Privacy

• Books reads. It never moves money, holds no payment credentials, and cannot make a transfer or a payment on any account you connect.
• Your data is never sold, never rented, and never used for advertising, for credit decisions, for lending, or to build a profile of you.
• There is no analytics service, no advertising pixel and no third party tracker anywhere in Books. The pages you load talk to this site and, if you are connecting a bank, to Plaid. Nothing else.
• Five companies can see any part of this, each for one reason, and each only when you have chosen the thing that involves them. They are named below.
• One account can never see another's books. That is enforced in the code and proven by a test that drives two accounts holding identical books against every route.

Nothing here is collected because it might be useful later. Each item is here because a part of Books would not work without it.

Your account

Your email address, a display name, and a password if you set one. The password itself is never stored: what is kept is a scrypt hash of it, which cannot be turned back into your password. If you sign in with Google instead, no password is stored at all.

One person can hold more than one verified email address on the same account, so that signing in a second way finds the books you already have rather than making you an empty second set.

Your sessions

When you sign in, a cookie is set on your browser and a record of that session is kept so that it can be ended. The record holds the account, when it was created, when it expires, and the browser description your browser sends. What is stored is a digest of the session token, not the token itself, so a copy of the database hands nobody a working login.

Sign-in safety records

Failed sign-in attempts are counted, per account and per network address, so that nobody can grind at your password or spray one password across many accounts. Neither the email address nor the network address is stored: what is stored is a one way digest of it, so that table can never become a list of who tried to sign in here.

Statements you upload

The PDF, CSV or Numbers files you upload, kept as you sent them, together with what was read out of them: the transactions, the account and period the statement covers, and whether it tied to the totals printed on it. Files are held so that a figure can always be traced back to the document it came from, and so your accountant can be shown the proof.

Bank and card activity, if you connect an account

Connecting a bank is optional and Books works without it. If you do connect one, what is requested is transactions and balances, and nothing else: up to 730 days of history, and only from checking, savings, money market and credit card accounts. Investment accounts, loans and mortgages are not even offered in the connection screen, because the transactions data Books keeps books from does not serve them.

For each transaction that means the date, the amount, the description the bank wrote, the merchant if the bank names one, and the account it belongs to. Balances are stored with the time they were read, so a stale figure can never present itself as a fresh one.

What you tell Ezra, and what you type in

Your conversations with Ezra are kept so the thread is there when you come back. So are the things only you can know: mileage trips, home office, cash and charitable write-offs, the standing rulings you make about how a merchant should be categorized, and the notes you ask Ezra to remember.

What we do not collect

No location. No contacts. No camera or microphone: every one of those browser capabilities is switched off by a header Books sends on every response. No advertising identifier. No behavioral analytics of any kind. Books does not ask for a Social Security number, a date of birth, or a government identifier, and has no field to put one in.

• Your books are yours alone. Every row of data belongs to one account, and every query has to name that account or it refuses to run. This is not a convention that a future edit could forget: a query that omits the scope raises an error rather than quietly returning somebody else's rows. A test drives two accounts with byte identical books against every route in the API, substitutes every identifier, and proves nothing crosses.
• Bank and QuickBooks tokens are encrypted with a key derived separately for each account, so a token row lifted from one account's books cannot be read under another's.
• Your session cookie cannot be read by script, is not sent on cross site requests, and is marked secure on the live site. Signing out, or disabling an account, takes effect on the very next request rather than whenever the cookie happens to expire.
• Backups are encrypted with AES-256-GCM before they leave the machine, and a restore from one has been performed rather than assumed. An archive that was truncated, reordered, or spliced together from two runs fails to decrypt instead of restoring something quietly wrong.
• The site is hardened in transport: an enforcing Content Security Policy that names every source it allows, HSTS, and no framing of Books by anyone.
• Credentials stay out of the logs. Authorization codes and tokens that arrive in a web address are redacted before the request is written down.

Running a service means someone can look at it. What that person can see is deliberately narrow, and it is enforced by the code rather than by a promise: who has an account, when they signed up, when they were last seen, how they signed in, how many sets of books they made and what those books are called, and counts of how much is on them.

They cannot see a transaction. Not a merchant, not an amount, not the date of a particular charge. Nor a balance, an income or spend figure, a statement, an uploaded document, a conversation with Ezra, a note, a write-off, or which bank you connected. A count of your transactions is an operations fact. The transactions themselves are your private finances, and no query in that part of the code is allowed to select one.

Every look is written to an audit trail: who looked, when, and at which account. The line is written before the answer is computed, so a look that finds nothing is recorded too.

This is the complete list. There is no sixth company, and no category of "partners" hiding behind the five.

Plaid, only if you connect a bank

Plaid is the service that carries the connection between Books and your bank. You authorize it yourself, in Plaid's own screen, and your banking credentials are typed into that screen or into your bank's own login page. Books never sees them and never stores them. What Books sends Plaid to start a connection is your account identifier on this service, which is a random string, not your email address.

Anthropic, only when you use Ezra

Ezra is built on Claude, made by Anthropic. When you ask Ezra a question, what leaves this machine is your message, the recent messages on that thread, and the specific slices of your books that answering the question required. Your ledger itself is not uploaded; Ezra runs queries against it here and sends only the compact results.

The standing description Ezra is given names your sets of books, their types, the date ranges they cover, and the account names as they appear on your statements, with any trailing masked digits removed first: the last four of a bank account is the single most identifying field in a ledger and no answer needs it. If you never open Ezra, nothing of yours is sent to Anthropic at all.

Intuit, only if you connect QuickBooks

The QuickBooks connector is built and it is not open to customers yet: it has not been through Intuit's app review, so nobody can connect a QuickBooks company to Books today. When it opens, connecting is your choice, the permission asked for is accounting data on the company you pick, and what would be sent is the bookkeeping entries you approve.

WorkOS, only if you sign in with Google

The Google sign-in button is carried by WorkOS. Books sends them no information about you to start it; they hand back your email address, whether the provider says it is verified, and your first and last name. If you sign in with a password instead, WorkOS is not involved and never hears of you.

The hosting provider

Books runs on Railway, which is where the servers, the disk and the backups live. Like any hosting company they hold the infrastructure your data sits on.

The plain answer is: until you get rid of it. A bookkeeping product whose figures quietly expired would be worse than useless, so nothing about your books ages out on its own. Around that, four things do have a clock:

• Sign-in sessions expire thirty days after you sign in, and expired ones are cleared out.
• A statement you delete is removed from your books immediately, and its file is held in a recovery area for thirty days before it is destroyed, so that a mistake is a mistake and not a catastrophe.
• Failed sign-in counts are kept for fifteen minutes and then reset.
• Backups are taken daily and the most recent fourteen are kept. Data you delete therefore survives in an encrypted backup for up to two weeks after it leaves the live system, and then it is gone from those too.

Some of this you can do yourself, right now, from inside the product:

• Delete a statement, which also removes the lines it put on your books.
• Disconnect a bank. That revokes the connection at Plaid, destroys the stored token, and deletes the transactions that connection put on your books.
• Disconnect QuickBooks, which revokes the connection at Intuit and destroys the stored token.
• Clear a conversation with Ezra, one thread or all of them.
• Delete a write-off, a rule, or a set of books that has nothing on it.

If you want a copy of everything before you go, build the year end package for each set of books. It is a zip you download: the categorized ledger, the profit and loss, the write-offs and the reconciliation. You can also download every statement file you uploaded, because they are still your files.

Books is a tool for running a business. It is not directed at children, and an account is not for anyone under 18.

Write to support@ezra.is. That address reaches a human being at Ratifyly, not a ticket queue and not a bot. Use it to ask what is held about you, to correct something, to have data deleted, to close the account, or to ask a question about anything on this page.

The date at the top is how you know. If something changes in a way that matters, for instance a new company added to the list above, the date moves and the change is described rather than slipped in. This page is versioned in the same repository as the software it describes, so its history is a matter of record.