Privacy Policy — Script Sense → Xero browser extension

Last updated: 28 May 2026

This Chrome extension ("the extension") lets a Script Sense user push their monthly account charges from Script Sense into Xero as invoices. It is provided by Kieran Erasmuson ("the developer", "we", "us"). This policy explains what data the extension handles, where that data goes, and how it is stored.

The short version

The extension runs entirely inside your browser. It communicates only with two services that you connect: the Script Sense platform and Xero. It does not send any of your data to the developer, and there are no analytics, advertising, or third-party tracking of any kind. We never see, receive, or store your data on our own servers — we operate none.

What data the extension accesses

Data	Source	Why
Your Script Sense session token	Read from the authenticated request your browser already makes to Script Sense, while you have Script Sense open and logged in.	To call the Script Sense API on your behalf to read your billing data. It is the same access you already have when logged in.
Account (debtor) billing data: account names, bill IDs, dates, charge amounts, invoice line-item descriptions, quantities and prices.	The Script Sense API.	To show you which account customers have outstanding charges and to build the corresponding Xero invoices.
Xero access and refresh tokens, and your Xero organisation (tenant) ID	Xero's OAuth 2.0 sign-in, which you complete yourself in a Xero-hosted window.	To create contacts and invoices in your Xero organisation on your behalf.
Xero contacts, tax rates, and revenue accounts	The Xero API.	To match Script Sense accounts to Xero contacts and to let you choose the correct account code and tax rate.

What the extension writes

To Xero: it creates contacts and invoices that you have selected, and (optionally) emails those invoices through Xero.
To Script Sense: it marks the bills you have invoiced as "Sent", so they are not invoiced twice.

Where data is stored

Your Script Sense session token is held only in your browser's session storage. It is cleared automatically when you close your browser and is never written to disk by the extension.
Your Xero tokens, Xero organisation ID, your saved account-to-contact matches, hidden accounts, and your default invoice settings are held in your browser's local storage on your own device.
None of this data is transmitted to the developer or to any party other than Script Sense and Xero themselves.

Data sharing and sale

We do not sell, rent, or share your data with anyone. The extension transmits data only to the Script Sense and Xero APIs, which are the services you are using it to connect. We do not transfer your data to any other third party.

Data retention and deletion

The Script Sense session token is discarded when you close your browser.
You can remove all locally stored data — Xero tokens, contact matches and settings — at any time by removing the extension from Chrome, or by clearing the extension's storage from your browser settings.
Disconnecting in Xero (Settings → Connected apps) revokes the extension's access to your Xero organisation.

Security

Authentication with Xero uses OAuth 2.0 with PKCE; no Xero password or client secret is stored in the extension. All communication with Script Sense and Xero is over HTTPS.

Children

The extension is a business tool and is not directed at children.

Changes to this policy

If this policy changes, the updated version will be published at this URL with a new "last updated" date.

Contact

Questions about this policy or the extension's handling of data: kieran@scriptsense.co.nz.