Privacy

What we store, where it lives, and who can reach it.

Last updated 25 August 2026

What changed on 25 August 2026. We added Google Analytics to this public website, and it is opt-in: it does not run unless you agree. Nothing changed about the app: it still carries no third-party code, and the server still refuses to let any load. Said here rather than quietly, because this page promises that.

The short version. Your books live on your own device and on one server in Germany. We do not sell anything to anyone, and there is no analytics or tracking code in the app: not ours, and not anybody else's. One cookie exists there, and it carries a single fact: that you are signed in. On this public website we count which pages bring people here, and only if you agree to it.

Two different things, and they matter

Elvira Books holds two kinds of information, and our responsibility for each is different.

Your account	Your books
Your name, email address and password. We decide how this is handled, so it is ours to answer for.	Your customers, suppliers, staff, transactions and files. This is your information. We hold it so the software works; we do not use it for anything else and we do not look at it.

If you keep staff records in Elvira, they may include identity documents, salaries and dates of birth belonging to people who never signed up with us. Those records are yours, and you remain responsible to the people in them. We process that information only to run the service for you.

What is actually stored

On your device

Elvira runs in your browser and keeps a working copy of your books there. That is why it opens instantly and keeps working when the connection does not. Clearing your browser's site data removes that copy.

Signing out does not delete the local copy. It ends the connection to the server; the books stay on that device so you can keep working offline and so nothing unsynced is lost. On a shared or borrowed computer, clear the browser's site data as well.

On the server

Your account: name, email, and your password stored only as a slow one-way hash (scrypt). We cannot read your password and neither can anyone who copies the file.
Your books: the records above, as files belonging to your company.
Sign-ins: stored as a hash of the session token, never the token itself, so a copy of that file cannot be used to sign in as you.
Files you attach: invoices, receipts and scans you upload.
Devices: for each point of sale you connect: which company it belongs to, what it is called, when it was last seen and which version it is running.

Where it lives

On one server in Frankfurt, Germany, rented from Amazon Web Services. Nothing is copied to another country by us.

Germany rather than somewhere nearer is a deliberate choice: the software is built so your device does the work and the server only synchronises, which means the distance costs you nothing you would notice: and it puts your records under one of the stronger data-protection regimes.

Cookies, and the absence of everything else

One cookie. It is called ebauth, its value is 1, and it records that a sign-in exists in this browser. It does not contain your session token, your identity, or anything about you. It exists so the site knows whether to show you the app or the sign-in page.

In the app, where your books are: no analytics, no advertising, no tracking pixel, and no third-party script of any kind. This is enforced in the software itself: app.elvirabooks.com is served with a policy that forbids the browser from loading anything from another company's servers, so it could not happen by accident. That has not changed and will not.

On this website, the public pages you are reading now, we would like to know which of them bring people here, so we use Google Analytics. It does not run unless you say yes: until you do, nothing is loaded, no cookie is set, and no request is made to Google at all. If you say no, or if your browser sends Do Not Track or Global Privacy Control, you are not asked again and nothing runs. Your books are on the other side of that line and are never measured.

Who else is involved

Who	What they do	What they can see
Amazon Web Services	Rents us the server in Frankfurt	The machine your books sit on
Resend	Sends account email: password resets	Your email address and the message sent to it
Cloudflare	Answers the question "where is elvirabooks.com?"	Nothing. Traffic goes straight to our server, not through them.
Google Analytics	Counts visits to this public website: only if you agree, and never inside the app	Which pages you looked at on elvirabooks.com, and roughly where in the world you are. Nothing from your books, because it is not there.

Email you send to your own customers: invoices, statements: goes through the mailbox you configure, as you. It does not pass through us.

How it is protected

Everything travels over HTTPS, and browsers are told to refuse anything else.
Passwords are stored as slow one-way hashes, not encrypted: there is no key that could turn them back.
Sign-in tokens are stored hashed, so the file that lists valid sessions cannot be used to become one.
If you save a mailbox password for sending your own documents, it is encrypted, and the key is kept outside the folder that gets backed up.
A password reset ends every other sign-in: but deliberately leaves your connected points of sale running, so a shop does not stop trading.

Backups

The server takes a copy of the books every night and keeps the last fourteen. They exist so a mistake can be undone. Deleting something removes it from the live books immediately; it may remain in a backup for up to fourteen days before ageing out.

What you can ask for

A copy. Export everything, yourself, at any time, from inside the app. No request and no fee.
Deletion. Ask and your account and books are removed from the server. Backups age out as above. Any copy on your own devices is yours to clear.
Correction. You can edit your own records directly.
To be told what we hold. Ask, and we will tell you.

Children

Elvira Books is accounting software for businesses. It is not intended for anyone under 18 and we do not knowingly hold their information.

Changes

If this policy changes in a way that matters, we will say so on this page and change the date at the top. We will not quietly widen what we do with your information.

Contact

Questions about anything here, or a request about your own information: contact@elvirabooks.com.

Operated from the Kingdom of Bahrain · Company details will be published here on registration