Privacy Policy

Effective date: October 22, 2026

Last updated: October 22, 2026

Write It Off helps you capture business receipts, see what a cost might qualify as, and hand a tidy packet to your accountant. To do that, we have to handle some of your information, including photos of things you bought. This policy explains, in plain words, what we collect, why, who helps us run the app, and the choices you have.

If anything here is unclear, email us at margy.lam@arenainnovation.io.

1. Who we are

Write It Off ("Write It Off," "we," "us") is provided by Arena Innovation, LLC, an Oklahoma limited liability company, and offered under the Arena Accounting brand. Arena Innovation, LLC built the app, runs it, and is responsible for your information under this policy.

• Website: https://writeitoff.app
• Privacy contact: margy.lam@arenainnovation.io
• Mailing address: Arena Innovation, LLC, 519 SW 4th St, Ste 105 #2131, Moore, OK 73160

Write It Off is a white-label app: Arena Innovation, LLC builds and runs it, and it's offered to you under the Arena Accounting brand. That's why you'll see the Arena Accounting name in the app.

2. What we collect

Information you give us

• Account details. Your email address and a password (or a one-time sign-in link sent to your email). Passwords are handled by our sign-in provider, Supabase, and we never see them in plain text.
• Receipts, photos, and notes. Photos of receipts or business items (like a laptop or desk), questions you type, your answers to follow-up questions, and notes you add.
• Details read from your receipts. Things like the merchant, date, amount, description, and payment method (for example "Visa 1234" if it's printed on the receipt), plus the business purpose and other details you enter, such as who attended a meal or where a trip went.
• Your accountant's email address, if you choose to add it so you can send a receipt PDF to them.
• Feedback and problem reports. Your message, the page you were on, the app version, and an optional screenshot. A problem report can also include your browser and device type, your screen size, and the last few error messages from the app on your device.
• Business profile. The business type you pick in the app: sole proprietor or single-member LLC (Schedule C), S corporation, C corporation, partnership, or "not sure." We use it to tailor AI answers, suggestions, and your exports. You can change it in Settings.
• Email preferences. Which of our email lists you're on, when you joined, how you joined (for example "at sign-up" or "from Settings"), and when you unsubscribed.

Information created when you use the app

• Usage counts. Each time you ask for an AI read, we record that it happened, when, and which AI model answered. We also keep a one-way fingerprint (a "hash") of the input. It lets us tell a follow-up on the same receipt apart from a new scan. It is not the photo itself. We use these records to apply free and paid limits and to prevent abuse.
• Plan and billing status. If you subscribe, we store your Stripe customer ID, your plan, its status, and when the current period ends. Your card details go straight to Stripe and never reach our servers.
• Google Drive connection, if you connect one (see section 5).
• Technical logs. Our hosting and database providers keep standard server logs, such as IP addresses, browser type, and error messages, so the service can run and be fixed. On our current plans, these logs are kept for about 1 day by our hosting provider (Vercel) and about 1 day by our database provider (Supabase). After that, they're deleted automatically.

Information stored only on your device

The app saves a few things in your browser's local storage, not on our servers: your sign-in session, your light or dark theme choice, and the name or email you want printed on your accountant packet. Clearing your browser data removes them.

3. How the AI part works

When you ask Write It Off to read a receipt, a photo, or a question, your photo and text are sent to an AI provider so it can produce the result. This happens before you decide whether to save it. It does not happen only on your phone.

• Requests go through the Vercel AI Gateway, which passes them to an AI model. Today the main model comes from OpenAI. If that's unavailable, the request may be handled by OpenAI models hosted on Microsoft Azure, or by Anthropic.
• For requests handled by OpenAI, the app asks OpenAI not to store the request. Vercel says its AI Gateway doesn't keep the content of requests or answers once a request is finished. The AI providers themselves have their own data-retention terms, so we don't promise that no provider keeps a copy for a limited time.
• The business type you picked (section 2) is sent with your request so the answer fits your kind of business.
• The AI suggests what a cost might qualify as. It does not approve anything, and a person does not review each result. See our Terms of Use.

If you choose "known write-off" to record a receipt yourself, the app tries to read the receipt text on your device using your browser's built-in text reader, where that's available. That path does not send the photo to the AI provider.

4. How we use your information

We use your information to:

• run the app: sign you in, read your receipts, save your history, and build your PDF and spreadsheet packets;
• apply free and paid plan limits, and process subscriptions through Stripe;
• send account emails, like confirming your email address and resetting your password;
• send receipt PDFs to your accountant when you press "Send to accountant";
• answer your feedback and fix problems;
• send marketing emails, which you can stop at any time (section 6);
• keep the service secure and prevent abuse; and
• meet legal obligations.

We do not sell your personal information. We do not use your receipts or photos for advertising. We do not use your receipts or photos to train our own AI models.

5. Google Drive (optional)

You can connect Google Drive to save a receipt PDF or your spreadsheet into a "Write It Off" folder in your Drive.

• We ask Google only for the drive.file permission, plus your Google email address (so Settings can show which account is connected). drive.file lets the app create and update only the files it saved. It cannot see or open anything else in your Drive.
• We store an encrypted Google access token and your Google email so we can save files when you ask. Your browser can't read the token.
• You can disconnect at any time in Settings. That revokes our access at Google and deletes the stored token. You can also remove access from your Google Account under Security, then Third-party connections.
• Files we saved to your Drive stay there after you disconnect. They're yours to keep or delete.
• Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Drive access only to save the files you ask us to save. We don't sell it, use it for ads, or use it to train AI models.

Note: while our Google app is in Google's "Testing" stage, only people we've added as testers can connect Drive.

Your receipt photos themselves are stored in our private database storage (section 7), not in Google Drive, unless you choose to save a copy there.

6. Emails we send

• Account emails (sign-up confirmation, sign-in links, password resets) come from noreply@writeitoff.app and are sent through our email provider, Resend. These are needed to run your account.
• Marketing emails. When you create an account, you're automatically added to two email lists: AI tips and how-to guides from Arena Innovation, and tax tips and updates from Arena Accounting. The sign-up screen says so. Every marketing email has a one-click unsubscribe link. Unsubscribing stops marketing email to you and takes you off both lists. You can also turn off either list at any time in Settings. Account emails, such as sign-in links and password resets, still come because they're needed to run your account. Marketing emails show our mailing address (section 1). We record when and how you joined and when you left each list. To manage these lists, we share your email address with Resend. Arena Accounting is a separate company, and it receives subscribers' email addresses. Its use of those email addresses is covered by the marketing consent for these lists, and every marketing email has an unsubscribe link.
• Feedback notifications. When you send feedback, a copy, including your email address so we can reply, is emailed to our team inbox.

7. Where your information is stored and who helps us

Your saved items are stored with Supabase in the United States (AWS us-east-1). Receipt photos are kept in a private storage area, in a folder tied to your account. Photos aren't public, and the app shows them to you through short-lived private links.

We use these service providers to run Write It Off. They handle your information only to provide their services to us:

The website loads its fonts from Google Fonts, so your browser contacts Google's servers and shares your IP address with them when pages load.

While we finish moving off our previous platform (Lovable), some account data from before mid-October 2026 may still be held there. We plan to delete it by November 30, 2026.

We may also share information if the law requires it, to protect people's rights or safety, or as part of a merger, sale, or similar business change. If that happens, this policy keeps applying to your information.

8. Cookies and similar technology

We don't use advertising cookies or third-party analytics trackers. The app uses:

• your browser's local storage to keep you signed in and to remember your settings (section 2);
• one short-lived security cookie (wio_google_oauth), set only while you connect Google Drive, to protect that sign-in step.

We don't use analytics or advertising trackers, including Vercel Web Analytics.

9. How long we keep your information

• Saved items and photos stay until you delete them or your account is deleted. You can delete any saved item, with its photo, at any time.
• Usage, billing, and email-preference records stay while your account exists. After an account closes, we keep billing records for 7 years for tax and accounting reasons.
• Feedback and problem reports (with any screenshots) stay for 12 months.
• Information about a photo you had read but didn't save isn't kept in your account. The AI providers' own retention rules apply to the request (section 3).
• Backups held by our database provider may keep deleted data for a limited time. On our current plan, our database provider doesn't keep automatic backups. If we turn backups on later, deleted data may stay in them for a limited time (for example, 7 days) before it's overwritten, and we'll update this policy.

10. Deleting your account

There isn't a "delete my account" button in the app yet. To delete your account and the information tied to it, email margy.lam@arenainnovation.io from the email address on your account. We'll confirm the request and delete your account, saved items, and photos within 30 days. If you have a paid plan, please cancel it first in Settings, under Manage billing.

Some records may be kept after deletion when the law requires it (for example, payment records Stripe keeps). Copies you saved to your own Google Drive, downloaded, or emailed to your accountant are outside our control.

11. Your choices and rights

You can:

• see and download your saved items at any time (PDF and spreadsheet export);
• correct your information by editing items or your settings;
• delete individual items in the app, or your whole account by email (section 10);
• stop marketing emails with the one-click unsubscribe link in any marketing email, or in Settings;
• disconnect Google Drive in Settings.

Depending on where you live, you may have other rights, such as asking for a copy of your data. Email us and we'll respond within 30 days. Write It Off is offered only in the United States.

12. Security

We take reasonable steps to protect your information. Each person's records and photos are walled off from other users in our database, photos are kept in private storage, Google tokens are encrypted, and card details stay with Stripe. No system is perfectly secure, though, and we can't promise your information will never be accessed without permission. Only the two founders of Arena Innovation, LLC have admin access to customer data. They may look at customer data only to provide support, fix problems, prevent fraud or abuse, or when the law requires it.

If we learn of a breach that affects your personal information, we'll notify you as the law requires.

13. Children

Write It Off is for business owners. It isn't meant for anyone under 18, and we don't knowingly collect information from children under 13. If you think a child has given us information, email us and we'll delete it.

14. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll also let you know by email or in the app at least 14 days before it takes effect.

15. Contact

Questions or requests: margy.lam@arenainnovation.io

Arena Innovation, LLC · 519 SW 4th St, Ste 105 #2131, Moore, OK 73160