Privacy Policy

1 Who we are

QSync ("we", "us", "our") is a reporting tool for Xero users that adds quantity data to general ledger reports — a feature Xero does not natively provide.

QSync is operated by an independent developer. If you have questions about this policy, please contact us using the details at the bottom of this page.

2 What data we collect

When you connect your Xero organisation, we retrieve and store the following data via the Xero API:

• Invoice and bill line items (date, description, quantity, unit price, account code, amounts)
• Bank transaction line items (date, description, amounts, account code)
• Manual journal lines (date, narration, amounts, account code)
• Chart of accounts (account codes, names, types)
• Contacts (names, account numbers, contact groups)
• Your Xero organisation ID (tenant ID) to keep your data separate from other users

We also store OAuth tokens (access token and refresh token) to maintain your connection to Xero without requiring you to log in repeatedly.

We do not collect or store passwords, bank account numbers, or any personally identifiable information beyond what Xero provides in the API response.

3 How we use your data

We use your data solely to:

• Display your GL transaction report with quantity columns
• Power filters, date ranges, and export functionality
• Refresh your data when you click the Sync button

We do not use your financial data for any other purpose. We do not analyse it, aggregate it across users, sell it, or share it with any third party.

4 Data storage and security

Your data is stored in a PostgreSQL database hosted on Railway (railway.app), a US-based cloud infrastructure provider. Data is stored in the US West region.

We take reasonable technical measures to protect your data, including:

• Encrypted connections (HTTPS) between your browser and our servers
• Each organisation's data is isolated by tenant ID
• OAuth tokens are stored securely and refreshed automatically

We recommend you disconnect QSync from Xero if you no longer use the service.

5 Data retention

Your data is retained for as long as your Xero organisation remains connected to QSync. If you disconnect via Xero's connected apps settings, your OAuth tokens will be invalidated. You can request deletion of your stored data by contacting us.

6 Third parties

QSync uses the following third-party services to operate:

• Xero — the accounting platform we connect to via their official API
• Railway — cloud hosting and database infrastructure

We do not use advertising networks, analytics trackers, or any other data-sharing services.

7 Your rights (GDPR)

If you are based in the UK or EU, you have rights under GDPR including:

• The right to access your data
• The right to correct inaccurate data
• The right to delete your data ("right to be forgotten")
• The right to object to processing

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

8 Cookies and sessions

QSync uses a single session cookie to keep you logged in during your browser session. This cookie contains your Xero organisation ID and is required for the app to function. It is not used for tracking or advertising.

We do not use any third-party cookies or tracking pixels.

9 Changes to this policy

If we make significant changes to this privacy policy, we will update the "Last updated" date at the top of this page. Continued use of QSync after changes constitutes acceptance of the updated policy.