Privacy policy

Effective 17 October 2026

InvoicePack is a browser extension that downloads sales invoices from your Xero organisation as PDF files. This page explains what it reads, where that data is processed, what it stores, and how to stop it. The short version: your invoices go from Xero to your browser and nowhere else.

Who operates InvoicePack

InvoicePack is developed and operated by Gustavo Martínez, Córdoba, Argentina. Contact: gustavomartinez+invoicepack@gmail.com.

What the extension reads from Xero

When you connect, the extension asks Xero for read-only permissions (accounting.invoices.read, accounting.contacts.read, accounting.attachments.read, openid, offline_access). With them it reads:

• Sales invoice details: number, date, due date, contact name, reference, status, totals and currency.
• The PDF of each invoice you select.
• The files attached to those invoices, only when you tick "Include attachments".
• The list of organisations your Xero login can access, so you can choose one.

It cannot create, edit, send or delete anything in Xero.

Where your data is processed

Entirely in your browser. The extension calls Xero's API directly from your computer, builds the ZIP file locally and saves it to your Downloads folder. InvoicePack has no server of its own: your invoice data is never uploaded to, logged by or analysed by us or by anyone else on our behalf.

What is stored on your device

The extension keeps the following in your browser's extension storage, on your computer only:

• The Xero access and refresh tokens that keep you signed in.
• The list of your organisations and which one you selected.
• Your license key, if you entered one.
• Your preferences (file name pattern, folder layout, filters).

Invoices, PDFs and attachments are not kept by the extension after the ZIP is saved. Everything above is deleted when you disconnect, remove the license or uninstall the extension.

License validation

If you buy a license, the extension sends your license key, and nothing else, to Polar (polar.sh) when you enter it and about once a week afterwards, to confirm it is valid. Purchases are handled by Polar as merchant of record; the payment details you give at checkout are governed by Polar's privacy policy. We receive your email address and order details from Polar for support and refunds.

No tracking

The extension contains no analytics, advertising or tracking code and sets no cookies. This website uses no analytics either; our hosting provider may keep standard, short-lived server logs (IP address, requested page, time) to operate the service.

Limited use

Data obtained through the extension is used only to provide the feature you are using at that moment. It is not sold, shared with third parties, used for advertising, or used to train or improve AI or machine-learning models.

How to disconnect

• In the extension: press "Disconnect". This deletes the stored tokens.
• In Xero: Settings → Connected apps → InvoicePack → Disconnect. This revokes the extension's access even if the extension is still installed.
• Uninstalling the extension from Chrome removes everything it stored.

Changes

If this policy changes, the new version will be published on this page with a new effective date. Changes that affect what the extension reads or stores will also be described in the extension's update notes.

InvoicePack is an independent tool and is not affiliated with or endorsed by Xero Limited. "Xero" is a trademark of Xero Limited.