Privacy policy
Last updated 27 July 2026. Fiska is in beta.
Your tax picture is yours. We do not sell it, we do not advertise against it, and we do not use it to profile you.
The short version
Fiska holds the information you put into it so it can work out your tax picture and keep your records in one place. That is the only reason we hold it.
We do not sell your information. We do not share it with advertisers. There is no advertising network and no analytics service in this app.
Two services do run in the background: Expo, which delivers app updates, and Sentry, which receives a report when Fiska crashes. Neither is given your tax records. Both are described under "Who else is involved".
Some of what you enter never leaves your phone at all. The rest sits on our own server, and you can ask us to delete it.
Who is responsible for your information
Fiska is run from Malta by one person, who is the data controller for the information described here. Write to us at privacy@fiska.mt about anything in this policy, including any of the requests described under "Your rights" below.
What Fiska collects
Your account details. Your email address, and — if you sign in with Apple or Google — the name and email address they pass to us. Sign-in is handled for us by Clerk, which is described under "Who else is involved" below.
What you tell us about your business. Your business or trading name, what you do, your VAT position, your bank account details for putting on invoices, and the setup answers you give when you first open the app.
Your tax records. The income, expenses, assets, invoices and till readings you enter or import, along with the dates, amounts and categories attached to them.
Documents you attach. Photos and files of receipts and invoices that you choose to save. These often contain other people's details, such as a supplier's name and VAT number, because that is what makes them valid tax records.
Technical records when something breaks. If Fiska crashes or hits an error, we receive a report describing what went wrong — where in the code it happened, what the app was doing beforehand, and basic details about the app and the device it is running on. What you had typed or entered is removed before it is sent. This is described under "Who else is involved".
Nothing else. We do not collect your location, your contacts, your browsing, or a device identifier for tracking.
Why we are allowed to hold it
Most of it we hold because you asked us to give you the service, and we cannot give it to you without holding it.
Some of it we have to keep even when you would rather we did not, because Maltese tax law sets minimum record-keeping periods. That is described under "How long we keep it".
A small amount is kept to keep the service secure and working, such as the technical records a server keeps to spot abuse and faults.
What stays only on your phone
If you use the team features, the details of the people you employ stay on your phone. They are not sent to our server, in whole or in part.
The device store that holds them is encrypted, and it is deliberately excluded from your phone's backups so that it does not end up copied into a cloud backup we do not control. If the encryption key is not available, the app refuses to open the store rather than falling back to an unencrypted one.
This means that if you lose the phone, that information is gone. That is the trade we have chosen on your behalf, and you should keep your own records of anything you cannot afford to lose.
Photos and documents you attach
When you attach a photo on your phone, the location and camera details embedded in the image are stripped on the phone, before anything is uploaded. We never receive them.
The image itself is uploaded and stored so that it can back up the entry it belongs to. Uploads and downloads travel over an encrypted connection and are stored encrypted at rest.
We do not read your documents for any purpose other than showing them back to you and attaching them to your own records. They are not used to train anything.
Where your information is kept
Our server and the store holding your attachments run on our own hardware in Malta, inside the EU. They are not on a public cloud, and your records are not copied to one.
Traffic between the app and the server is encrypted.
Who else is involved
Clerk handles sign-in and holds your email address and any name your Apple or Google account passes on, so that we can recognise you when you come back. Clerk acts on our instructions, and this can involve your account details being handled outside the EU.
Apple and Google are involved only if you choose to sign in with them, and only to confirm to us that the sign-in succeeded.
Expo delivers app updates. Every time you open Fiska, the app asks Expo's servers whether there is a newer signed version of itself to install. Expo sees your device's IP address and which version you are running. It is not sent anything you have entered — no records, no documents, no account details. This check happens on every launch and cannot be turned off inside the app, because it is how security fixes reach you.
Sentry receives crash reports. When Fiska crashes or hits an error, a report is sent so we can find the fault. Before it leaves your phone we strip out your identity, anything you typed into the app, the contents of any request or reply between the app and our server, and the query part of any web address. What remains is the technical trace of the failure, plus basic details about the app and the device it is running on. We keep these reports only as long as we need them to fix the fault, and no longer than 90 days.
No advertisers, no data brokers, no analytics companies.
How long we keep it
We keep your records while you are using Fiska.
Some records we have to keep for longer than that, even after you ask us to delete your account, because Maltese income tax and VAT law require records to be kept for a minimum period — currently understood to be nine years, with the longer of the two periods governing. The precise point that period starts counting from is still being confirmed with a qualified accountant, so we keep records rather than delete them where there is any doubt.
Where that applies, we tell you what was kept and why, and we delete it once the period has passed.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, or object to us holding it.
Deletion you can do yourself, from inside the app — see "Closing your account" below.
For anything else, write to privacy@fiska.mt and we will answer within one month. We will not charge you, and we will not make it difficult.
You can also complain to the Information and Data Protection Commissioner in Malta, who supervises this. You do not have to raise it with us first.
Closing your account
You can close your account from inside the app: open Profile, then "Close your account". You do not have to ask us, and you do not have to give a reason.
When you do, we remove your records and the attachments belonging to them, and the encrypted store on your device is destroyed. You will not be able to sign in again with that account.
Some records are kept because Maltese law requires it — the invoices you issued and the receipts behind what you claimed. Those are described under "How long we keep it", and they are deleted once that period has passed.
You do not need the app to do this. If you cannot open it, or would rather not, write to privacy@fiska.mt and ask us to close the account instead. We will ask you to confirm the request, because we have to be sure we are deleting the right person's records.
This is a beta
Fiska is being tested with a small number of real people using real information. It is early software: it can lose data, it can be wrong, and features change without notice.
Do not put anything into Fiska that you do not have another copy of.
Changes to this policy
If we change how any of this works, we change this policy in the same release, and the date at the top changes with it. If the change is one you would want to know about, we will tell you rather than leave you to notice.