MonkeeToolsPrivacy

Privacy and sharing

This page explains local invoice storage, optional sharing, feedback and usage events. You can inspect browser behavior in developer tools; server storage and retention also depend on the service described below.

What is stored on this device

The generator can remember your business profile, clients and invoice history in this browser’s localStorage. These records do not automatically sync across devices. Data included in a link leaves this browser when you share it; choosing a short link also sends the full invoice link to the short-link service.

• Your choice: “Remember on this device” controls saving your business profile, clients and invoice history. You can use the generator without saving those records. Other local preferences and random usage identifiers are separate; turning off remembering is not a promise that the browser stores nothing.
• Records: your business profile, payment details, saved clients, invoice history and defaults can be stored in this browser. Anyone with access to the browser may be able to read them.
• Clearing and copies: browser site-data controls can clear local records. Clearing local records does not retract files or links you already shared, or delete copies held by a recipient or the short-link service.
• Backups: downloaded backup and CSV files are separate copies. Store and share them carefully.

Invoice editing and sharing

• Invoice editing and PDF generation run in your browser. The PDF does not need a server to render it.
• A full client link carries the invoice in its fragment. Anyone with that link can open it, and the email or messaging service you use receives the link you send.
• A short link requires the complete invoice link to be sent to the short-link service. Compression or encoding makes a link smaller; it does not keep its contents secret.

Network activity

The site loads its pages and assets. Depending on the feature and deployment, it can also make these requests:

• Feedback, replies and votes: when enabled, submission contents are encrypted in the browser. Protected forms send a human-verification token alongside the encrypted envelope. The token is not part of the encrypted message.
• Usage events: when enabled, event payloads are encrypted in the browser. They include event names, timestamps and random session or installation identifiers; a page path or referral or team marker may also be included. These identifiers can link activity from the same browser.
• Short client links: choosing the one-time shortening action, or using Copy client link, Email client or Text client with the shortening setting on, sends the full invoice-bearing URL to the short-link service. Cancelling Text or entering an invalid number stops before shortening.
• Directory badges: pages with external badges may load images from PromptFrenzy, LetsLaunch and Startup Fame. Those providers receive the image requests.
• Human verification: feedback and tool-suggestion forms use Cloudflare Turnstile, which may process browser or device signals under Cloudflare’s privacy policy.

Your browser also contacts external services when you follow their links or open your email, messaging or payment app. The Network tab shows requests made by this page; requests made by another app must be assessed separately.

Finder services

The Email Finder and Client Finder are service-powered: each lookup sends a request to our service to run the search.

• Data: the search terms you enter (name, business, website). Email Finder also sends your Brand Pack license key with each lookup so the service can verify access.
• Transient cache: discovery queries and candidate page URLs are held in Worker memory and reused for 10 minutes. Ten minutes limits reuse, not deletion: stale entries can remain until replaced, evicted when the cache exceeds 200 entries, or the Worker instance ends. This cache is not written to a database by this code.
• Quota records: each Finder allows 3 lookups per day per IP address, resetting at midnight UTC. People sharing a network share that limit. The server stores an IP-based daily key and count, without search terms, with two-day expiry metadata. KV fallback applies a two-day expiry; D1 reads do not enforce expiry, and automatic D1 cleanup has not been verified. This is not a two-day deletion guarantee.
• Usage totals: separate daily counters record lookups, hits and misses with 90-day expiry metadata. The Finder code does not write individual search terms to these counters. These totals are distinct from the IP-based quota records; production platform logs and automatic D1 cleanup have not been independently verified.
• Discovery providers: when discovery is needed, the service sends a query to DuckDuckGo Lite; a provided website or reusable cache entry can bypass that request. It fetches candidate websites directly and uses Cloudflare DNS to check email domains. These providers receive the requests required for those steps under their own policies.
• Human verification: both Finders use Cloudflare Turnstile, which may process browser or device signals under Cloudflare's privacy policy.

Short client links

Short links use a Cloudflare-hosted service. Creating one sends the full invoice URL, including its fragment, to that service so the short link can redirect to it.

• When: the one-time “Shorten and copy this link” action requests a short link even when the Settings option is off. “Use short links for Copy, Email and Text” applies to Copy client link, Email client and Text client. Changing it takes effect for the next action.
• Data: the URL contains the invoice details included in the full link. The short-link request is not encrypted with the feedback-sealing key. Treat the service as able to read those details.
• Access: anyone with either the full or short link can open the invoice. Links are not recipient-restricted or password-protected. Share them only through channels you trust.
• Control: turning shortening off stops future automatic shortening. Do not assume it revokes an existing link, gives it an expiry date or removes copies already shared.
• Retention and deletion: the implementation stores the full URL in D1 with a creation time and click count. It defines no expiry or user-facing deletion/revocation endpoint. We have not verified a separate operational cleanup period. Treat an existing short link as persistent; clearing local records does not delete it.

How the sealing works

Feedback, reply and vote contents, and enabled usage-event payloads, use the browser encryption shown below. This does not apply to short-link URLs or the separate Turnstile token.

{
  "v": 1,
  "key": "<RSA-OAEP-SHA-256 sealed AES key>",
  "iv":  "<random 12-byte IV>",
  "data": "<AES-GCM-256 sealed payload>"
}

• A fresh 256-bit AES-GCM key is generated per submission; the payload is sealed with it.
• That AES key is sealed with an RSA public key using OAEP and SHA-256.
• The submission envelope contains an encrypted payload and an encrypted AES key. This browser code demonstrates the encryption step; it does not establish who can access the server or private key, or how long server records are retained.

Our RSA public key fingerprint (SHA-256 of the SPKI):
bc91:64b5:27d2:7b4d:a5a0:5d52:63cb:acde:cd2a:a14d:874b:971e:ebbe:4781:3b20:530a

Verify it yourself

Use synthetic invoice details when testing. The following checks describe the intended behavior; a failed check should be reported.

• With “Use short links for Copy, Email and Text” off, use each action and inspect Network for /shorten requests: none should occur.
• Turn the setting on without downloading another PDF, then repeat each action. Each should make one shortening POST. Its JSON body contains the full client URL, including the fragment. If the service fails, the action should use the full link and report the fallback.
• With shortening on, cancel the Text prompt or enter an invalid number. Neither should make a shortening request. The separate one-time shortening button should make a request even when the default is off.
• Open a full invoice link. Its fragment is absent from the page’s HTTP request, but the page can read it. This does not prevent script from sending it in a separate request.
• On a configured test form, inspect the feedback request: message contents should be inside the ciphertext envelope and the verification token outside it. A preview with no endpoint or site key cannot demonstrate end-to-end delivery.

Site security

• Inspect the Content Security Policy in page source and HTTP response headers in Network. A meta-tag policy does not provide every protection available through response headers.
• Browser storage can contain invoice records and preferences. Anyone with access to this browser may be able to read them. An absence of cookies would not remove that risk.
• External resources include Turnstile on forms and directory-badge images where displayed. Review those providers’ privacy terms when using the affected features.
• Local PDF generation reduces the need to send invoice data to a server. Optional shortening is an exception: the short-link service receives the invoice-bearing URL and needs its own access controls, retention policy and security review.

What we collect, and why

• Feedback: submission contents are encrypted in your browser for delivery to our team. We review feedback before publishing it on the feedback board, anonymously unless you ask to be named. An optional reply email is included in the encrypted submission and is not displayed on the board.
• Usage events: event names and random browser identifiers help measure visits, downloads and repeat use. They are not direct identifiers such as a name or email, but can connect activity from the same browser.
• Short links: the service receives the full invoice link to create and resolve the redirect. See Short client links for the data and sharing implications.

Optional Meta AI job-note suggestions

File reading and reconciliation are separate requests, each requiring consent. You check and correct a transcription against the original before it can become invoice evidence. Evidence checks validate that confirmed text, rather than independently verifying the original image or audio. Source files and transcripts remain in memory in this tab; this feature does not upload files to a persistent file-storage API. Prepared files are limited to 4 MB, PDFs to three unencrypted pages and audio to 60 seconds.

MonkeeTools can offer Meta AI suggestions when its operator enables the server connection. Local parsing remains the default. Choosing the Meta step and checking its consent box sends the selected photo, PDF or audio clip, or the confirmed source text in that panel, through the MonkeeTools server to Meta Model API (Muse Spark 1.3). Saved invoices, client history, payment details and other browser storage are not included in that request. Meta's API data terms apply to files and text sent to Meta.

The server holds the application key in a protected environment or encrypted Worker secret, never in browser code. This feature does not persist submitted notes or model responses. The hosted feature requires a Cloudflare Turnstile human check after you choose consent. Its device and verification signals are separate from your notes; the token is validated on the server before a Meta request. There is no three-use product lock. Each completion is bounded in size and time and has no automatic retry. Source checks and your review are required before a proposal can change the unsaved invoice. This step does not save, issue, send or collect payment for an invoice. A separate local verification harness limits its own attempts; that is not a product quota or an account-wide billing limit.

History, honestly

Before 2026-09-12, submissions were sent as plaintext to a token-guarded inbox. That relied on the token staying secret, which is a weak guarantee once the token ships in public page source. So we moved to browser-sealed encryption and rotated every endpoint. Current sharing behavior includes optional server-created short links. See the sections above for what is sent and stored.