Budgie BudgiePrivacy Policy
Budgie is a small app for logging what you spend and seeing it against a budget. Most of what it does happens entirely on your device. This policy says, plainly, what leaves it, when, and why.
The short version
- Signed out, nothing about you leaves your phone. Your purchases, categories, budgets, projects, notes and receipt photos stay on the device. The only things sent are requests for exchange rates, which carry no personal data, and, unless you turn them off, anonymous usage counts that can't tell us who you are.
- Signing in is optional. It is needed only for AI receipt reading, AI auto-categorising and sync across your devices.
- When you use sync, your data is stored under your account on Google's Firebase service, so your other devices can see it.
- When you use AI receipt reading, the receipt goes to OpenAI through our server, is read, and the answer comes back. We do not keep the image on our server.
- Purchases are handled by Apple. We never see your payment details.
- Anonymous usage statistics, which you can turn off. Once a day Budgie sends our server a few counts of how the app is used, like how many receipts were scanned and how sure the reader was. They carry no identifier and nothing you entered. They are on by default; Settings → Privacy turns them off.
- No ads. No tracking. There is no advertising or third-party analytics code in Budgie. We do not sell or share your data with anyone for their own purposes. This website sets no cookies; its only script is the beta sign-up form on the home page.
- You can delete everything from inside the app.
What Budgie stores on your device
Everything you enter: purchases (amount, currency, date, merchant, notes, the category or categories, the project, refund and split details), receipt photos you add, line items read from them, your categories and budgets, your projects, and your settings. The widgets read a small summary of your budget that the app keeps in a shared container on the device. Siri and Shortcuts log purchases through the app on the device. Receipts you scan without AI are read on the device and never leave it. Unless you turn the usage statistics off, the device also keeps the counts of the last few days until they are sent (at most 7 days).
This data is protected by your device's own security. It is included in your device backups according to your iPhone's backup settings.
When you sign in with Apple
You can sign in with your Apple ID. Apple tells us a stable identifier for you and, the first time only, your name and email address (which may be Apple's private relay address if you chose to hide your email). We use Google's Firebase Authentication to hold that sign-in. Your name is kept on the device to greet you; Firebase holds the identifier and the email Apple provided.
Signing in does not, by itself, upload your data. The features below do, and only when you use them.
Sync across devices (Premium)
With sync on, Budgie stores a copy of your purchases, categories, budgets, projects, line items and the refund and split details under your account in Google Cloud Firestore, and your receipt photos (reduced in size) and any exports or reports you choose to save to your account in Google Cloud Storage. This is what lets another device signed in to the same Apple ID show the same figures. The data is stored under your account and is accessible only to you through the app; our security rules allow a signed-in user to read and write their own data and nobody else's.
You choose where receipt photos live (on this device, in your account, or both) in Budgie's Settings.
Google processes this data for us as a service provider. It is stored in Google's data centres, which may be outside your country, including in the United States.
AI receipt reading and auto-categorising
Signed in, you can have a receipt read by AI: five times a month for free, and more with Budgie Premium. When you do, the app sends the photo (reduced in size), the text your device already read from it, the names of your categories and your currency to our server. The server checks that you are signed in and that you have a Premium subscription or free reads left this month, then forwards the photo and text to OpenAI, which reads the receipt and returns the merchant, date, total and line items. The server passes that answer back to the app and does not keep the photo or the text.
Auto-categorise (Premium) sends only the text of a receipt's line items, the merchant name and your category names, never the photo, and gets a category per line back the same way.
OpenAI processes this as a service provider under its API terms, which do not allow it to use the content to train its models. OpenAI keeps API content for up to 30 days, to provide the service and to detect abuse, and then deletes it.
To count free reads and to stop any one account costing more than it should, our server keeps a count of your AI calls per hour and per month under a hashed form of your account identifier. It keeps no content.
Exchange rates
To show amounts in your chosen currency, the app asks our server for today's exchange rates. The request carries only the base currency code, nothing about you, and the server fetches the rates from the European Central Bank (via Frankfurter) or ExchangeRate-API. The server limits how often a single network address may ask, using a hashed form of the address.
Anonymous usage statistics
Budgie counts how its features are used, so we can tell whether it does its two jobs well: for example, how many receipts are read on the device, how sure the reader was, and how often a field had to be corrected. Once a day, when you leave the app, it sends that day's counts to our own server. They never say who you are, and never anything about your money.
On by default, and you can turn them off: Settings → Privacy → Share anonymous usage statistics. With it off, Budgie records and sends nothing more (not even that you turned it off), and any counts not yet sent are deleted from the device at once. Settings → Privacy → What's sent lists them in the app. Signed in or not, the same counts are sent.
What is counted
- About the app: its version, the iOS version, iPhone or iPad, the app's language, your App Store country (the country of your App Store account, not where you are), whether it is a TestFlight or App Store copy, your plan (free, trial, monthly, annual, lifetime, or a subscription with a billing problem or that has ended), and roughly how long ago Budgie was installed, in ranges such as “8 to 14 days”.
- Active devices: whether this is the device's first report of the day and of the month, so we can count devices in use without giving any device an identifier.
- Logging: how each purchase was logged (keypad, scan, Siri or Shortcuts; from the app, a widget or Control Centre), which kinds of detail it had (a refund, a split, a project, a note, items, the calculator, another date or currency: yes or no, never what they were), roughly how many seconds it took from opening Budgie to Save, the first purchase after installing, which fields an edit changed, deletes and undos, and use of the Archive.
- Scanned receipts: which reader read it (on the device or AI) and, if AI reading fell back to the device, why; whether it was saved; how long reading took; how sure the reader was of the total, date, shop and currency (in tenths); which of those were marked Check, and which you changed or filled in before saving; taps on the photo to fill a field; whether the suggested category was kept and where the suggestion came from; how many item lines there were and whether they added up; how many line categories you changed; and how a shared bill was split (the method, never the amounts).
- The Premium screen: where it was opened from, how long it stayed open, how the visit ended (a purchase, a restore, cancelled at Apple's sheet, closed), which plan was chosen or bought, whether signing in was needed, and plan changes the app sees, such as a trial becoming annual.
- Prompts: the App Store review request (Rate, Not now or dismissed, and whether the support link was tapped), and the reminders after a lifetime purchase (the notice and what was tapped, whether notifications were allowed, which reminder was opened, and when the old subscription was seen cancelled).
- Features: which screens, Insights ranges and charts, History tools (never the search text) and exports you use, and whether you changed the budget on the first screen.
- Settings, once a day: the budget style and window, Simple view, the calculator, the reader and auto-categorise choices, whether sync is on, where photos are kept, whether any category is an essential, how many categories, category budgets, projects, purchases and currencies you have (in ranges), and which widget sizes and Control Centre button you have placed.
- Problems: scans that produced nothing, AI reading falling back, sync errors by kind, exchange-rate failures, and counts the device had to drop.
Times and numbers are sent in ranges (“3 to 4 seconds”, “3 to 5 lines”), never exactly.
Never sent
- Your name, email address or Apple ID, or any identifier: no account or device ID, no advertising identifier, no purchase token, no cookie, and nothing derived from one of them.
- Anything you entered: amounts (not even in ranges), budgets, shops, categories, projects, notes, items, search text, receipt photos or their text, or the currencies of your purchases.
- Your location, or any time more precise than the day. A day's events are merged and sorted on the device, so not even their order is sent.
Because nothing in the counts says which device sent them, two days from the same phone can't be joined, and what we count is devices, not people.
Your network address. Like any request over the internet, the daily upload comes from your network (IP) address. The statistics never store it: our server uses it only to limit how often one address can send, through a code that is replaced every day and deleted the next, and it is never kept with the counts. Until we switch off the web server's access log for this one address, that log records the upload like any other request (see Our server's logs) and deletes it after 14 days.
Where they are kept, and for how long. Securely, on QuaalCo's own server. The server adds each upload to that day's totals for all devices and discards it: only the daily totals are kept, and they are kept indefinitely, so we can compare how the app does over the years. No one else receives them. There is no analytics company or advertising code in Budgie, and only we read the totals, to decide what to fix and what to build next. On the device, counts wait at most 7 days to be sent.
Purchases and subscriptions
Budgie Premium is sold and billed by Apple through the App Store, as an auto-renewing subscription or a one-time purchase. Apple handles payment, renewal, cancellation and refunds under its own terms and privacy policy; we never receive your payment details. When you buy, Apple records an account token that the app derives from your sign-in; our server uses it only to confirm that the purchase belongs to the account making a request. We do not use it for anything else.
Managing or cancelling a subscription is done in your Apple ID settings, not in Budgie.
Beta sign-up on this website
If you sign up for the beta on this website, the form sends your name, your email address and, if you choose to say, where you heard about Budgie to our server. The server also records the time, your network address and your browser's name and version, to stop abuse. We use these only to email you the TestFlight link and news about the Budgie beta, and we send those emails through our email provider. Signing up does not create a Budgie account and is not connected to your data in the app.
Joining the test happens in Apple's TestFlight app, under Apple's own terms and privacy policy. Apple may share with us the email address you were invited with, your device model and iOS version, and any feedback, screenshots or crash reports you choose to send through TestFlight.
We keep your sign-up until the beta ends, then delete it. To have it removed sooner, email support@quaal.co.
Our server's logs
Like any web server, ours keeps standard access logs (the network address a request came from, the time, the path, the result code and the app or browser version the request names) for security and troubleshooting. These logs never contain receipt content, your data or your tokens, and are deleted after 14 days. The daily usage-statistics upload is logged the same way until we switch the log off for it. This website keeps the same kind of access log for the same period.
What we do not do
- We do not show ads.
- We do not use third-party analytics, advertising or crash-reporting services; Budgie's own anonymous usage statistics (above) go only to our server. Apple may share anonymised crash reports with us if you have opted in to sharing analytics with developers in iOS Settings.
- We do not track you across apps or websites, and we do not sell, rent or share your data with anyone for their own purposes.
- We do not read your data. It is yours.
Service providers
| Provider | What for | What they receive |
|---|---|---|
| Apple | Sign in with Apple; App Store purchases and subscriptions; TestFlight beta testing | Your Apple ID; payment; TestFlight feedback you choose to send |
| Private Email | Sending beta sign-up emails | Your name and email address, when you sign up for the beta |
| Google (Firebase) | Authentication; storing your synced data, receipt photos and saved exports | Your sign-in identifier and email; the synced data above |
| OpenAI | Reading receipts and categorising line items | The receipt photo and text, line-item text, merchant and category names, per request |
| The European Central Bank via Frankfurter, and ExchangeRate-API | Exchange rates | Nothing about you (our server asks on your behalf) |
Deleting your data
Delete account in Settings → Account removes everything Budgie holds for you: every record, receipt photo and saved export in your Firebase account, the sign-in itself, and all data on the device. It asks you to confirm with Apple first, because it cannot be undone.
Deleting your account does not cancel a Budgie Premium subscription. Only you can do that, in Settings → your name → Subscriptions; the app reminds you of this before it deletes anything.
You can also delete individual purchases and receipts in the app at any time, and signing out leaves your cloud data in place for when you sign back in.
Usage statistics: turning them off, or Delete account, deletes any counts not yet sent. Counts already sent are part of daily totals that can't be traced back to you, so they can't be picked out and deleted.
Children
Budgie is not directed at children under 13 and does not knowingly collect personal information from them.
Changes to this policy
If this policy changes, the new version will be posted at this address with a new effective date. Changes that affect what the app sends off your device will be described in the app's release notes.
Contact
Questions about this policy or your data: support@quaal.co.