App privacy policy
What the app keeps, and why.
This policy explains what the eZacto mobile app collects, why, who sees it, and your choices. The browser Apple sign-in section also covers that optional authentication service in CONFLICT's team workspace and the public ezacto.io demo. The eZacto instance you connect to is controlled by its workspace operator under its own policies. For the ezacto.com marketing site, see the site privacy policy; for the browser extension, the extension privacy policy.
What the app handles
Sign-in token and cached records. Your session token is stored securely on your device. Time entries, projects, and invoices are sent to and cached from your eZacto instance. Cached records may remain available offline; refreshing records, uploads and other server actions require a connection.
Sign in with Apple. In app versions that use our Apple authentication service at apple-auth.ezacto.com, choosing Apple sign-in sends the authorization code and identity token to that first-party service. We verify them with Apple and hold the resulting authentication credentials encrypted so we can validate and revoke authorization when needed. This includes your Apple user identifier, any email or private-relay address in the identity token, your selected instance's origin, and limited request and recovery information. We do not separately request your name or email for this service. Your workspace password, API credentials, time entries, invoices and receipt photos are not sent to it.
Receipt photos. When you choose to attach a receipt to an expense, the app requests camera access to take a photo or opens the photo picker. You can review or remove the photo before saving. The image may be compressed before it is uploaded to your selected workspace as an expense attachment. The workspace operator controls its storage, access and retention. The app does not extract receipt text with OCR or send the photo to an AI service.
App updates. The app checks Expo's update service for compatible updates. These requests include technical information needed to deliver the correct app update and a randomly generated installation identifier that persists in the app's native preferences. It is not an advertising identifier or a hardware serial number. During recovery from an update failure, a request can also include a previous fatal-error message alongside that identifier. This update and recovery processing is separate from Sentry crash reporting. Your workspace records and receipt photos are not sent to Expo for update delivery. See Expo's privacy policy for its processing practices.
Timezone. The app sends your device's timezone to your instance so a running timer is filed on your local day.
Support requests. If you contact support from the app, your message, the optional reply email you provide, your platform, and the app version are sent through our Cloudflare website service and recorded in a private GitHub support issue. Diagnostic details are included only when you choose to attach them: app/build and operating-system information, device name as supplied by the operating system, language, timezone, instance hostname, Pro status and recent redacted diagnostic logs. These details remain with your support message and any reply email you provide; they are not treated as anonymous. Avoid sending secrets or unnecessary personal information.
Crash diagnostics (when enabled in the build). If your build enables crash reporting, crash and error diagnostics are sent to our processor (Sentry), used only to fix problems, with default user-data collection and performance tracing disabled. This is a build setting, not a per-user consent switch. If you submit optional support diagnostics, the build may also send a support-event subject and diagnostic context to Sentry. Do not include sensitive information in the subject or diagnostic attachment.
The app does not use third-party advertising and does not track you across other apps or websites.
Apple sign-in in your browser
This section applies when browser Apple sign-in is enabled in CONFLICT's team workspace or the public ezacto.io demo. The shared Apple service processing, credential retention and recovery periods, security, contact and rights information in this policy also applies. Descriptions of mobile device storage, app updates and receipt capture apply to the mobile app.
Apple receives the site's sign-in identifier, callback address and sign-in security information. Its response to the site can include an authorization code, identity token with your Apple identifier and email or private-relay address, and a name on first authorization. The team site applies its normal membership and account-provisioning rules and may store identity and profile information. The demo does not create a personal workspace account for the visitor, but Apple identity and email claims still reach the first-party credential service. Using a shared demo account does not make that authentication data anonymous.
Sign-in uses a secure browser cookie lasting up to five minutes to match the callback to your request; it is cleared after a valid callback. A separate secure recovery cookie, lasting up to 90 days, lets the site recognize your Apple connection for cleanup. The site stores a hash of that recovery handle. Your ordinary workspace session is separate. Sign-in transaction records include security hashes, including an IP-derived hash, and request timing information. Expired transactions are cleaned up when later transactions are created, not necessarily at the instant a cookie expires.
The site stores Apple identity references, encrypted recovery credentials and cleanup proofs, and connection, site and request information. Team connections can be linked to a workspace user; demo connections are not linked to a personal demo workspace account. Encryption and hashing do not make these records anonymous. Team-site connection metadata and proofs have no automatic age-only purge; the operator must manage their retention and requests separately from the credential service's recovery periods.
The first-party service exchanges the authorization code with Apple and keeps the resulting provider credentials encrypted for validation and revocation. Your workspace password, API credentials, projects, time entries, invoices and attachments are not sent to that service. Its retention and provider recovery-copy limits are described below.
Signing out, clearing or expiring cookies, a failed callback, or a demo reset does not automatically revoke Apple authorization or erase credentials held by the separate service. Use the site's Disconnect Apple action to request revocation. If recovery information is lost or the site database is reset, you may need to authorize again with the same Apple account to regain cleanup access. Contact us if you cannot recover it.
Disconnecting can affect related eZacto Apple sign-ins, including the mobile app, team site and demo. Closing workspace access and revoking Apple authorization are separate actions; provider cleanup can remain pending or require follow-up. Neither action by itself proves that all workspace records or historical recovery copies were erased.
How it is used
To provide time tracking and billing, attach your receipts, deliver app updates, verify and manage Apple sign-in authorization, keep you signed in, file your time on the correct day, answer support requests, and diagnose crashes. That is all.
Where GDPR applies, necessary processing to provide the authentication and account-management service you request relies on Article 6(1)(b). Limited fraud prevention and service-security processing relies on our legitimate interests under Article 6(1)(f), subject to your rights and interests. See GDPR Articles 6, 13 and 21 for lawful bases, information duties and objection rights. These bases do not create a blanket exception to deletion.
Who sees it
Your business records and receipt photos go to your selected eZacto instance and the storage services its operator uses. Support requests go to the eZacto team through Cloudflare and private GitHub issues. Crash diagnostics, when enabled, go to Sentry as a processor. Expo processes update requests, installation identifiers and any included recovery errors to deliver and recover app updates. Subscription purchases are handled by Apple or Google under their own policies. CONFLICT operates the Apple authentication service using Cloudflare for request processing and encrypted storage; Apple receives the requests needed to verify, refresh or revoke its credentials. Authentication information is not used for advertising or cross-service tracking. We do not sell your data.
Retention and account deletion
Sign-out clears the app's ordinary workspace token and persisted cache. In builds supporting request recovery, a limited deletion-request record remains in secure storage after sign-out or restart so you can check its status without keeping ordinary login credentials. This applies whether or not you used Apple sign-in. Pending Apple cleanup information may remain separately so the app can finish or recover that request. Saved deletion-status records remain until you explicitly remove them using the saved request's Remove action; completion, sign-out or expiry of server status access does not automatically erase that local record. Uninstalling alone may leave iOS secure-storage entries. Server records and store purchase history are separate from device data. The workspace operator determines the retention of business records; operating the app does not give CONFLICT access to self-hosted data.
An account-deletion request does not require destruction of records that must lawfully remain for tax, accounting, employment or audit purposes, or necessary legal claims. Required records may include worker identity, when work occurred, hours, rates, approvals, invoices, payments and the audit trail connecting them. Only necessary records and attribution should remain for the applicable period; unrelated profile information does not inherit that exception.
CONFLICT's separately contracted hosted service follows the hosted retention terms, with US, Florida, California, Texas and EU references. Independent operators must provide their own applicable schedule and request handling. For data we control separately, including support correspondence and identifiable diagnostics, we assess requests and retain only what remains necessary for a disclosed lawful purpose.
Apple authentication credentials are retained encrypted while they remain needed to manage a revocable authorization, with validation no more than daily. Confirmed invalidation removes the credentials; temporary provider failure does not count as successful revocation. Short-lived sign-in challenges expire after five minutes. After confirmed revocation, limited proof and request information can remain recoverable for up to 90 days, with a review reminder after 30 days, so you can finish delivery to an unavailable workspace. It is removed earlier when delivery is acknowledged or you explicitly discard it; minimal acknowledgement information remains for 24 hours. Metadata for a credential Apple reports as invalid expires after seven days. These are authentication recovery periods, not financial-record retention exceptions.
Removing active authentication records does not instantly erase every provider recovery copy. Cloudflare's SQLite storage supports recovery of the preceding 30 days; we do not create separate exports of Apple credentials. See Cloudflare's storage and recovery documentation. Recovery copies must not be restored to resume old authorizations.
Security
Data in transit is encrypted with HTTPS. The mobile workspace token is held in the device's secure storage. The Apple service encrypts stored credentials separately from the device and does not log request bodies or tokens. Infrastructure providers still process network and security information needed to operate the service. No method is perfectly secure, but we take reasonable measures to protect your information.
Your choices
In the mobile app, sign out to clear the ordinary workspace token and cache from the device. Sign-out alone does not revoke Apple's authorization or erase records on your workspace. See Apple sign-in cleanup for recovery and the possible effect on other eZacto sign-ins. Ask your administrator to correct or delete records on your instance. For support-ticket data, contact us. To have your account and the data held against it deleted, see account and data deletion.
Children
The app is intended for workplace use and is not directed to children, and we do not knowingly collect children’s information for our own account or marketing purposes. Contact us if you believe a child has provided information to us.
Changes
We may update this policy; the "last updated" date above will change, and significant changes will be noted in the app where appropriate.
Contact
CONFLICT LLC, 80 SW 8th St, Ste 2000, Miami, FL 33130, USA, is responsible for the app-related support and first-party Apple authentication data it controls. For privacy questions, use Contact support in the app or email privacy@ezacto.com. Contact your workspace operator for records it controls. Where GDPR applies, you may exercise applicable access, correction, erasure, restriction, objection and portability rights and complain to a supervisory authority. See request timing and retention limits and remedies.