Local-first

There is no server. That's the whole point.

Most invoice tools ask you to trust their privacy policy. We removed the thing a policy is supposed to protect.

The first time you send an invoice through a "free" online tool, you paste in a few things without thinking: your client's name, their billing address, the amount they owe you, maybe a note about the project. Ordinary details. Then you hit export, and those details are now sitting on a company's servers, indexed, backed up, and covered by a privacy policy you didn't read.

That is the deal almost every invoicing tool offers. It is rarely stated plainly, so let's state it: in exchange for a free PDF, you hand a third party a running record of who your clients are and how much they pay you. For a lot of people, that is fine. For a lot of other people, once they notice it, it is not fine at all.

The privacy-policy sleight of hand

The industry's answer to this discomfort is the privacy policy. Tools compete on how carefully they promise to guard your data. Encryption at rest. Servers in the EU. SOC 2. These are real and they are better than nothing.

But look at what a privacy policy actually is. It is a promise about how a company will behave with data it has already collected. It is a fence around a field you already handed over. The fence can be well built. It can also be sold to a new owner, subpoenaed, misconfigured, or quietly widened the next time the terms update. Every data breach you have ever read about happened at a company with a privacy policy.

There is a category of problem you cannot have if you never collect the data in the first place. You cannot leak what you never received. You cannot be forced to hand over what you never held. You cannot change your mind and start monetizing a database that does not exist.

Local-first is not a feature. It is an absence.

We built Billfold with no server. Not a small server, not a privacy-focused server. None.

The entire application runs in your browser. When you open it, the code loads once, and from then on it reads and writes to your own device's storage. Your business details, your saved clients, your invoice history, and the finished PDF are all created and kept on your machine. When you export, the browser's own print engine renders the file locally and drops it in your downloads.

Nothing is uploaded, because there is nowhere to upload it to. This is why we can say something no cloud competitor can honestly say: your invoices never leave your device. It is not a claim about our conduct. It is a fact about the architecture.

The trade-off is real and we will not hide it: because your data lives in your browser, clearing your browser data erases the saved list. So we nudge you to export the PDFs you want to keep, add a one-click backup file, and are building an optional, end-to-end encrypted sync for people who want their invoices on more than one device. Even then, the design holds: the server would only ever see ciphertext it cannot read.

Why "free" usually isn't

The other half of the invoicing bargain is money, and it follows the same pattern. The tool is free until the moment you want it to look like your business. Your own logo, your own color, no watermark: that is the upsell, and it usually costs around nineteen dollars every month, forever, for a document you send a few times a month.

We think that is backwards. Billfold's core is free and stays free: unlimited invoices, PDF export, tax, discount, and every currency. If you want your branding, you pay once. Twenty-nine dollars, one time, no renewal to forget to cancel. You are buying a tool, not renting access to your own paperwork.

An invoice is a document, not a database row

Underneath all of this is a small philosophical disagreement with the rest of the category. Most tools treat your invoice as a record in their system that they let you view. We treat it as a document that belongs to you and happens to be made with our tool.

That difference decides everything downstream. It is why there is no account to create, no server to trust, no subscription to cancel, and no data to breach. It is why the whole thing works on a plane.

If you have ever felt a small hesitation pasting a client's details into yet another cloud tool, that hesitation was correct. You do not have to make that trade to send a professional invoice.