The short version
Your Excel workbook, its backups and its activity log stay on your computer. Our service receives the invoice documents you ask it to read, a masked summary of your workbook's layout, a few example notes with every digit masked, and anything you type into the setup chat. Anthropic's Claude reads those. Ordinary, tested code on your computer does all the writing, and only after you approve a cell-level preview.
This page is the plain-language version. The app's formal privacy policy will be published before the app launches. The site's privacy notice covers this website and the waitlist.
What stays on your computer, and what leaves
| Data | Stays on your computer | Sent to General Invoices' service | Why |
|---|---|---|---|
Your workbook file (.xlsx / .xlsm) | Always | Never | It is read and written only on your disk |
| Backups and the activity log | Always | Never | The five most recent backups sit in a folder next to the workbook; the log records each write |
| Dollar amounts, balances and dates in the workbook | Always | Never | Masked on your computer before the layout summary is sent, then masked again by our server |
| Workbook layout: sheet names, column headers, sample text cells, formula text | Yes | At setup, when you re-learn the layout, and with each setup-chat message | So Claude can propose where entries belong. Processed in memory, not stored |
| Up to eight example notes from the notes column you chose | Yes | With each invoice read, every digit replaced with # | So the note written for a new entry matches your shorthand |
| Setup-chat messages and your corrections | Yes | When you send them | They travel with the layout summary. Not stored in our database |
| Invoice and receipt documents you add | Yes | Each time one is read, up to 10 MB and 30 pages | Claude extracts vendor, date, invoice number, amounts and tax. The bytes are dropped after the reply |
| Extracted values | Yes | Returned to your machine | They become the proposed entry you preview |
| Error reports when the app hits a bug | Yes, if you switch them off | Otherwise sent to PostHog: error type, where in our code, app and OS version, an anonymous install id, your account id | So bugs get fixed. File paths, emails, amounts and long numbers are removed first; never workbook contents or vendor names |
| Your email address, plan and usage counts | Yes | Sign-in, billing, and metering against your monthly allowance | |
| Payment card details | Entered on Stripe's pages | General Invoices never sees the card number |
The local part of the app, the engine that reads and writes your workbook, listens only on your own machine (127.0.0.1) with a secret generated fresh each launch. Nothing else on your network can reach it.
How a write happens
Every approved entry goes through the same six steps. Any step can stop the write; none can be skipped.
-
Preview
You see the exact cells that will change (sheet, row and column) before anything else happens. This is the plan you approve or refuse.
-
Verified on a copy
The plan is applied to a temporary duplicate of your workbook and a set of checks runs against the result. A failing check blocks the write and tells you why.
-
Fingerprint check
The workbook's structure is fingerprinted when you approve. If the file has changed since then, because you edited it or something else did, the write is refused rather than applied to a file that no longer matches the plan.
-
Backup
A timestamped copy of the workbook is saved next to it before the write. The last five backups are kept.
-
Write to a temporary file
The full new version is written to a temporary file, never directly into your original.
-
Atomic swap
The temporary file replaces the original in a single operating-system operation. A crash before that moment leaves your original exactly as it was.
When it refuses to write
Refusing is a feature. In each of these cases General Invoices stops and explains, instead of guessing:
- The workbook is open in Excel. Two programs writing one file is how files get corrupted.
- The workbook changed since you approved the plan. The structure fingerprint no longer matches.
- The invoice is already in the book. Same vendor, same amount, same date: refused as a duplicate.
- The layout can't be expressed safely. A sheet with one column per expense category, or a quarterly budget grid, has no single place an invoice belongs. It is refused with an explanation rather than posted somewhere plausible.
- A verification check fails on the copy. The real file is never touched.
- You are signed out or offline. The app says so. It does not invent a layout for a real workbook.
Where the app is unsure but can proceed, it warns instead. When a vendor's name closely matches an existing section, it posts and names the section it matched so you can check.
How we know it works
Claims about safety should come with evidence. These figures come from the engineering status verified on September 12, 2026:
- 1,435 automated tests across the workbook engine, the verification harness, the desktop app and the backend, run on every change.
- Verified against copies of real small-business workbooks, driven through the real code path with the live model reading real invoice PDFs: vendor-grouped ledgers with per-vendor detail sheets, months-by-accounts utility grids, accounts-payable sheets with calculated columns and cross-sheet summary tabs, and native Excel Tables.
- A corpus of ten further common layouts: a check register with a running balance, one sheet per month, a signed-amount ledger, an accounts-receivable register, a header buried under a title block, VAT columns in a native Table, two independent tables on one sheet, a template row kept at the bottom, one column per expense category, and a quarters-by-categories grid. All ten were driven through the same pipeline. Eight posted correctly, two were refused with an actionable message, and none were written incorrectly.
- That corpus found five defects the reference workbook had never exposed. All five are fixed and pinned by regression tests.
Why we publish this. A green test suite is not the same as correctness on your book. Roughly a thousand of our tests once passed while the write path was mis-placing entries on real workbooks the fixtures didn't resemble. That is the reason the coverage dry-run and the cell-level preview exist: you see it work on your workbook before you trust it.
Accounts, billing and updates
- Sign-in
- Email and password, a magic link, or Google, Microsoft or Apple, through Supabase. General Invoices never sees your password.
- Billing
- Handled by Stripe. General Invoices never sees or stores card numbers.
- Metering
- The service records the kind, count and time of each request against your plan's monthly allowance. It does not keep document contents.
- Updates
- App updates are cryptographically signed and verified before they are installed. An update that cannot be verified is refused.
Privacy summary
In plain terms:
- Our database holds your account identity, subscription state and monthly usage counts.
- It never holds your workbook, its dollar amounts, extracted values, or the contents of invoices after they have been read.
- The app contains no advertising and no usage analytics: it does not record clicks, screens or keystrokes.
- When the app hits a bug it can send a short, scrubbed error report to PostHog. You can switch this off under Settings, Error reports.
- We do not sell your data or share it with advertisers.
- Anthropic processes the documents and layout summaries described above under its agreement with us.
The app's full privacy policy, including retention and your rights, will be published before the app launches. This website and its waitlist are covered by the privacy notice. Questions: max@agen-tech.com.
Questions
Does my Excel workbook get uploaded?
No. The workbook file stays on your computer and is only ever read and written there. What leaves is a masked summary of its layout: sheet names, column headers, sample text cells and formula text, with every number, amount and date blanked out. It is sent at setup, when you re-learn the layout, and with setup-chat messages.
What AI reads my invoices, and is it trained on them?
Claude, Anthropic's model, reads invoices and layout summaries through our server, under Anthropic's agreement with us. The document is processed to extract vendor, date, amounts and tax, the result comes back to your computer, and our server drops the bytes. Ordinary, tested code writes to your workbook, never the AI. The app's privacy policy, published before launch, will cover Anthropic's data handling.
Does General Invoices work offline?
Partly. Previewing, backing up and writing happen on your computer. Reading a new invoice, and learning or re-learning a layout, need an internet connection because they run through our service. If you are signed out or offline, the app says so, writes nothing, and does not guess a layout.
What happens if my computer crashes in the middle of a write?
Your original file is untouched. General Invoices writes the new version to a temporary file next to the original and only then swaps it into place in a single atomic operation. A crash before the swap leaves the original as it was; a timestamped backup was also taken before the write began.
Built for people who don't trust software with their books.
General Invoices isn't released yet. Join the waitlist and we'll email you when it launches.