Privacy

Your records stay yours. No ads. Nothing sold.

The short version

CostTabs collects no name or email. It has no advertising, and it does not follow you across other apps or websites. We do use PostHog, an analytics service, and we want you to know why: if you allow it, the app sends usage counts, such as which screens are opened and whether a scan worked, so we can see where CostTabs is confusing or breaks and fix it. They are stored in the EU. They carry a random number for your copy of the app, not your name, email or Apple Account. They never include your receipts, suppliers, amounts, card details or anything you type, and you can turn them off in the app's Settings, under Privacy.

Your receipts, invoices, suppliers, prices and claims are kept on your iPhone, and the photos are copied to your own iCloud Drive. On Pro or Business, with iCloud sync turned on, your records are kept in your own iCloud too. We do not have a copy.

Two ways of reading a receipt or invoice send it off the phone, and only when you choose them: your own OpenAI key, and server reading. This page says exactly what each one sends and to whom.

When a document does go to our server and its AI provider, or to OpenAI on your own key, it is for one purpose only: to read it, so the app can work. We do not keep it, we do not sell it, and we do not use it for anything else.

The camera, photos and files

CostTabs asks for the camera so you can photograph a receipt or invoice. That is the only reason. You can also pick a photo from your library, load a PDF from Files, or share a document into the app from Mail, Files, Safari or Messages. The page images are saved with the record as clear copies, never edited, so you can look back at them.

Where your data lives

On your iPhone. Receipts, invoices and their pages, suppliers, products and their price history, agreed prices, claims, trips and your settings are stored on the device. Our server never receives a saved receipt or invoice.

iCloud sync (Pro and Business)

iCloud sync is off until you turn it on in the app's Settings, and it comes with Pro and Business. When it is on, your receipts, invoices, suppliers, claims and trips are kept in your own iCloud, under your Apple Account, so every iPhone signed in to it has them all. Apple stores them under its own iCloud terms. They go straight from your iPhone to your iCloud: they never pass through our server, and we cannot see them. Turning sync off, or a plan ending, stops the copying and keeps everything on the phone.

Your iCloud backup

CostTabs copies the original photos of your receipts and invoices to a CostTabs folder in your own iCloud Drive, under your Apple Account. You can open it in the Files app. Apple stores it under its own iCloud terms. We cannot see it, and it never passes through our server. If iCloud Drive is off, nothing is copied.

If the phone is lost, the photos are still in your iCloud. The exports for your accountant are another copy you control.

Reading on your iPhone

On an iPhone with Apple Intelligence turned on (iPhone 15 Pro and later), the receipt or invoice is read and sorted on the device. Nothing is sent to us or to anyone else.

Your own OpenAI key

If you choose to add your own OpenAI key, the app asks first and then, for each document:

• sends the text found on it, up to three page photos, and the names of the products you already keep for that supplier;
• sends them straight from your iPhone to OpenAI, using your key;
• never sends them to us. We do not see, store or touch any of it.

Your key is kept in your iPhone's keychain and is sent to nobody but OpenAI. OpenAI's privacy policy covers what OpenAI receives.

Server reading

Server reading, called CostTabs Reader in the app, sends a document to our server and its AI provider, OpenAI, only to read it. Each copy of the app can use it five times for free. After that, it is part of a paid plan. Free or on a plan, the first time it would send a document, the app stops and asks you, names what will be sent and who receives it, and you can say no. Without that yes, the app does not send anything.

When you say yes, for each document:

• up to three page photos, the text read from them on your iPhone, and the names of the products you already keep for that supplier are sent to the CostTabs server, and from there to OpenAI, to be read;
• they are used only to read this document so the app can show it to you. Our server holds them only while the reading takes place. It does not store them, does not log them, and drops them as soon as the lines come back;
• OpenAI does not use what it receives through its API to train its models. It may keep it for up to 30 days to watch for abuse, then deletes it. OpenAI's privacy policy covers the rest.

What our server keeps

Our server keeps no receipt, no invoice, no photo, no text and no answer. It keeps:

• a random number for your copy of the app, and the public half of a key your iPhone made, so the server can tell a request really came from your iPhone;
• a scrambled, one-way version of your Apple subscription number, which the server cannot turn back into you;
• how many of its five free reads your copy of the app has used, kept against that random number so the free reads are given once, and shown back to the app so it can tell you how many are left;
• on a paid plan, how many documents you have sent to server reading this month, so it can apply your plan's monthly limit, and small counters that stop one phone sending too much too fast;
• a note if Apple tells us a subscription has ended or was refunded;
• one log line for each request: the date, that random number, what was asked for, whether it worked, how long it took and how large it was. No photo, no text and no IP address.

How long each is kept:

• the random number and its key, and the count of free reads used: for as long as the service runs, so the free reads are given only once. They stop being used the day the app is deleted from your iPhone;
• the monthly count: about 40 days;
• the small speed counters: about 2 hours;
• the note about an ended or refunded subscription: about 1 day;
• the log lines: as long as our hosting company keeps its logs.

Our own code does not record your IP address. The company that hosts our server may keep ordinary connection logs of its own for a short time. We do not use them.

Your scans

The app counts your scans on your iPhone, so it knows how many you have left. The count of your five free scans is kept in the iPhone's keychain, so they are given once. The counts themselves stay on the phone. If you allow usage counts, the app sends only that a scan was used and a rough range of how many are left (such as “6 to 20”).

Usage counts

Usage counts tell us which parts of CostTabs are used and where it goes wrong, so we can make it better. They are sent only while Settings, Privacy, “Share usage data” is on.

What is sent:

• small events such as “a scan was started”, “a scan was read” or “failed”, “a record was saved”, “a tab or screen was opened”, “an export was made”, “the plans were shown” and “a plan was bought”;
• with each one, only yes or no answers and words from a fixed list in the app (for example which way the document was read, or why a read failed). Numbers go in rough ranges, such as “2 to 5”, never the exact figure;
• a few labels: your plan, the business country set in the app, the App Store country in broad groups, whether the phone has Apple Intelligence, the app and iOS versions and the phone model;
• a random number made for your copy of the app, so events from one copy can be counted together. It is not your Apple Account, not Apple's device or advertising number, and it is never joined to your name, your email, our server's number for your copy, or a purchase.

What is never sent: anything on a receipt or invoice, supplier or business names, tax numbers, invoice numbers, amounts, card details, email addresses, photos, anything you type, or the text of an error. PostHog is told not to work out a location from your IP address and not to keep the address, and the app does not record taps on the screen, screen recordings or crash reports.

Where and for how long: PostHog keeps them in its EU region, in Frankfurt, for up to 12 months. PostHog is a US company, and its staff and the companies it uses may handle them from outside the EU, including in the United States. PostHog handles them only on our instructions.

Why: to improve CostTabs. In the UK and the EU, the lawful reason is our legitimate interest in seeing how the app is used, which you can object to at any time with the switch. Usage counts are never used for advertising, never sold and never used to build a profile of you.

Your choice: when you first open the app, the “Help improve CostTabs” row shows the switch. It starts on for App Store accounts in Australia, the UK and the US, and off everywhere else. Change it there, or any time in Settings, under Privacy. Turning it off stops new usage counts at once; a few made just before may still be sent.

To have the usage counts from your iPhone deleted, open Settings, Privacy, “Show my usage ID”, and email that ID to support@supplierfolio.app. Without it we cannot tell which counts are yours. You can also complain to the privacy regulator where you live: the OAIC in Australia, or the ICO in the UK.

Claims you send

When you send a claim to a rep, the app writes the message and hands it to your own Messages, Mail or share sheet. You choose who receives it. It does not pass through us.

Subscriptions

CostTabs plans are billed by Apple. Apple takes the payment and gives the app a signed receipt that says which plan you bought and when it ends. We receive no name, no email address and no card detail, and we do not ask for one. With server reading on a plan, the app shows that receipt to our server so it knows you subscribe. A free read sends no receipt. Our server never learns who you are. Apple's own privacy policy covers the purchase.

Third parties

PostHog (EU) for usage counts, if you allow them. No advertising kit, no crash reporter. Beyond the storage on your iPhone, the app talks to Apple for purchases, for your own iCloud Drive backup, for iCloud sync if you turn it on, and to prove a server request came from a real copy of the app, and, only in the cases you choose, to OpenAI with your own key, or to our server and OpenAI with server reading.

The App Store privacy label

Apple counts data as collected when it is kept longer than it takes to answer a request. By that rule, server reading collects a few things, and the label says so: the document photos and text you send (OpenAI may keep what it receives for a time under its own policy), the random number for your copy of the app, how many free reads it has used, your scrambled subscription number, your monthly count and one log line per request. All are used only to make server reading work. If you allow usage counts, the label also lists them for analytics: how the app is used, a few other usage details, failure reasons, the random number for your copy of the app, and the plan bought. None of it is linked to who you are and none is used for tracking or advertising.

Children

CostTabs is a business tool, not made for children. We do not knowingly collect anything from children, and nothing we collect, including usage counts, says who anyone is.

Deleting your data

Delete a receipt or invoice in the app and it is gone from the phone. Its photo stays in your iCloud Drive backup until you remove it there, in the Files app, because records are often needed for years. Delete the app and the data on the phone goes with it. Your OpenAI key, if you entered one, can stay in the iPhone's keychain: clear it in the app's Settings before you delete the app. With iCloud sync on, deleting a record deletes it from your iCloud too, but deleting the app does not: the records stay in your iCloud until you delete CostTabs' data in the iPhone's Settings, under your name, iCloud, then storage. There is no copy of a document for us to delete, because we never kept one.

To stop server reading, choose another way of reading in the app's Settings, under Reading, or simply don't choose it when you scan. Nothing more is sent to our server. To stop your own key, turn it off or remove it in Settings, Advanced. To stop usage counts, turn off “Share usage data” in Settings, Privacy.

What our server keeps holds no name or email and nothing that says who you are, so we cannot look up one person's record. Deleting the app makes its key unusable, and its record is never used again. For any other privacy request, write to support@supplierfolio.app and we will help as far as the records allow.

Changes

If this policy changes, the new version is posted here with a new date. We cannot notify you directly, because we do not have your contact details.

Who we are

CostTabs is published by Coffee Alchymists Pty Ltd, Australia. Questions about privacy go to support@supplierfolio.app.