Privacy policy

1. Who runs this software

Falcon online is operated by Godengine. If you use a copy of Falcon that somebody else runs, or the desktop application on your own computer, whoever runs it operates the database; this page describes what the software itself does.

2. Where your data is stored

Falcon online stores your account and your books on servers in the United States, provided by a hosting company there. It does not store them in India.

The Windows desktop application keeps the books in a folder on your own computer and sends them nowhere.

3. What is stored

Account data: your name, e-mail address and a slow, salted hash of your password. The plaintext password is never written anywhere — not to the database, not to a log, not to a backup.

Company data: business profile, addresses, tax registration numbers, bank account details you enter for your own records, logo and signature images, parties, items, the chart of accounts, vouchers, bills, payments, stock movements, payroll records and fixed assets.

Operational data: sessions (as token hashes), an audit trail of significant actions, AI request metadata, captured outbound mail, and rate-limit counters keyed by a hash rather than by a raw address.

4. What is never stored

Plaintext passwords. Bank login credentials — no bank is connected, so there is nothing to hold. GST portal credentials, digital signatures, or any other means of accessing a government system. Card or payment details, because no payment provider is connected.

Payroll figures never appear in a log line at any level. This is a deliberate constraint, not a side effect of the default log level.

5. What is sent to an AI provider

Only when an AI provider is configured, and only for the feature you use. Drafting an invoice sends what you typed or said, any document text you supplied, your default currency, tax rate and country, and the names of your existing customers and items with their rates, so they can be matched.

Asking a question about your books sends the figures worked out to answer it — for example cash and bank balances, profit and loss, the GST position or item profitability. Bank statement lines and payroll records are not sent.

On Falcon online no outside AI provider is configured at present, so nothing is sent to one.

6. Retention of AI data

Each generation stores a truncated excerpt of the prompt, the provider and model used, timing and token counts, and the validated draft — so you have a history of what was produced and can reproduce a result. Full raw prompts and raw provider responses are not retained.

7. Cookies

The application sets its own cookies only: a session cookie holding a random token; a short-lived one while a two-factor sign-in is completed; a signed ten-minute one while a Google sign-in is completed; which organisation, company and financial year you have open; and your display choices — the look you picked, whether reports show charts or text, and how far you are through the guided tour.

One more cookie, falcon_aid, holds a random, anonymous identifier for our own visit counting (described next). It is first-party and kept for one year. It is not set at all if your browser sends Do Not Track or Global Privacy Control.

There is no advertising and no third-party tracking or analytics of any kind.

8. Visit counting

Falcon counts page visits, sign-ups and first use with its own code, into its own database on the same servers in the United States. Each event records the page path without its query string, the host of the referring site, campaign tags if the link had them, and the anonymous identifier above.

It never records your IP address, your browser’s user agent, your e-mail or name, the page title, a full referring address, amounts, document contents or tokens. Visits from a browser sending Do Not Track or Global Privacy Control are not recorded at all. Only the Falcon team can see the totals.

Nothing is deleted automatically yet; we intend to remove events older than thirteen months.

9. Support requests

The help button on every page answers from Falcon’s own help pages. If you ask a person, your request and the conversation are stored on the servers in the United States. A request sent without signing in also stores the e-mail address and name you type, so that the reply can reach you; a request sent while signed in belongs to your business and can be seen by your business’s owners and admins as well as the Falcon team.

Please do not put passwords, bank details or your customers’ information in a request. No reply time is promised.

Until an e-mail provider is configured, no e-mail is sent at all — the acknowledgement and replies are kept in the application instead.

10. Signing in with Google

If “Continue with Google” is offered and you use it, Google tells Falcon your Google account identifier, your e-mail address (only if Google has verified it) and your name. Falcon asks for nothing else from your Google account. The option is switched off until it has been configured, and it does not appear until then.

11. Public share links

A share link contains a high-entropy token stored only as a hash. Anyone holding the link can view that one document. Links can be set to expire and can be revoked at any time; revocation takes effect immediately. Draft documents are never reachable by link.

12. Access, export and deletion

You can export reports — trial balance, statements, day book, receivables, payables, stock and GST working papers — as spreadsheets at any time, and invoices, payments and the tax summary as CSV. There is not yet a single export of the whole set of books.

There is no button to delete an organisation yet. To have your account and its books deleted, write to us at the address below.

The audit trail is a hash chain, so entries within it are not individually editable.

13. Security

Every query is scoped to your organisation and company, and row-level security in PostgreSQL adds a second lock on writes and on posting. Authorisation is checked on the server for every action rather than in the component that renders the button. Identifiers are random rather than sequential. Authentication, AI, upload, export, contact and public-share endpoints are rate-limited.

The security page describes each of these in more detail, including the things that are deliberately absent.

14. Contact

Questions about this policy: hello@godengine.io