Privacy Policy

Short version: we collect as little as possible and never sell anything to anyone. Tidy Cents is not an AI product: no artificial-intelligence model reads your data or produces your results, which come from fixed, tested formulas. Your business numbers are calculated in your browser (with the exceptions named below) and are never shared with ad networks. Advertising and analytics tags load only if you accept them in the cookie banner.

Your business figures stay on your device and we never receive them, unless you save them to your account or turn on encrypted sync — and even then we cannot read them. (Five other optional features are the exception, as described below: a bank connection passes your transactions through our server without storing them; a QuickBooks Online connection passes the figures it reads through our server to your browser without storing them; figures sent to our API — with or without an Advisor key — are calculated and returned without being stored; and the online versions of the business apps Tidy Decision Lab, Business Shock Map, Cash Domino and Business Fragility X-Ray send the figures you enter to our server to be calculated and return the result without storing them — their downloaded offline versions calculate on your device; and the one-time QuickBooks import without an account, whose figures pass through our server’s memory for up to 10 minutes on the way to your browser.) The free emergency-fund calculator and the demo of the Irregular Income Toolkit also send the figures you type to our server to be calculated and return the result without storing them. For orders, accounts and support we keep only the minimum personal data described below; the company responsible for it is Perco Ltd.

Who is responsible

The controller of your personal data is Perco Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For any privacy question, write through the contact form at /support.

We do not sell to buyers in the United Kingdom: checkout refuses, or refunds, a purchase made with a UK card, a UK billing address or from a UK network location.

What we collect

When you buy. Your order (which products, the price, the time) with the IP address, browser type and referring page it was placed from, and from Stripe, which processes the payment: your transaction ID, the email address you entered at checkout, your name, your country and the payment confirmation it sends us. Each download of your files is logged with its time and IP address. We need these to deliver your files, to find your order when you ask, to prevent fraud and to keep tax and accounting records. Your card details never reach us — payment happens entirely on Stripe's servers.

Merchant of record. Card payments are made under Stripe Managed Payments, with Stripe as the merchant of record for the sale: Stripe receives the details you enter at checkout in its own right, under its own privacy policy (stripe.com/privacy), and your receipt and card statement show the payment as "Sold through Link".

When you download a free sample or subscribe. Your email address, which sample you asked for, the date and the IP address the request came from.

When you write to us. Your email address, the topic you chose, your message and the IP address it was sent from, so that we can answer and keep the form free of abuse.

Bot protection (if switched on). Our sign-up, password-reset, free-trial and support forms may use Cloudflare Turnstile to tell people from automated abuse. When it is switched on, the form loads a check from Cloudflare that processes technical signals from your browser and connection — such as your IP address, TLS fingerprint and browser type (user agent) — only to detect bots, and gives the form a one-time token that our server checks with Cloudflare. We store neither these signals nor the token. As we use it, Turnstile sets no cookie. Cloudflare processes these signals on our behalf, and as a controller only to improve its bot detection (cloudflare.com/turnstile-privacy-policy).

When you browse. A single page-view record: the page path, the referring site, your language and browser type, and a one-way hash of your IP address (we cannot reverse it back to your IP). No cookies are used for this record. In the Control Room we also record product events (for example “stress test finished” with its overall result band, “sign-up”, “checkout started”) with the page, the language and a short one-way hash of your IP address — never the amounts or other business numbers you enter (a purchase event carries only the price paid and the order number). These include “free X-Ray started” and a registration from the free X-Ray, with the step that led to it. Only if you chose “Accept” in the cookie banner do we link these product events to the advertising visit you arrived from (see tc_attr).

Advertising and analytics tags. Google Analytics and Google Ads, the Meta Pixel and the Pinterest Tag receive page visits and events such as a sign-up or a purchase (with its value), never the numbers you enter. These providers may set their own cookies. In the European Economic Area, the United Kingdom, Switzerland, Canada and every other country not named below, they load only after you choose “Accept” in the cookie banner; with “Only necessary” none of them loads. In the United States, Australia and New Zealand (recognised by your browser's time zone), they load without a banner, because the law there gives you the right to opt out instead: choose “Do not sell or share my personal information” or “Cookie settings” at the bottom of every page, then “Only necessary”, and none of them loads again in this browser. If your browser sends a Global Privacy Control signal, we treat it as that opt-out and load none of them. Wherever you are, you can change your choice at any time with “Cookie settings”. This is separate from the advertising measurement described under tc_attr below, which uses no third-party tag.

Cookies and browser storage

Every cookie we set ourselves is first-party. None of them is used for advertising, except tc_attr, which only measures which of our own ads lead to sign-ups, trials and purchases.

• tc_consent — your cookie-banner choice; 180 days.
• tc_cart — the products in your cart (signed so it cannot be altered); 30 days.
• tc_coupon — a coupon code you applied; 7 days.
• tc_lang — the language you picked; 365 days.
• tc_lead — remembers that you already asked for a free sample, so the sample pop-up is not shown again; 365 days.
• tc_ref — the site or campaign you first arrived from, set once; 30 days.
• tc_sess — keeps you signed in to your account; 30 days, or until you sign out.
• tc_csrf — protects forms against requests forged by other sites; 7 days.
• tc_dv — a random browser mark used only to stop free offers being repeated: the free Undo run and the one-time QuickBooks import (earlier also the 7-day trial, the one free X-Ray and the short continuation after registering, which ended on 14 October 2026). It is set only when you register, run a free Undo run or start that import. We store only keyed hashes of it, never with your figures, and never use it for analytics or advertising; 730 days.
• tc_crco — ties the return from checkout to the browser that started it; 2 hours.
• tc_buy — remembers the plan you picked before registering, so that after you confirm your e-mail you land on that plan; 1 day.
• tc_crlic — unlocks what you bought in this browser; 400 days.
• dlab_ax, sm_ax, cd_ax, fx_ax, ml_ax, pg_ax — access to a business app you bought; until that access ends.
• tc_crdemo — used only on test builds, never on the live site; 7 days.
• tc_pend — (no longer set since the free X-Ray ended on 14 October 2026) a signed cookie set when you register from the free X-Ray, so this browser can keep working while you confirm your e-mail. It holds only keyed hashes, of your browser mark and of the e-mail you entered, so that only that account can take over the X-Ray; 48 hours.
• tc_carry — (no longer set since the free X-Ray ended on 14 October 2026) a one-time signed cookie set when you confirm, so the X-Ray you made in this browser can be moved into your account; 10 minutes.
• tc_qbo1 — holds the reference to your one-time QuickBooks import until this page collects it; 10 minutes.
• tc_attr — when you arrive from one of our ads: a random reference to a short record of that visit (the ad click identifier, the campaign labels, the landing page, the referring site without its query and a shortened browser description), used only to see which of our ads lead to sign-ups, trials and purchases; the records are deleted after 180 days; 30 days.

The Control Room also keeps your workspace, your display settings and the answers of a stress test in progress in your browser's own storage on your device, and the shop remembers there whether you have already seen the sample pop-up. This storage is not a cookie and is not sent to us; it stays until you clear it, for example by signing out with the option that also deletes the copy in this browser.

Business Decision X-Ray and the Control Room

Your account. If you create an account: your email address, your password (stored only as a salted scrypt hash, never in readable form), whether the address is verified, the dates of a free 7-day trial if you started one before 14 October 2026, your plan, the state of your subscription, and the last workspace and screen you opened, so you can continue where you left off. If you signed up from the free X-Ray (until 14 October 2026), we also noted that, and which step brought you there.

Audit log. Security-relevant events are kept in an audit log with the time and, for some events, a short detail such as the plan, the old and new status, a count or a file format — never amounts or other business numbers. The events are: sign-in, sign-out, e-mail verified, password change, trial started or refused, checkout started or refused, plan changed, subscription status changed, cancellation requested or undone, payment failed, refunded or disputed, workspace created, edited, archived, restored or deleted, and account closed; and, by name only, the actions your browser reports: import, report, export, business model changed and decision created. For sign-ins and for the actions your browser reports we also store a keyed one-way hash of your network address.

Your business data. The profile of your business — cash, sales, costs, customers, invoices, the business type, money you hold for others, your decisions and their history — is calculated in your browser. When you save it to your account or switch on sync, it is encrypted in your browser (AES-256-GCM, with a key derived from a passphrase only you know) before it is sent. Our server stores only this ciphertext and its saved versions and cannot read it. To list your businesses we keep, unencrypted, each workspace’s name, industry, country, currency, colour and optional description — do not put anything there you want to keep private.

Free X-Ray without an account (ended on 14 October 2026). The one free X-Ray per browser is no longer offered. Without an account you can use the open demo, on fixed example data, and the free express check, which runs in your browser — we do not receive the figures you enter there. For free X-Ray runs made before then we keep a keyed hash of your browser mark with the date of the run for 30 days (the same applies to the free Undo run, which is still offered). An X-Ray already moved into an account stays there; its workspace name is stored unencrypted, as for every workspace.

Advertising measurement. When you arrive from one of our ads, we keep a short record of that visit (see tc_attr) so we can tell which of our ads lead to sign-ups, trials and purchases. We link your sign-up, trial or purchase to that record only if you chose “Accept” in the cookie banner; if you did not, the record is never linked to you and is deleted after 180 days. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” at the bottom of every page.

Subscription billing. Paid plans are billed by Stripe. We keep your Stripe customer and subscription identifiers, the plan, its status and billing period, your country, the amount and currency, and the payment events Stripe sends us (paid, failed, refunded, disputed). Your card details never reach us.

Bank connections. If you choose to connect a bank account, the connection is made through Plaid or GoCardless (Bank Account Data), licensed providers of read-only account access; you sign in with your bank on their pages, never on ours. We store an encrypted access token (Plaid) or request reference (GoCardless), the bank’s name and the connection status, so you can refresh or remove the connection. When you refresh it, your transactions and balance pass through our server to your browser; they are not stored on our server. Removing the connection deletes the stored token.

QuickBooks Online (optional). If you connect QuickBooks Online, we ask Intuit for read-only access to your company's accounting data and, when you ask for an import, read your company name, country and home currency, your chart of accounts and bank balances, open invoices and bills, your customer credit notes and payments and your supplier credits (to net them against open invoices and bills), the invoices of the last 12 months (to work out each customer's share and payment terms), active customers and the monthly profit and loss for the last 12 complete months. We store only an encrypted connection token, your QuickBooks company ID, the dates you connected and last imported and, for 24 hours, the time of each import (to apply the import limits). The figures we read are sent straight to your browser and used there; we do not keep them on our servers. You can disconnect at any time in the Control Room, which revokes our access at Intuit and deletes the stored token; closing your account or deleting the business does the same. Intuit handles the connection under its own privacy statement.

QuickBooks Online without an account. Without an account you can import once. You first accept our Terms, having read this Policy; Intuit then asks for your permission, and we read your books once, read-only. We map them on our server and hold the mapped figures only in server memory, for up to 10 minutes, until your browser collects them; then they are deleted. Our access token is revoked immediately after the read and is never stored. To limit free imports, we keep for 24 hours keyed hashes of your browser mark and of your QuickBooks company identifier, with the time of the import. We also keep a daily count of imports and requests, with no identifiers, for about 13 months.

Reminders and alerts. If you switch them on, we keep that setting and your language and, for alert emails, only the alert codes, levels and dates your browser sends — never amounts.

API keys (Advisor plan). We store a hash of each key (never the key itself), its first characters, its name, scope and monthly quota, and a count of calls per endpoint and month. Figures sent to the API — with or without a key — are calculated and returned; they are not stored.

Business apps. The online versions of Tidy Decision Lab, Business Shock Map, Cash Domino and Business Fragility X-Ray send the figures you enter to our server to be calculated and return the result; nothing you enter is stored. Their downloaded offline versions calculate on your device and send nothing.

Partner embeds. A partner, for example an accountant, can place our calculators on their own website. If a visitor on that site chooses to leave an email address and a note, we store them with the partner’s embed id and show them to that partner so they can reply. The partner decides how they use these contacts; we delete them on request.

Advisor client workspaces. An advisor keeps the businesses of their clients inside the advisor's own account, stored like any other workspace. Clients do not get access to it, and nothing is shared with a client unless the advisor sends them a report. The branding an advisor sets (name, colour, logo, contact) is stored so it appears on their reports and embeds.

Why we use your data

We rely on these legal bases:

• Contract — to deliver what you bought and to run your account, subscription, sync, bank connections, QuickBooks Online imports, reminders and API keys when you use them. It also covers the free express check and the one-time QuickBooks import you ask for.
• Legal obligation — to keep order and billing records for tax and accounting.
• Legitimate interests — to keep the service secure and prevent fraud (audit log, sign-in limits, the one-free-trial rule, the UK sales restriction, the bot check on our forms when it is switched on), to count page views and product events without cookies, and for the one-time business outreach described below. You can object at any time. The same interest covers limiting free offers to one per browser and per QuickBooks company (the free QuickBooks import, and until 14 October 2026 the free X-Ray and the continuation after registering).
• Consent — for advertising and analytics tags, and for newsletter and sample emails. You can withdraw it at any time with “Cookie settings” or the unsubscribe link. In the United States, Australia and New Zealand these tags rely instead on this notice and your right to opt out (see “Advertising and analytics tags”).

Who sees your data

• Stripe processes all payments and subscriptions and sends us confirmation (stripe.com/privacy).
• Plaid and GoCardless connect bank accounts — only if you choose to connect one (plaid.com/legal, gocardless.com/privacy).
• Intuit (QuickBooks Online) — only if you connect it: we read your company's accounting data from Intuit, which receives our connection and read requests (intuit.com/privacy).
• Cloudflare runs the bot check on our sign-up, password-reset, trial and support forms — only if it is switched on (cloudflare.com/turnstile-privacy-policy).
• Google, Meta and Pinterest receive page visits and conversion events from their tags — only if you accept them in the cookie banner (in the United States, Australia and New Zealand: unless you opt out, see above). Separately, when a sale or a trial followed one of our ads, Google Ads may receive its click identifier, the event name, its time and value and an order reference — never your name, e-mail address or payment details.
• Railway hosts the site and its database.
• Brevo or Resend send order, account, reminder and newsletter emails, if email is enabled.
• Nobody else. We do not sell or rent personal data.

International transfers

Some of these providers process data outside your country, including in the United States. Where the law requires it, these transfers rely on the providers' standard contractual clauses or on an adequacy decision.

How long we keep it

• Orders, with the IP address, browser type and referring page stored with them: 7 years (tax rules). Download records, with their IP address: 365 days.
• Orders paid earlier through PayPal or Lemon Squeezy also keep the payment notice those services sent us (payer email, name, country and transaction details): it is kept with the order record, for the same period as the other order records. New orders no longer collect it.
• Sample requests and contact-form messages, with the IP address stored with them: until you ask us to delete them.
• Email subscribers: until you unsubscribe.
• Page-view records and Control Room product events: 90 days, then deleted automatically.
• Sign-in attempts: 7 days. Sign-in sessions: up to 30 days.
• Saved versions of a synced workspace: the latest 120.
• Billing records and the audit log: kept after an account is closed, for as long as tax and fraud-prevention rules require.
• The keyed hashes that enforce one free trial per e-mail address, device and network connection: kept after an account is closed, so the rule still applies.
• QuickBooks Online connections (the encrypted connection token, the company ID and the dates): until you disconnect, delete the business or close your account. The time of each QuickBooks import: 24 hours.
• Keyed hashes recording a free X-Ray run, a registration continuation or a free Undo run: 30 days.
• Keyed hashes recording a one-time QuickBooks import without an account (browser mark and company identifier): 24 hours.
• Figures from a one-time QuickBooks import: in server memory only, at most 10 minutes.
• Daily counts of free QuickBooks imports (no identifiers): about 13 months.
• Advertising-visit records (tc_attr): 180 days.
• Bank connections, API keys, embed contacts, advisor branding and reminder settings: until you remove them or ask us to delete them.

Closing your account

Deleting your account in your account settings does the following at once: it cancels your Business Decision X-Ray subscription with Stripe, so no further payment is taken; it deletes your sign-in record, your password hash and your sessions; and for every workspace you own it deletes the stored encrypted data, removes its name, description and members, and marks it deleted; and it disconnects every QuickBooks Online connection, which revokes our access at Intuit and deletes the stored token.

It does not delete: your orders and billing records; the audit log; the keyed trial hashes; the closed-workspace record with its industry, country, currency, colour and dates; and, if you used them, synced backups, bank connections, API keys, advisor branding, embed contacts and reminder settings. Remove those in the Control Room before you close the account, or ask us to delete them. A Plus or Advisor subscription bought on the pricing page is linked to your email address rather than to the account and is not cancelled by closing it: cancel it in the billing portal first, or write to us.

Business outreach

We sometimes write once to organisations that publish small-business resource pages, to offer our free tools. For that we use only a business contact address the organisation published on its own website, its name, and the page we saw. We keep them so we never write twice, and delete them on request. The lawful basis is our legitimate interest in telling relevant organisations about free tools; you can object at any time by replying "unsubscribe" or writing to hello@gettidycents.com.

Your rights

Write to the contact form at /support and we will, within 30 days: send you a copy of everything we hold about you, correct it, delete it (except records we must keep for tax purposes), restrict its use or give it to you in a portable format. You can object to uses based on legitimate interests and withdraw consent at any time. You can unsubscribe from emails with the link in any email, or by writing to us. You can also complain to the data-protection authority where you live.

Children

This store is not directed at children under 16 and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top of this page.

Contact: /support