Billkeep
Kept on your device, and gettable back out
Most invoicing apps are a website with your business inside it. Billkeep is the other shape: the records are on your own device, the network is optional, and the way out is a file you can read. This page is the long version of why, and the honest limits of it.
Where they are kept
In this browser
A database inside the browser, reachable only by this site. It is not a cookie, it is not sent with any request, and no other site can read it.
On the phone
A SQLite database in the app's own private storage, which Android does not let other apps read. Uninstalling the app removes it, so take a backup first.
In your account, so your devices agree
Under your own account, in a store only that account can read. Signing in is what puts it there — the app needs an account, so this is true for everybody, and we would rather say so than let you find out.
Four things, and you can see all of them
There is no fifth. Billkeep has no analytics library, no advertising identifier, no crash reporter that ships your data, and no third-party pixel anywhere in it.
- Signing in — your email address and password, or a Google sign-in, to the sign-in service.
- The cloud copy — your records, but only while the switch is on.
- Opening a payment link — your customer's browser going to the address you put on the invoice.
- Dictating an invoice on Android — the words you spoke, if you turn that feature on. Never the audio.
- No advertising, of any kind
- No analytics or usage tracking
- No third-party scripts once you are past the sign-in screen
- No selling or sharing of anything you type
- No payment processing, so no card details ever exist here
- No reading of your records by us — the rules on the store forbid it
Billkeep is a record-keeper, not a payment provider
That is not a disclaimer bolted on afterwards — it is the constraint the whole app was built inside, and it is why several things work the way they do.
- The payment link is yours, so the money never routes through us.
- Links open in the system browser, never in an embedded window — an in-app checkout is what makes a record-keeper look like a processor.
- Payment status is always recorded by a person, because there is no webhook that could tell us.
- There is no merchant account, no card handling and no percentage anywhere in the product.
- Backup — one JSON file with every table in it, readable in any text editor.
- CSV — invoices and their lines, plain numbers, no currency symbols, ready for a spreadsheet.
- PDF — every finished document, printable and saveable.
- Both ways — a backup written on the phone restores in the browser, and the other way round.
Leaving is a button, not a support ticket
An invoicing app holds the paperwork of your business. If getting it back out is hard, the app has a hold on you that has nothing to do with being good. So the export is complete, free on every tier, and in a format nobody needs our permission to read.
Where local-first cuts the other way
Keeping records on your device has a cost, and it is better said out loud than discovered.
Clearing your browser data deletes them
“Clear site data”, some privacy extensions, and certain private windows all take the database with them. Signing in again fetches the copy held in your account, which is what it is for — but take a backup file as well if the records matter. A file you hold is the one copy nobody can take away.
Uninstalling the phone app deletes them too
Android removes an app's private storage with the app. Same answer: a backup file, or the cloud copy.
An account is not a copy
Signing in gives you somewhere to put a copy; it does not put one there. The cloud copy is a separate switch and it starts off, so an account on its own will not save you from a cleared browser.
Two devices need the cloud copy
Records do not travel by themselves. Sign in on both and switch the copy on, or move a backup file across by hand. With the copy on it goes both ways — what you write on one shows up on the other.
With two devices, issuing needs a connection
Writing an invoice never does — draft, price and edit it anywhere. But once your records are shared, the invoice number has to come from your account, or both devices could hand out the same one and you would find out at the worst possible moment. Offline, it stays a draft until you have signal. With the cloud copy switched off, one device owns its own numbering and issues anywhere.
Dictation on Android sends your words
If you turn voice invoicing on, what you dictated is sent to Google's model to be turned into a draft, on a tier where it may be retained and reviewed. The app says so on the screen where you switch it on. Leave it off and nothing goes.
Our host keeps ordinary web logs
Serving this site means a server writes down that a page was requested, with an address and a time, the way every web server does. None of your records are in that.
The only thing we ask for is an email address
No card. Create an account, write an invoice, and take a backup file away with you if you decide it is not for you.