Privacy Policy

Last Updated: August 21, 2026 | Effective Date: August 21, 2026

Local-First Data Sovereignty Ethos: Rake is designed from the ground up as a data-sovereign application. Your operational records—including timesheets, billable rates, client names, invoice totals, and tax calculations—are stored strictly on your local device. We do not upload, host, track, or sell your local operational business data.

1. Our Commitment to Privacy

We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable to international users, we also respect global data protection standards, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

This Privacy Policy explains how Rake handles data, what limited information is processed on central servers, and the rights you hold regarding your personal information.

2. Architectural Separation: Local Data vs. Server Data

2.1 Local Device Storage (Your Sovereign Data)

The vast majority of data generated when using Rake remains localized entirely on your hardware within your browser's IndexedDB database. This includes:

Client directory details, contacts, and rates;
Time tracking entries, timers, and project descriptions;
Invoices, quote calculations, and payment statuses;
Personal Services Income (PSI) compliance assessments;
Division 7A loan calculations and wealth strategy scenario parameters;
Custom business profile settings and branding defaults.

Provider has zero visibility into, access to, or central backups of this local database.

2.2 Server-Side Data Collection

To deliver software licensing, facilitate account authentication, process payments, and ensure platform stability, we collect and process limited information on our secure servers:

Data Category	When Collected	Primary Purpose	Retention Period
Account & Billing Info (Email, Name, Company, ABN)	Account creation, trial activation, or purchase	License entitlement, transactional receipts, billing support via Stripe	Duration of active account + 12 months after cancellation
Cryptographic License Data (License Key, Tier status)	Software activation & periodic check-in	Verifying subscription entitlement and access rights	Duration of active license
Error Telemetry (Stack traces, browser type)	When application encounters an unhandled exception	Identifying software bugs, stability improvements, performance optimization	90 days (auto-pruned)
Product Feedback (Ratings, text comments)	Voluntarily submitted via in-app feedback dialog	Product roadmap development and quality assurance	Indefinitely (or until user requests deletion)
Server Security Logs (Hashed IP, requested path, User-Agent)	Visiting landing page or API endpoints	DDoS mitigation, rate limiting, and security auditing (raw IPs are hashed)	90 days (auto-pruned)
Email Delivery Logs (Recipient email, delivery status)	Sending license keys or password receipts	Audit trail, proof of delivery, anti-spam compliance	12 months (auto-pruned)

3. AI Features and Third-Party Data Processing

3.1 Integration with Google Gemini API

Rake offers optional AI-assisted tools (such as automated work log summaries, invoice item description formatting, and project health checks) powered by Google Gemini API.

3.2 Data Flow and Processing Constraints

When you trigger an AI action, specific text context (e.g., project titles, work log task descriptions) is transmitted over encrypted TLS directly to Google's API servers for processing. We enforce the following privacy constraints:

Rake servers do not store or log the text payload of your AI prompts or AI-generated completions;
We do not submit master account passwords or raw financial tax databases to AI endpoints;
Google processes API requests under their enterprise terms, which specify that data sent via official developer API endpoints is not used to train public foundation models. You can review Google's API Privacy Terms at https://ai.google.dev/terms.

4. Cookies, Tracking, and Analytics

4.1 Zero Ad Tracking

We do not sell advertising space, nor do we employ third-party tracking pixels (such as Meta Pixel or Google Ads tracking), invasive cross-site scripts, or commercial data brokers.

4.2 Essential Cookies and Local Storage

We use a minimal set of essential cookies and local storage tokens:

admin_token: A secure, httpOnly session cookie utilized exclusively for authenticating access to internal administrative management panels;
localStorage: Used strictly on your local browser to preserve display settings, UI theme selections, and custom brand configurations.

5. Information Sharing and Third-Party Service Providers

We will never sell, rent, or trade your personal information. We disclose limited server-side data only to trusted third-party service providers bound by strict confidentiality and security obligations, including:

Payment Processors: Payment gateway services (such as Stripe) to process credit card transactions securely under PCI-DSS compliance;
Cloud Infrastructure: Secure cloud hosting providers hosting server endpoints under Australian and tier-1 international data center security standards;
Transactional Email Services: Secure dispatch services used solely for sending license keys, receipts, and system alerts.

6. Data Security Measures

We employ robust technical and organizational security controls to safeguard data:

Transport Security: All data transmitted between your browser and our backend servers is encrypted using HTTPS / TLS 1.3 encryption;
Password Protection: Master passwords set within Rake for local encryption are hashed on-device using bcrypt with a high work factor and are never transmitted to our servers in plaintext;
Infrastructure Security: Server infrastructure enforces strict Content Security Policies (CSP), HTTP security headers, CORS restrictions, rate limiting, and automated vulnerability patching.

7. Your Privacy Rights and Data Control

Under the Australian Privacy Principles (APPs) and applicable privacy laws, you possess clear rights over your data:

Right to Access: You may request a copy of all server-side personal information held about you by contacting connect@getrake.au;
Right to Correction: You may request the correction of inaccurate or out-of-date personal information;
Right to Erasure (Deletion): You may request deletion of your server-side account records. You can also trigger immediate deletion of all local records on your device via the "Reset System" function in App Settings;
Right to Data Portability: You can export 100% of your local business records at any time using Rake's built-in JSON backup and export tool;
Complaints: If you believe we have breached the Australian Privacy Principles, you may submit a complaint to us at connect@getrake.au. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. International Data Transfers

Server-side account and transaction records may be hosted on secure servers located in Australia or with international cloud providers adhering to recognized privacy safeguards (such as Standard Contractual Clauses). By using the Service, you consent to this transfer under equivalent privacy protection standards.

9. Children's Privacy

Rake is designed for business professionals and independent consultants. The Software is not intended for use by persons under 18 years of age, and we do not knowingly collect personal information from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our software features, legal requirements, or operational practices. Updated versions will be published on our website with a revised "Last Updated" date.

11. Contact Our Privacy Lead

For any questions, requests, or privacy concerns regarding Rake, please contact:

Rake Privacy & Data Protection
Email: connect@getrake.au
Website: https://getrake.au