Effective 7 October 2026 · Last updated: 22 October 2026
This policy applies to the Ochre app for iPhone, iPad, and Mac (the “app”) and this website. Ochre is provided by Adsit.Work (“Ochre”, “we”, “us”). Ochre is made by an independent developer; for any question about this policy or a request about your data, use the contact page.
From the app: nothing. Ochre is local-first. Everything you enter — your business details, clients, products, invoices, payments, attachments — is stored on your device using Apple’s on-device database. Nothing leaves your device unless you choose to send it: sharing a document, emailing it, printing it, or saving a backup. It never reaches a server operated by us, and we have no ability to read it.
What the app does contact. Two things, and neither carries your books:
We do not require an account, a sign-up, an email address, or a password to use the app. We do not embed advertising, analytics, tracking, or third-party SDKs that collect your information.
If you turn on Search invoices and customers in Spotlight (Settings → Privacy), Ochre gives your device’s own search index enough to find your records from the system search field. For each document that is its type and number (a draft has no number), the customer’s name, its status, its total and currency, your business’s name, and its issue and due dates. For each customer it is the name, their role, the city if you entered one, and your business’s name. Nothing else goes in: not line items, notes, terms, tax IDs, street addresses, email addresses, phone numbers, bank or payment details, payment links, attachments, or how much has been paid or is still owed.
That index is kept by your device’s operating system, outside Ochre. Nothing is sent to us or to anyone else. Ochre’s app lock does not cover it: while indexing is on, anyone who can use your unlocked device can search it. For that reason the switch is off until you turn it on, and it is unavailable while “Require unlock to open” is on. Turning the app lock on removes everything Ochre indexed, at that moment. Turning the switch off removes it too, and so does deleting a business or starting fresh; deleting a document or customer removes its entry.
When Handoff is on in your system settings, Ochre shares only the identifiers of the record you have open with your own devices signed in to the same Apple Account, through Apple. No names or amounts are included.
Ochre does not sync until you turn sync on. A new install keeps your books on that device and nowhere else. There are two ways to put them on another device you own, and both run through your own Apple ID rather than any system of ours.
Switching on iCloud sync in Settings lets your devices keep the same books in step. Your records — businesses, documents, customers, vendors, products, payments and expenses — are mirrored into the private database of your own iCloud account. A private database is readable only by the Apple ID that owns it: not by other users, not by us. We operate no server in this path and receive no copy, no key, and no notification that it happened. What travels is governed by Apple’s Privacy Policy and your iCloud terms.
Sync needs a signed-in iCloud account and available iCloud storage. If either is missing, Ochre keeps working normally on the device and tells you what it is waiting for. You can switch sync off at any time; doing so leaves the books on your device intact.
You can instead create a backup from within the app (see “Backups” below) and open it on the other device. When you choose to save that backup to iCloud Drive, it travels there the way any file you save to iCloud Drive does, under the same Apple terms above. We never see the backup or its contents.
A backup you create by hand is locked with a passphrase only if you give it one; leave the passphrase blank and the file is saved unlocked, readable by anyone who has it. The automatic backups Ochre keeps on its own schedule are always locked with the passphrase you set for them. Either way, backups are stored where you choose: on your device or a location you pick. We never receive your backups or your passphrase. If you lose the passphrase, an locked backup cannot be recovered — by anyone, including us.
Client and contact details you enter live in your local store on your device, the same as the rest of your data. When you choose to send an invoice, receipt, statement, or export, that file leaves your device only through the channel you pick at that moment (email, share sheet, print, save, or a backup to iCloud Drive). We are not a party to that transmission.
The free tools under ochreinvoice.com/tools — invoice, estimate and receipt generators, pricing calculators, and the rest of that line — are separate from the app but held to the same standard. Each one runs entirely in your browser. Nothing you type into a tool page is transmitted anywhere; there is no server that ever sees an invoice number, a client name, or an amount you entered.
Some tools save a draft locally, in your own browser's IndexedDB storage, so it is still there if you come back later. That draft never leaves your device either — clearing your browser's site data for ochreinvoice.com removes it completely, the same as it would for any other local website storage.
We set no cookies of our own, and there are no advertising or cross-site trackers anywhere on this website. We do count page views, using Cloudflare Web Analytics. It is cookieless, does not build a profile of you, and does not follow you to other sites — so we can see that, say, the estimate generator gets used more than the barcode one, and never who used it. Exactly what is counted is set out in What this website counts below.
The contact page additionally loads Cloudflare Turnstile, a spam check that runs in your browser before a message can be sent. To tell people from bots, Cloudflare processes signals such as your IP address, User-Agent and TLS fingerprint on our behalf. Cloudflare describes those signals as strictly necessary for detecting and blocking bots, and says it does not use them to identify or profile anyone; any cookie or browser storage Turnstile uses is for that spam check only, so there is nothing to accept or reject — nothing optional is stored. Cloudflare publishes the detail in its Turnstile privacy notice.
What that measurement cannot see is anything you type. Not a client's name, not an amount, not an invoice number, not a draft. The tools transmit none of it, to us or to anyone — there is no code on any tool page capable of sending it, which is a property of how the pages are built rather than a promise about how we behave.
The only thing on this website that deliberately sends your information anywhere is the contact form, and only if you choose to submit it — it sends the name, email address, and message you type into it, and nothing else on the site does anything comparable. What happens to that message is set out next.
In short: no cookies, no profile of you, no advertising trackers. We do count visits, in aggregate. Two services are involved, and nothing else on this website measures you.
Every page loads Cloudflare’s Web Analytics script (Cloudflare adds it to the page for
us; it comes from static.cloudflareinsights.com). When a page has finished loading,
and when you leave it, the script reports to Cloudflare which page was opened, which page
sent you there, and page-load timing figures, and Cloudflare adds the country the visit came
from. As with any web request, your browser necessarily sends your IP address to Cloudflare to
fetch the script.
static.cloudflareinsights.com in your browser; the website works the same
without it. You can also ask us through the contact page.Search Console is a Google tool that shows us data Google already has from its own search results: which searches led to our pages, how often a page was shown or clicked, and which pages Google has indexed. We have added no Google code to this website for it — we proved we own the domain with a DNS record — so it receives nothing from your visit here. Google’s handling of searches is covered by Google’s own privacy policy.
/, /contact, /privacy and a tool page all returned no
Set-Cookie), and a fresh browser held none after loading them.ochre.privacyNotice.dismissed) is saved in your browser’s local storage so the
notice does not come back. It stays in your browser and is never sent to us; clearing the site’s
data for ochreinvoice.com removes it, and if your browser blocks local storage the notice simply shows
again.We use your name, email address, topic and message only to read and answer your message (and to keep a record of the conversation). We do not add you to any list and Ochre sends no marketing email.
When you download or purchase the app, Apple processes that transaction and may provide us with aggregate, non-identifying sales and crash information through App Store Connect, under Apple’s terms. This does not include the contents of your books.
Ochre is a business tool and is not directed to children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect information from children.
Because your data lives on your device, you are in direct control of it: you can view, edit, export, back up, or permanently erase all of it at any time from within the app (Settings → Data → Start fresh…). You choose whether that erases this device only or, with iCloud syncing on, iCloud and every device signed into the same iCloud account as well. Backups you’ve saved separately — including any saved to iCloud Drive — are not touched by an erase; delete those yourself if you want them gone too.
When you delete a business in Ochre, its documents and the PDFs Ochre made from them are removed from the device. Another business in the same app keeps its own files. The history list that records changes keeps one line for each change to that business, but only the time and the kind of change. Names, file names, contact details and amounts in those lines are blanked.
Start fresh goes further. It removes every PDF Ochre made and the safety copies Ochre keeps for itself, such as the copy taken before a restore. It does not remove automatic backups, or any export or backup you saved in a place you chose. Ochre leaves those alone, and you can delete them yourself.
Ochre sells in many countries, so here is what the privacy laws of the main ones give you, in plain words. This is a summary, not legal advice. The personal data we can actually hold about you is small: the name, email address, message and IP address from a message you sent through the contact form, plus the aggregate counts above, which are not about you. We do not sell your personal information or share it for advertising, and we handle a request from any country the same way.
How to ask, for every region below: use the contact page, choose the topic “Privacy or data request”, write from the same email address you used before, and say what you want (see a copy, correct it, delete it, stop using it). You may also complain to the regulator named below, with or without asking us first.
You can ask for access to your data, correction, erasure, restriction, a portable copy, and to object to its use, and you can complain to your national data protection authority. The ePrivacy rules need your consent before a website stores or reads things on your device unless that is strictly necessary; this website stores nothing for tracking. Ask us here.
The same rights as the EU, and you can complain to the Information Commissioner’s Office. For anonymous visit counting the ICO expects a website to tell you its purpose and give you a simple, free way to object: that is the notice, this page, and the opt-out under “Cloudflare Web Analytics” above. Ask us here.
California residents can ask what personal information a business holds, to have it deleted or corrected, to limit use of sensitive information, to opt out of its sale or sharing, and not to be treated worse for asking. Virginia, Colorado, Connecticut, Texas and other states give similar rights (access, correct, delete, opt out of sale and targeted advertising). We do not sell or share personal information, so there is nothing to opt out of. Ask us here.
Under the federal PIPEDA you can be told why your information is collected, ask for access to it, challenge its accuracy, and challenge an organisation’s compliance; you can complain to the Office of the Privacy Commissioner of Canada. Quebec has its own private-sector privacy law, and you can complain to the Commission d’accès à l’information. Ask us here.
You can ask to confirm whether your data is processed, to see it, to correct it, to have unnecessary data anonymised, blocked or deleted, for portability, for who it was shared with, and to withdraw consent; you can petition the national authority (ANPD). Ask us here.
You can ask for information about your personal data, to have it corrected or erased, to have your complaint heard (grievance redressal), and to nominate someone to exercise these rights for you. The grievance route is the same contact page.
You can ask to access and to correct personal information an organisation holds about you, and complain to the Office of the Australian Information Commissioner. Whether the Act applies to a business of our size depends on its terms; we honour these requests either way. Ask us here.
You can ask to be told the purposes for which retained personal data is used, to have it disclosed to you, corrected, added to or deleted, and to have its use stopped where it is handled in breach of the Act; the regulator is the Personal Information Protection Commission. Ask us here.
You must be told the purposes for collecting your personal data on or before it is collected, and you can ask for access to it and for it to be corrected; the regulator is the Personal Data Protection Commission. Ask us here.
You must be made aware of what is being collected before it is collected from you, and you can ask for access, for correction or deletion, and object to its use; you can complain to the Information Regulator. Ask us here.
You can ask for inaccurate personal data to be corrected and to restrict or stop its processing. Ask us here.
If your country is not listed, you can still use the contact page in the same way and we will treat the request the same.
If this policy changes, we will update this page and revise the effective date above.
Questions about privacy, or a request about your data? Contact us.