live books are never touched by it.

Your rights

• Export. You can take your data out at any time, in one tap, from Settings → Data. You get a single file holding your whole books that opens in any browser on any phone or computer, with no app and no internet. You also get spreadsheets if you prefer Excel. The same file can be loaded back into DeFogger to rebuild your books. It is not locked with a password, because you need to be able to open it yourself, so treat it like your ledger book: anyone who opens it can read your sales, prices and customers.
• Delete. Ask us and we will delete your business and all of its books at once. (Deleting is permanent.) Locked safety copies made before the deletion are not opened and edited; they are deleted as they age out, within about a year. The record of what you paid us is kept, closed, as our own accounts (see “What you paid us” above).
• Correct. You can edit your own books and account details in the app whenever you like.

To make a request, email us at privacy@defogger.app.

Where your data is kept

Your data is stored securely with our cloud hosting provider, Railway. Locked safety copies of it are also kept in a private store on GitHub, as explained above, and only the owner of DeFogger holds the key that opens them. If we ever change where or how it is stored in a way that affects you, we will update this page.

A copy also stays on your own device. That is what lets you keep billing when the internet drops, and it is kept in your browser's own storage on the phone, tablet or computer you use. It is not a separate file you can lose, and it is never sent anywhere except to your own cloud books. It holds the same things your books hold, so treat an unlocked phone the way you would treat an open ledger. Signing out removes that copy from that device once every entry on it has reached your cloud books. From October 2026 the app checks first. If some entries have not reached the cloud yet (with no internet, for example), they stay on the device so nothing is lost; the app tells you so before you sign out, and they go up when your business signs in there again. Clearing the app's data in your browser removes the copy at once, sent or not. Your cloud books are untouched either way.

Changes to this policy

If we change this policy, we will update the date at the top. Please check back from time to time.

Contact

Questions about your privacy or your data? Email privacy@defogger.app and we will help. For anything else, write to support@defogger.app.