Privacy Policy
This policy says what WeekBill collects, why, where it's kept, who else handles it, and how to have it deleted. It covers the WeekBill apps for iPhone and Android, the invoice pages your clients open, and this website.
Who we are
WeekBill is run from New South Wales, Australia. In this policy, "we" and "us" mean WeekBill.
For anything about your privacy, write to privacy@weekbill.com. For help with the app, write to support@weekbill.com.
We handle personal information in line with the Australian Privacy Principles.
What we collect and why
Signing in
When you first open the app, it makes an anonymous account with Firebase Authentication, a Google service, so nothing you do is lost. Before your first invoice goes out, you sign in with Apple or Google. Firebase then keeps your sign-in, including which of the two you used and the email it shares. Our server keeps your Firebase ID and that email. If you chose Apple's Hide My Email, we only ever get the private relay address.
We use your sign-in to keep your account, back up your work, and let you use it on another phone. When you ask us to email you all your invoices, they go to the email on your invoices, or to your sign-in email if you haven't added one.
Your business details
We look your ABN up on ABN Lookup, the Australian Business Register's public service, for your business name, entity type, location and GST registration. We keep your name, ABN and GST dates. You also give us the email and phone printed on your invoices, your PayID, and your BSB and account number, and how your invoices look.
These go on your invoices, which is why we hold them.
Your clients
The names, kinds of work, rates, emails, mobiles and ABNs you give us for your clients. "Your clients' details", below, says what we do with them.
Your work
Your jobs (dates, hours, rates or prices, descriptions and extras), your invoices, with when each was sent, opened and paid, and the reminders you send. When a client first opens an invoice's page, we record the date, so you can see it. We record nothing else about who opened it.
Voice and typed notes
When you talk to WeekBill, the speech recognition built into your phone writes your words down as you speak: Apple's on iPhone, and on Android the phone's speech service, which is Google's on most phones. It works on the phone where it can. When it can't, Apple's or Google's own servers do it instead, so your voice may go to Apple or Google. WeekBill doesn't keep the audio, and it never reaches our server.
A note is kept on your phone as text, with how long you spoke. To find the jobs in it, the phone sends the text to our server, with today's date and any jobs on screen. Our server adds your clients' names and passes it to an AI model that understands it. That model isn't switched on yet: until it is, your notes wait on your phone, and before it's switched on we'll name the service that hosts it here. Our server doesn't keep the note. Typed notes, your replies in a conversation with WeekBill, and questions you ask it, go the same way.
Your phone
Each phone that runs WeekBill gives us a push token, so we can wake it, and says whether it's an iPhone or an Android phone. Our push messages carry no content: they only tell the app to check for news, and the app writes its own notification.
How the apps are used
The apps send Amplitude these events, so we can see which parts of WeekBill get used:
- Setup Finished, with whether you have an ABN and whether you're registered for GST
- Note Recorded, with whether it was spoken or typed
- Jobs Saved, with how many
- Client Added, with how: in a conversation, from your contacts, or typed in
- Invoices Sent, with how many, and how many by email and by text
- Invoice Marked Paid, with where in the app it was marked
- Reminder Sent, with whether it was the firmer one
- Setting Changed, with which setting, never its new value
Amplitude also records when the app opens and closes, and how long it's used, with your phone's model, operating system, app version, language, country and region.
No event carries a name, an address, a phone or account number, an amount, or anything you typed or said. The apps tell Amplitude not to keep your IP address, city or mobile carrier, and use no advertising ID. Amplitude knows your phone by a random ID, not by your WeekBill account.
Purchases
RevenueCat would handle subscriptions if a paid plan comes. Today there's nothing to buy. RevenueCat knows the app by a random ID and, once you sign in, by your Firebase ID. It isn't given your name or email.
This website
- The email list. If you join it, we keep your email, which form you used, when you joined, and the promise you agreed to: "One email when it's out." We use it only to email you once, when WeekBill is out. That email has an unsubscribe link, and unsubscribing works at once.
- Deletion requests. The email you enter, when you asked and confirmed, and when and how we acted on it.
- Visits. Cloudflare Web Analytics counts visits without cookies and without identifying you. It isn't used on the pages whose address holds a private link.
- Forms. Cloudflare Turnstile checks that a person, not a bot, sent a form. To do that it looks at your browser and your IP address.
- Serving the site. Cloudflare, which serves this site, sees your IP address and browser, as any web host does, and uses them to keep the site safe, for example to limit how often a form can be sent.
The site sets no cookies of its own.
When you write to us
Email to support@weekbill.com or privacy@weekbill.com reaches our inbox, which Gmail (Google) holds. We keep it to answer you.
Where it's stored
Your account lives on our server and database in Sydney. The server runs on Fly.io, and the database on Neon, in Amazon Web Services' Sydney region.
Your phone keeps its own copy of your work, and your notes, until you sign out or delete your account.
Who processes it
These services help us run WeekBill. Each gets only what its part needs.
- Fly.io runs our server, in Sydney.
- Neon runs our database, in Sydney.
- Google Firebase handles sign-in, and Firebase Cloud Messaging carries the push messages that wake your phone.
- Apple handles Sign in with Apple, and carries push messages to iPhones.
- Apple and Google speech recognition writes your voice down, on your phone or, when it can't, on their servers.
- Resend sends email: everything WeekBill emails your clients, your invoices to you when you ask, and this website's emails.
- Cloudflare serves this website, checks its forms for bots, counts visits, and forwards email sent to our addresses.
- Google (Gmail) holds our support and privacy inbox.
- Amplitude receives the app events listed above.
- RevenueCat handles subscriptions, if a paid plan comes.
- ABN Lookup, the Australian Business Register, is asked about your ABN.
We don't sell personal information, and we don't share it for advertising.
Overseas
Our server and database are in Australia. Some of the providers above may store or process information outside Australia, including in the United States: Google (Firebase, Gmail and speech recognition), Apple, Amplitude, RevenueCat, Resend and Cloudflare. The apps send their Amplitude events to Amplitude's United States data centre.
Your clients' details
When you add a client, you give us their details. We use them only to make your invoices and get them to that client.
We email a client only when you act: an invoice when you slide to send, a reminder when you tap Send it, a corrected invoice when you say so, and a cancellation when you confirm it. Texts to clients go from your own phone. We never market to your clients, and never contact them about anything else.
An invoice email comes from your name via WeekBill. Replies go to the email on your invoices, if you've added one. It carries the invoice as a PDF and a link to the invoice's page, which shows the invoice and the payment details you choose to show. Anyone with the link can open that page, so the link is long and can't be guessed.
When you pick a client from your contacts, your phone's own contact picker shares only the contact you choose. WeekBill can't read the rest of your contacts.
Please make sure your clients are happy for you to give us their details. If a client asks us about their details, we'll help them, and we may refer them to you.
Keeping and deleting
We keep your account, and everything in it, until you delete it.
Deleting in the app. Open You, then Account, then Delete my account. You can email yourself all your invoices first. Deleting removes everything in your account from our database at once: your business and payment details, clients, jobs and invoices, and the phones registered for notifications. It also clears the phone, and asks Firebase to delete your sign-in. If Firebase doesn't delete it then, we ask again when that sign-in next tries to reach us (at most once an hour). All we keep is a one-way scrambled form of your Firebase ID (a SHA-256 hash), which can't be turned back into the ID. It stops the deleted account coming back.
Deleting from the web. If you no longer have the app, ask at weekbill.com/delete-account. We email you a link to confirm, which works once, for 24 hours. Once you confirm, we delete the account within 7 days and email you when it's done. We keep a record of the request.
What stays. Invoices you already sent stay with the clients who got them, as emails, texts and PDFs. Their invoice links stop working. The app events in Amplitude were never linked to your account, so they stay there, unlinked. RevenueCat keeps its record of your Firebase ID; write to privacy@weekbill.com to have it removed. Resend, which sent your emails, keeps its own copies of them, including your clients' addresses and the invoice PDFs, for as long as it keeps its email logs. Copies our database keeps for restoring itself are gone within a day.
Signing out clears the phone and keeps your account.
The email list. Unsubscribe at any time from the link in the email. We keep your address marked as unsubscribed, so it's never emailed again.
Your rights
You can ask for a copy of the personal information we hold about you, and ask us to correct it. You can see and change most of it in the app yourself. Write to privacy@weekbill.com, and we'll reply within 30 days.
If you have a complaint about how we handle your information, write to us first. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC), at oaic.gov.au.
Changes
If we change this policy, we'll update this page and the date at the top. If a change matters, we'll let you know before it takes effect.