Privacy policy

Last updated 31 October 2026

Who we are

"OsaBooks", "we" and "us" mean the OsaBooks project and its maker, hidicker, in New Zealand. We follow the New Zealand Privacy Act 2020. Questions, requests and complaints about privacy go to nzosa@proton.me.

OsaBooks on your own computer

When you download OsaBooks and run it yourself, your books are files in a folder on your computer. We never receive them, and the app sends nothing to us. It connects to other services only when you set one up or press a button for it:

• Bank feeds. If you connect Akahu or Wise, the app fetches your transactions and balances from them using the token you give it. The token stays in your books' folder.
• AI. If you add your own key for Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), OpenRouter or Jev, then when you press an AI button the lines being asked about (dates, amounts, payees, descriptions and account names) are sent to that provider under your key, and its own privacy terms apply.
• OpenAccountants. If you connect it on the AI check page, the AI provider you use looks up New Zealand tax guides from openaccountants.com while it answers. The lookups can include the topic being checked.

Books kept online (signed in)

If you sign in at nbparagliding.nz/osabooks to keep books online, we hold:

• Your account: your email address and, if you sign in with Google, the name and profile picture address Google shares with us. A password, if you use one, is stored only as a secure hash.
• Your books: everything you put in them, such as bank lines, coding, invoices, payroll, entities, owners and IRD numbers, so you can open them from any computer.
• Sharing: who you invite to a set of books, their email address and their role.
• Connections: bank feed tokens and AI keys you add. They are kept on the server (the page is only ever shown their first and last few characters) and used only to fetch your transactions or ask the AI for you.
• AI use: a count of AI requests per person per day, to keep the shared AI within its limits. Not what was asked.

Only you and the people you invite can open your books: the database enforces this on every request. We do not look at your books.

Not end-to-end encrypted. Your books are stored in the OsaBooks Supabase account, which is controlled by a single developer, HD, and they could technically read them. We don't. If you would rather nobody else could, you can keep your books in your own Supabase account (Books page, “Keep your books in your own Supabase account instead”), or keep them on your own computer.

If you use the shared AI rather than your own key, the lines being asked about are sent to Google Gemini through our server, under a paid key whose terms do not let Google train on them.

Your own Supabase project

If you choose to keep your books in your own Supabase project, your books, sign-in details and everything else are held in your project, under your Supabase account and its terms. We never receive them. We can't recover them if you lose access to your project.

The online demo

The demo at nbparagliding.nz/osabooks_demo holds invented books, kept in your browser. Nothing you do in it reaches us, except that pressing AI suggestions sends the demo's invented lines to Google Gemini through our server, and a daily count of those requests is kept.

Signing in with Google

Signing in with Google gives us your Google account's email address, name and profile picture address, and nothing else: not your contacts, files, mail or calendar. We use them only to sign you in and show who is signed in.

Donations

Donations are taken by Stripe on its own pages. We see the amount, the date and the name and email address you give Stripe. We never see your card details. Stripe's privacy policy covers the payment.

The website

Our web host keeps standard server logs: the address your request came from, the page asked for, your browser and the time. They are used to keep the site working and secure. We use no analytics, no advertising and no tracking cookies. The app uses your browser's storage only to work: your books in the demo, your sign-in, and settings such as dark mode.

Who else handles it

We use these providers to run the online parts of OsaBooks. Their servers may be outside New Zealand; we choose providers that protect personal information to standards comparable to New Zealand's.

• Supabase: database, sign-in and server functions for books kept online.
• Google: Google sign-in, and Gemini for the shared AI and the demo's AI suggestions.
• Stripe: donations.
• Our web host: serving the website and app at nbparagliding.nz.
• Akahu, Wise and AI providers you choose: only when you connect them, as above.

We do not sell personal information or share it with anyone else, unless the law requires us to.

How long we keep it

Books kept online stay until you delete them. Your account stays until you ask us to delete it: email nzosa@proton.me and we will delete your account and any books only you belong to. Our database provider's backups expire on their own schedule after that. Server logs are kept by our web host for a limited time.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it. You can download a backup of your books at any time from the Books page. If you are not happy with how we have handled your information, tell us at nzosa@proton.me. You can also complain to the Office of the Privacy Commissioner.

Security

How OsaBooks protects your data, and how to report a problem, is set out in its security policy. If a privacy breach were likely to cause you serious harm, we would tell you and the Privacy Commissioner.

Changes

If this policy changes, the new version will be posted here with a new date. For a significant change affecting books kept online, we will tell signed-in users in the app.