# Privacy — Restaurant Manager Workbook (version 7.0.0)

## The short version

The workbook runs entirely in your browser. It makes **no network calls**,
has **no account**, and **sends nothing anywhere**. The only things that ever
leave your device are the files you choose to export or share.

## What the workbook does not do

- No account, no sign-up, no login to a server.
- No network calls. The file contains no `fetch` and no `XMLHttpRequest`.
  It loads no fonts, scripts, styles or images from the internet. (The
  fonts used in the interface are bundled inside the file.)
- No tracking, no analytics, no advertising.
- No data is sent to the developer, to any provider, or to the tax authority
  by the workbook itself. E-invoicing submission only happens through a
  provider you choose, and only with the frozen invoice data — see
  [docs/ZATCA.md](ZATCA.md).

## What stays on your device

Everything you enter is stored in your browser, on your device:

- **Autosave and snapshots** live in **IndexedDB** (database
  `restaurant-manager-v2`, `kv` store). On first run after the v7 update,
  the app copies your existing browser-saved data into IndexedDB without
  losing anything, and keeps the old copy as well.
- If IndexedDB is missing, blocked or fails, the app falls back to
  **localStorage** and shows one short banner note while the fallback is in
  use.
- A few small preferences (for example, whether you dismissed the demo
  banner) are also kept in localStorage. They are not business data.

## What leaves the device — only what you choose

Nothing leaves your device unless you do one of these:

| Action | What leaves the device | Where it goes |
| --- | --- | --- |
| Export data (JSON) | Your whole workbook data, as a `.json` file | Wherever you save the file |
| Export to Excel | All tables as an Excel file | Wherever you save the file |
| Export the app (.html) | A copy of the workbook file with your data inside it | Wherever you save the file |
| Backup folder | Backup files the app writes automatically | The folder you picked |
| Share an invoice / PDF / payslip | That one document | The app or person you share it with (message, e-mail, download) |
| Print | That document | Your printer, or a PDF file you save |
| E-invoicing submission | Only the frozen invoice data (see ZATCA doc) | Only the provider you chose |

Sharing an invoice through a message or e-mail app hands the file to that
app — what that app does with it is that app's business, not this
workbook's.

## What is encrypted — and what is not

**Encrypted (only when a master password is set):**

- JSON exports — the whole file is encrypted (AES-GCM, key derived from the
  password with PBKDF2 and a salt). Without the password it cannot be opened.
- Excel exports — salary pay fields are encrypted per row (`payEnc`). Other
  sheets are plain.
- Per-person PINs are stored only as salted SHA-256 hashes, never as plain
  digits.

**Not encrypted:**

- **Browser autosave and snapshots are not encrypted**, with or without a
  master password. Anyone who has your device and can open the browser can
  read the saved data. Lock the device, use the browser's own profile
  protection, and do not treat a PIN as security against someone who has the
  device. A PIN is a convenience sign-in: it never replaces the master
  password and never unlocks locked modules.

Provider credentials are **never stored in the workbook at all**. The
e-invoicing provider record holds only a short label saying which credential
to use. The secret stays with the provider or in your password manager.

## How to wipe your data

- **Inside the app:** delete the data from Settings, or import an empty
  backup. The demo data can be reloaded from Settings if you want a clean
  start.
- **From the browser:** clear the site data for the page. That removes the
  IndexedDB database (`restaurant-manager-v2`) and the localStorage copy.
  Do this only after you have exported a `.json` backup you want to keep —
  clearing browser data is not reversible.
- **A downloaded file** (`.html`, `.json`, `.xlsx`, `.pdf`) is an ordinary
  file on your device. Delete it like any other file. Deleting the workbook
  file does not delete the browser-saved data, and clearing the browser data
  does not delete downloaded files — check both places.

## Demo data

The workbook opens with a demo business and sample data. It is invented
sample data, not real business records. It contains no real names, no real
VAT numbers and no real financial records. When you set up your own business,
your data replaces it.

## Children and sensitive information

The workbook is a business tool. Do not enter personal health, family or
other sensitive information that the business does not need — there is
nowhere in the workbook for it, and it does not belong in a backup file.