Privacy Policy

devs group GmbH
8280 Kreuzlingen
devs-group.ch

This app is not an official product of Bexio AG. "Bexio" is a registered trademark of Bexio AG. It is developed and operated independently by devs group. Use is entirely voluntary. You decide whether and how long you use this App. Uninstallation is possible at any time and deletes all local data.

The Provider does not store any of your Bexio business data (invoices, contacts, files) on its own servers. This data is stored exclusively locally on your device. API requests to Bexio are routed through a backend system of the Provider that acts as a proxy and forwards requests to the official Bexio API. This backend neither logs nor analyses your requests or business data. Only the authentication tokens and minimal state data necessary for operation are stored server-side (see sections 4 and 5).

Authentication (OAuth / Device Token)

When signing in, you authenticate directly with Bexio via a secure OAuth process (PKCE). The Bexio credentials (Access Token and Refresh Token) are stored and managed exclusively on the Provider’s backend system – they never reach your device. Only a device-specific token (Device Token) is stored in the secure keychain (Keychain/Keystore) on your device, which identifies your device to the backend. Your Bexio password is never stored in the App or transmitted to the Provider.

Server-side storage of Bexio tokens serves two purposes: (1) the OAuth client secret is kept server-side and never transmitted to the device, enhancing authentication security; (2) the notification service can check in the background whether relevant status changes have occurred to trigger push notifications. The tokens are used exclusively for these purposes and are deleted when access is revoked.

Minimal server-side state data

To detect whether anything has changed since the last check, the backend stores an absolute minimum of state data per account. This exclusively includes:

• Last known count/IDs of files in the inbox (to detect new files)
• Last known status of invoices (to detect status changes such as "paid" or "overdue")

This data contains no content (no file names, amounts, customer names or other business data). It serves exclusively for comparison ("has anything changed?") and is deleted upon sign-out or revocation of access.

Cached Bexio data

For offline use, the following data from your Bexio account is cached locally on your device in a SQLite database:

• Invoices (master data, line items, status)
• Supplier bills (master data, line items, attachment metadata)
• Files in the inbox (metadata, preview images)
• Contacts (name, address, for invoice creation)
• Company name (for dashboard display)

This data does not leave your device. You can clear the local cache at any time in the app settings.

Push notifications (optional)

Push notifications are an optional feature that you must actively enable. When activated, a device-specific push token is transmitted to the Provider’s notification service. This token contains no personal data and serves exclusively for delivering notifications (e.g. invoice paid, invoice overdue, new files). You can disable push notifications at any time in the app settings.

The Provider stores server-side exclusively:

• Bexio Access Token and Refresh Token: encrypted, for authentication with Bexio and for background checks
• Push Token (only with activated notifications): for delivering push messages
• Minimal state data: last known file count/IDs and invoice status, without content (see section 4)

The Provider stores no IP addresses, no server logs and no usage data. The backend system forwards API requests to Bexio without logging or storing them.

The Provider has no access to your Bexio data, your Bexio password, your invoices, contacts or files.

Your data is not sold, rented or shared with third parties for advertising or analytics purposes. No tracking takes place. The following third-party services are technically integrated:

• Bexio AG: API requests are forwarded through the Provider’s backend to the official Bexio API (in accordance with their Privacy Policy)
• Apple Push Notification Service / Firebase Cloud Messaging: Delivery of push notifications (only when activated). Further details in the Firebase Privacy Policy.

• Local Bexio data: Immediate deletion upon uninstalling the App or clearing the cache in settings
• Device Token (local): Deletion upon sign-out or uninstallation from the keychain
• Bexio Tokens (server-side): Deletion upon sign-out, revocation of access in Bexio, or upon request
• Push Token: Deletion upon deactivation of notifications or uninstallation
• Server-side state data: Deletion upon sign-out, revocation of access, or upon request
• Automatic deletion upon inactivity: Accounts that have not connected to the App for more than 90 days are automatically and completely deleted from the server (Bexio Tokens, Push Token, state data). A new sign-in is required after deletion.

Since nearly all data is stored exclusively on your device, you have complete control over its deletion.

Under the Swiss Data Protection Act (nDSG, in force since 1 September 2023), you have the following rights:

• Information: You can request information about the data stored by the Provider at any time. This includes Bexio Tokens, Push Token and minimal state data (see section 5).
• Deletion: Uninstalling the App deletes all local data. Server-side data (Tokens, state data) are deleted upon sign-out or after 90 days of inactivity. You can request immediate deletion by email at any time.
• Revocation: Revoke OAuth access at any time in your Bexio account under "Connected Apps".
• Complaint: You have the right to file a complaint with the competent data protection authority (FDPIC).

This website and the App use no cookies, no advertising and no IP storage. No user profiles are created.

The App uses the security mechanisms of your device (Keychain/Keystore for tokens, App Sandbox for the local database). Communication with the Bexio API is exclusively via encrypted HTTPS connections. However, the Provider cannot guarantee absolute security and is not liable for unauthorised access to your device.

This Privacy Policy may be amended at any time. The current version is always available on this page.