Your bank statements and receipts stay on your device. The one exception is a reading service you can turn on for statements the app cannot read by itself: that statement is sent to our server, read, and not kept. We do not sell data, show ads, or track you across apps.
Connecting Gmail is optional. When you ask the app to find a receipt — for one payment, or for every payment of a month that still has none — it searches your mailbox from your device directly with Google, using read-only access. Messages are not sent to us or to any third party. The app keeps only the receipt you choose; when you ask for all missing receipts at once, it keeps the documents of messages that name the amount of a payment without a receipt, and nothing else. The access token is stored in the device keychain. You can disconnect in Settings, which revokes the access.
The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail is not used for advertising, is not transferred to others, is not used to train models, and is not read by people.
You can choose a folder (on the device, in iCloud Drive or in another place shown in Files) for the app to look in. The app remembers only where the folder is. Files in it are read on your device when the app is opened, exactly like files you add by hand, and are not sent anywhere. You can stop this in Settings at any time.
Some statements cannot be read by the rules built into the app, and the app can tell: the rows it found do not add up to the balances the statement prints. For such a statement the app offers our reading service and asks you first. If you agree, that statement — the PDF, or pictures of its pages, and the words on them — is sent over an encrypted connection to a server function we run on Vercel, which hands it to a large language model (Anthropic's Claude) and returns the rows to your device. The statement is held in memory for the length of that one request and is not stored on our server; our logs record sizes, counts and timings, never the content. Anthropic processes the request under its API terms and does not use the content to train its models. Nothing else from your device is sent: no receipts, no names, no account you have connected. You can turn the service off at any time in Settings, and it is off until you agree.
When a statement cannot be read well, the app offers to send its layout to the developer so that the bank's format can be supported. The layout is made on your device: every letter is replaced by “a” and every digit by “9”, and only the bank's column headings are kept. The app shows you exactly what will be sent, and nothing is sent unless you send it yourself from the share sheet.
Nothing that identifies you. The app contains no analytics or advertising software. When you use the reading service, the statement you chose to send is processed as described above and not retained.
Settings → Erase everything removes all statements and receipts from the device. Deleting the app does the same.
The app is not directed to children under 13.
If this policy changes, the new version is published on this page with a new date. Questions: defidare@gmail.com.