PRIVACY POLICY

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Sensitive Information.

Financial transaction data (amounts, categories, dates) is considered sensitive personal information. However, we store this data locally on your device and do not collect personally identifiable information like names or contact details. All sensitive financial data is stored locally using device storage.

Application Data.

If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's camera for QR code scanning functionality. If you wish to change our access or permissions, you may do so in your device's settings.
• Financial Data. When you use our app, we collect and store financial transactions including income, expenses, categories, amounts, and dates. This data is stored locally on your device using local device storage (AsyncStorage). Note: AsyncStorage is not encrypted by default on all platforms.
• Receipt Parsing Data. When you scan receipt QR codes or submit a receipt URL, the payload (QR text or URL) is sent to our backend solely to extract receipt details (amount, currency, date, vendor). If you provide a URL, our backend will fetch the webpage content and may use a remote browser provider (Browserless) to render dynamic pages. We then send only the extracted page text to our AI processor (OpenAI) to parse receipt details. We do not persist receipt payloads or parsing results on our servers. Only the extracted financial information is stored locally on your device. OpenAI’s use of data is governed by their privacy policy at openai.com/privacy. Browserless provides remote browsing; see browserless.io/privacy (or provider policy as applicable).
• App Preferences. We store your app preferences including currency selection, language preference, and theme settings. This information is stored locally on your device.

Please avoid scanning or submitting receipts that contain highly sensitive personal data (e.g., full payment card numbers, government IDs, medical information). Our feature only requires typical receipt fields (total, currency, date, vendor).

Important: No personal identifying information is collected. We do not collect your name, email, phone number, or any other personally identifiable information. Your transactions and preferences stay on-device. When you scan receipt QR codes, the QR payload is sent to our backend solely to relay it to an AI processor for parsing. Both the QR payload and the parsing result are discarded by our backend after processing—we do not persist this data on our servers. Only the extracted financial information is stored locally on your device.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide the Services, enable QR receipt scanning, and store your financial data locally on your device.

We process your personal information for the following reasons:

• To provide financial tracking services. We process your transaction data to track your income and expenses, calculate balances, and generate analytics.
• To parse receipt QR codes. When you scan receipt QR codes, we send the raw QR data to our backend service, which uses OpenAI's API to extract financial information. The parsed data is stored locally on your device.
• To customize your experience. We process your preferences (currency, language, theme) to provide a personalized app experience.
• All financial data processing occurs locally on your device. We do not upload your financial transactions to our servers. For the receipt parsing feature, we transmit: (a) QR text or (b) the URL you provide (and associated fetched page content) to our backend, which may use a remote browser provider to render dynamic pages and an AI processor to extract receipt details. We do not persist this data on our servers.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

The EU General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. For our app, we rely on the following legal bases:

• On-device financial data processing: Performance of a Contract. We process your financial transactions to provide the app's core features (tracking, analytics, balance calculations) as part of the service you expect from the app.
• Camera access for QR scanning: Consent. You grant camera access through your device's operating system permissions to enable QR code scanning.
• Sending QR payload to AI processor: Legitimate Interests. We send QR codes to an AI processor to enable automated receipt parsing, improving user experience and service delivery. This processing is necessary to fulfill the primary purpose of the QR scanning feature.
• App preferences (currency, language, theme): Performance of a Contract. We process these preferences to provide the customized experience you expect from the app.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We only share information in specific situations and with specific third parties for service delivery.

We may need to share your personal information in the following situations:

• QR Receipt Processing with AI Provider. When you scan receipt QR codes, we send the QR payload to our backend, which forwards it to OpenAI (an AI processing service) solely to extract receipt details. OpenAI acts as a third-party data processor. Their use of this data is governed by their published terms and privacy policy. For details, see: openai.com/privacy
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• No Sale of Data. We do not sell your personal information to third parties. Your financial data is stored locally on your device and is never sold or shared with advertisers or marketers.

Data Processors and Subprocessors

• OpenAI (receipt text parsing) — https://openai.com/privacy
• Browserless or equivalent remote browser provider (dynamic page rendering when a URL is provided) — provider privacy policy applies (e.g., https://www.browserless.io/privacy)
• Cloudflare (app infrastructure, Workers, KV, and network/security logs) — https://www.cloudflare.com/privacypolicy/
• ExchangeRate-API (currency rates only; no user personal data) — https://www.exchangerate-api.com/privacy

International Data Transfers. Our service providers may process data in countries outside your country of residence (e.g., the United States or the EU). Where required, we rely on appropriate safeguards for such transfers and contractually require processors to protect your information.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Our receipt parsing feature uses OpenAI's AI technology to extract data from QR codes.

Our receipt QR code scanning feature uses an AI processing service (OpenAI) to parse receipt QR codes and extract financial information (amount, date, vendor). This is a service feature designed to enhance your user experience by automatically extracting receipt details using AI technology. When you scan a receipt QR code, the raw data is sent to our backend, which forwards it to OpenAI for processing.

• Your QR receipt data is processed by OpenAI as a third-party AI service
• OpenAI's use of your data, including how they store or process it, is governed by their privacy policy at openai.com/privacy
• You should review OpenAI's privacy policy to understand their data practices
• The terms in this Privacy Notice and OpenAI's privacy policy govern your use of this feature

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information locally on your device until you delete it.

All of your financial data and app preferences are stored locally on your device. We will only keep your personal information for as long as:

• You continue to use the app and keep the data stored locally on your device
• You choose to delete your data using the "Reset Data" option in settings
• You uninstall the app (which removes all local data from your device)

When you scan receipt QR codes, the raw QR data is temporarily sent to our backend service, which forwards it to OpenAI's AI service for parsing. Both the QR payload and the parsing result are discarded by our backend after processing—we do not persist this data on our servers. Only the extracted financial information is stored locally on your device. OpenAI's data practices are governed by their privacy policy: openai.com/privacy

For transparency: our infrastructure provider may retain standard server logs (e.g., IP address, user agent) for a limited period per their policies. We cache currency exchange rates (non-personal data) in Cloudflare KV for up to 24 hours to improve performance.

You have full control over your data and can delete all app data at any time using the reset functionality in the app settings.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. We do not maintain user accounts—all data is stored locally on the user's device. If you are a parent or guardian and believe your child has used the app and you would like the data deleted, please contact us at petar@radojicic.co with instructions on how to access the device and request assistance with data deletion.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you have certain rights regarding your personal information. You can review, modify, or delete your data at any time.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making.

How to Exercise Your Rights:

Since all your data is stored locally on your device, you have direct control over it:

• Access/modify: Open the app to view and edit your transactions
• Delete all data: Use the "Reset Data" option in Settings
• Contact us: Email petar@radojicic.co for data-related requests (we respond within 30 days)

10. CONTROLS FOR DO-NOT-TRACK FEATURES

This is a mobile app with data stored locally on your device. We do not use in-app analytics SDKs, tracking technologies, cookies, or advertising identifiers. Our infrastructure provider (Cloudflare) may collect standard network logs (e.g., IP address, user agent) for security and operations. We do not use these logs for profiling or advertising. For receipt parsing, we transmit QR text or URLs and extracted page text to service providers solely to perform the feature, as described in Section 1.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at petar@radojicic.co or contact us by post at:

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

How to Make a Data Subject Request:

• 1. Email your request to petar@radojicic.co
• 2. Specify what information you need (access, correction, deletion)
• 3. We will respond within 30 days in accordance with applicable data protection laws

Note: Since your data is stored locally on your device, you can delete all data immediately using the "Reset Data" option in Settings.