Data & Xero Access

What we read from Xero

• Profit & Loss and Balance Sheet reports
• Manual journals (for close-timing and anomaly analysis)
• Organisation details and base currency
• Tracking categories
• The list of organisations you have authorised

All access is read-only in practice: APBuddy Reporting retrieves the above and never creates, edits, or deletes anything in your Xero account.

Permission scopes we request

When you connect Xero, we request the following OAuth scopes. Some are broader than our current read-only use; we request them so that planned future features (for example, attaching supporting documents or writing back reconciliation notes) can be enabled without asking you to reconnect. We will never use a scope to modify your data without making that clear first.

• openid, profile, email — to identify your Xero login
• offline_access — to refresh access automatically so you don’t reconnect constantly
• accounting.settings.read — read organisation details and tracking categories
• accounting.journals.read — read manual journals
• accounting.transactions — read transactions (write-capable; currently read-only use)
• accounting.contacts — read contacts (write-capable; currently read-only use)
• accounting.attachments — access attachments (write-capable; reserved for future use)

What we never do

• Pay bills, send invoices, or move money
• Create, edit, or delete transactions, contacts, or any other records in Xero today
• Sell your data or use it to train AI models

Where your data goes

Retrieved data is cached in our managed PostgreSQL database (Supabase) with row-level access control, and Xero tokens are encrypted at rest. AI features send only the relevant structured slice of data to Anthropic to generate a response. See our Privacy Policy for full detail.

Revoking access

You can disconnect any organisation from within APBuddy Reporting, or revoke access from Xero under Settings → Connected Apps. To request deletion of cached data, contact welcome@homeplanner.io.