Frac is accounting software made by Empty Spaces, Inc. (“we”, “us”). This policy explains what we collect when you use this website (usefrac.app), the Frac app (my.usefrac.app) and Frac’s MCP server, what we do with it, and the choices you have.
What we collect
When you sign in
You sign in to Frac with GitHub or Google. Either one shares your name, email address and profile picture with us, and tells us your email address is verified. We never receive your password.
- From GitHub we ask only to read your public profile and your email addresses. We get no access to your repositories, code or organizations.
- From Google we ask only for your basic profile, not your Gmail, Drive, contacts or anything else.
Your company’s books
- The company name you enter and the people you invite (their email addresses, and their names once they sign in).
- The API keys you paste in to connect Brex, Meow or Wise, and what we fetch with them: account details, balances and transactions, including their full history on the first sync.
- What you and your team add: categories, rules, splits, journal entries, accounts, memos, and the receipts and invoices you attach.
When you connect an AI assistant
When you connect Claude, ChatGPT, Cursor or another MCP client, we store the app’s registration (its name and where to send you back after sign-in), the company and access level you chose, and the tokens it uses. Tokens are stored only as hashes.
Technical data
A session cookie keeps you signed in, and we record the IP address and browser of each signed-in session. Our servers keep standard request logs. This website uses no analytics, advertising or tracking cookies.
How we use it
- To run Frac: sync your banks, categorize transactions, keep the ledger and produce your reports.
- To keep it secure: authenticate you, limit sign-in attempts, investigate abuse and fix problems.
- To talk to you about your account, support requests and changes to Frac.
We don’t sell your personal information or your company’s data, we don’t use it for advertising, and we don’t use it to train AI models. Frac itself sends your data to no AI model.
Google user data
Frac requests only your basic Google profile (name, email address and profile picture) to sign you in. We use it to identify you in Frac and to show your team who you are, and for nothing else. We don’t use it for advertising, don’t sell it, and don’t transfer it to anyone except as needed to run Frac, to comply with the law, or as part of a merger or acquisition. Frac’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with
- Amazon Web Services hosts Frac, its database and its backups, in the United States.
- GitHub and Google provide sign-in.
- Brex, Meow and Wise, the banks you connect: we call their APIs with the keys you gave us, to read your accounts.
- AI assistants you connect receive what they ask Frac for, within the company and access level you chose. What their providers do with it is governed by their own terms and privacy policies.
- Your team: the people you invite to a company see that company’s books.
We may also disclose information when the law requires it, to protect Frac or its users, or to a successor if Empty Spaces, Inc. is merged or acquired, in which case this policy continues to apply to it.
How we protect it
Each company’s books are kept apart by the database itself, with row-level security. Bank API keys are encrypted at rest with AES-256-GCM. Every connection to Frac uses HTTPS. Sessions end after 7 days. The database is backed up nightly. More on the security page.
How long we keep it
We keep your account and your company’s books for as long as you use Frac. When you ask us to delete a company or your account, we delete it from the live database, and it disappears from our backups as they are replaced. Request logs are kept only as long as we need them to run and secure the service.
Your choices and rights
- You can see and correct your company’s data in Frac, and export every report to CSV.
- Owners can disconnect a bank or an AI assistant, and remove team members, at any time.
- To delete a company’s books or your account, or to ask what we hold about you, email m@emptyspaces.ai. Self-serve deletion isn’t built yet, so we do it by hand.
Depending on where you live, including California, you may have rights to know, access, correct and delete your personal information, and not to be discriminated against for using them. Email m@emptyspaces.ai to use any of them. We don’t sell or share personal information for cross-context behavioral advertising.
Children
Frac is for businesses and isn’t directed to anyone under 16. We don’t knowingly collect their information.
Changes to this policy
If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell account owners by email before it takes effect.
Contact
Empty Spaces, Inc., the maker of Frac. Questions about this policy or your data: m@emptyspaces.ai.