Privacy

The short version

• Billy never asks for your bank login or card details. Payments go through Apple.
• What you log is stored on our servers so Billy can do the math.
• To understand what you type, say or snap, Billy sends it to AI models run by other companies (through OpenRouter and DeepInfra). The app asks your permission before it sends anything.
• If you allow location, the app sends your approximate location (rounded to about 1 km) and country to our servers, and we keep it in our logs for 7 days.
• We use PostHog and Sentry to see how the app is used and to catch crashes. They know you only by an internal account ID, and you can turn analytics off in Settings → Privacy.
• Our team can look at individual accounts, and can sign in as you to help with problems.
• We don't sell your data, and there are no ads.
• You can export your entries or wipe them at any time, and delete your account in the app under Settings → Account → Delete Account.

What we collect

• Your account: your name and email, plus your password (stored as a one-way hash, never in plain text). If you sign in with Google, Google shares your name, email and profile picture with us. If you add a profile photo, we store it.
• What you log: every entry, including the exact words you typed or said, the amount, category, date and note, and any receipt or price photo. We also store your budgets, bills, income, savings pots, trips, goals, categories and settings such as your currency and timezone. When you correct an entry, we keep the earlier version so you can undo.
• Device and connection details: your IP address, the rough location our hosting provider works out from it (city, region and country), your timezone, language and region settings, and your device and app version. If you turn on reminders, we store your device's push notification token.
• Location, if you allow it. More on this below.
• Feedback you send: your message, any screenshot attached to it (the three-finger shortcut attaches one of your current screen), and details that help us debug: your account ID and email, device model, iOS and app version, language, timezone, battery and network state, and your approximate location if you've allowed it.
• Your subscription: whether you have Pro, and its purchase and renewal history.

Location

Location is optional, and BillyPocket works fine without it. If you allow it when iOS asks, here's what happens:

• When you use the app, it sends your approximate location, rounded to about 1 km, and your country along with its requests to our servers.
• We use it for travel mode, to work out which currency you're probably spending in, and for service diagnostics, like spotting problems that only affect one region.
• We keep it in our request logs for 7 days, next to your IP address, then it's deleted automatically.
• If you send us feedback, the report includes your approximate location, and feedback is kept longer (see below).
• Your phone uses your location to notice when you've arrived in a new country and offer to start a trip. It asks Apple's location service which country you're in.
• We don't use your location for anything else, including ads or Billy's AI. Our team can see your recent approximate locations, including on a map, in our admin dashboard.

Even without location permission, our servers see your IP address and our hosting provider estimates a city and region from it. We log that for 7 days too.

To stop sharing location, turn it off for BillyPocket in your iPhone's Settings app. The Location row in BillyPocket's settings takes you straight there.

How Billy reads your entries

Our servers handle some simple entries with plain rules. Everything else goes to AI models run by other companies, through OpenRouter, a service that connects us to AI models:

• Typed and spoken entries usually go to a model called Jev first.
• Photos, and entries Jev can't handle or isn't sure about, go to Google's Gemma. If that doesn't work, they go to Anthropic's Claude Sonnet.
• OpenRouter may pass a request to any of several companies that host the chosen model.
• If OpenRouter can't be reached, we fall back to Gemma hosted by DeepInfra.

Here's what these companies receive, and why:

• The text of your entry, so Billy can work out the amount, category and date.
• Receipt and price photos you attach, so Billy can read the total.
• What you say, once it's text. When you speak an entry, your iPhone turns it into text using Apple's speech recognition (Apple may do that on its servers, depending on your device and language). The app never sends us the recording, only the text.
• A little context so Billy gets it right: your category names, savings pot names, currencies, timezone, language setting and today's date, plus the entry you're changing if you're correcting one.

We don't add your name, email or account ID, but whatever you write, say or photograph is sent as it is, so a receipt with your name on it includes your name.

Before Billy sends anything to these companies, the app explains what's shared and asks for your permission.

Whether these companies keep or learn from what we send depends on their own terms and settings, so we can't make promises on their behalf. We don't train any AI models on your data ourselves.

Analytics and crash reports

• PostHog (product analytics) records events like opening the app and moving through setup. It also records how you use the app as screen recordings, called session replays. Replays are set to hide text and images on screen, including what you type and your amounts, so they show where you tapped rather than what you logged. They also note which of our web addresses the app called and how long each call took.
• Sentry (crash reporting) gets a technical report when something goes wrong. It includes your device details and what the app was doing (including which of our web addresses it was calling). Screenshots in crash reports are turned off. Sentry also gets performance timings from some sessions.

Both identify you only by an internal account ID, never by your email or name. Both are US-based services. You can turn analytics off any time in BillyPocket's Settings → Privacy.

Companies that help run BillyPocket

• Cloudflare runs our servers and this website, sends our emails (like welcome messages, password reset codes and waitlist confirmations), and stores receipt photos, profile pictures and feedback screenshots. We send email with Mailflare, mail software we run on our own Cloudflare account.
• Neon hosts our database, in Amazon Web Services' US East (Virginia) region.
• OpenRouter, the AI companies it connects to, and DeepInfra read your entries as described above. DeepInfra also transcribes voice notes you send Billy on Telegram or WhatsApp.
• PostHog and Sentry handle analytics and crash reports.
• Apple handles payments and push notifications, and may handle speech-to-text and working out which country you're in.
• RevenueCat keeps track of your subscription. It gets your account ID, the name you give Billy during setup, and your BillyPocket purchase history.
• Google, only if you sign in with Google.
• Telegram and WhatsApp, only if you message Billy there.

Who can see your data

Other BillyPocket users can't see your data.

Our team can. People on our team with admin access can open an individual account in our internal dashboard and see its details, including your entries (with the exact text you typed), budgets, income, pots and trips, feedback you've sent, messages you've sent Billy on Telegram or WhatsApp, recent activity with IP addresses and locations, and your full-size profile photo. They can also sign in as you, for up to 4 hours at a time, to see what you see. This is there so we can help with support requests and fix problems.

How long we keep things

• Your account, entries, budgets and settings stay until you delete them or delete your account.
• Receipt photos and profile pictures currently stay in storage even after you delete the entry or use Start Fresh. Deleting your account removes them, or email us and we'll remove them.
• Request logs, which include IP addresses and your location if you've allowed it, are deleted after 7 days. Error logs are deleted after 30 days.
• Logs of Telegram and WhatsApp messages, and short-term records we keep so the same entry isn't saved twice, are deleted after 90 days.
• Feedback reports and the history of reminders we've sent you stay until you delete your account.
• Copies of the emails we send you are kept in our mail system until you ask us to delete your account.
• PostHog and Sentry keep data according to their own retention settings.

Your controls

• Export: in Settings, export a CSV or JSON file of your entries, recurring bills and income sources for any date range. It doesn't include budgets, savings pots, trips or receipt photos. Email us if you need those.
• Edit or delete any entry whenever you like.
• Start Fresh: in Settings, tap your name, then Start Fresh. This permanently deletes your entries, recurring bills, budgets, goals, income sources, savings pots and trips, and resets your categories. Your account, login and settings stay, and receipt photos currently do too.
• Delete your account: in Settings, go to Account → Delete Account. This permanently removes your account, entries, budgets, savings pots, trips, receipt photos, profile photo, feedback and settings, and it can't be undone. You can also email hi@billypocket.com from the address you signed up with and we'll do it for you. Deleting your account doesn't cancel a BillyPocket Pro subscription; cancel that in your App Store account settings.
• Analytics: turn PostHog and Sentry off in BillyPocket's Settings → Privacy.
• Location and notifications: turn them off any time in your iPhone's Settings app.

This website

billypocket.com doesn't use analytics or tracking cookies.

If you join the waitlist, we store your email, which signup form you used and the page that linked you here, and send you an email to confirm. Email us to be removed.

If you try Billy on the homepage, what you type is sent to our servers with your timezone and read by the same AI models the app uses, apart from Claude Sonnet. It's never saved as an entry. If you use the microphone, your browser turns your voice into text first, and some browsers do that on their maker's servers.

Like every request to our servers, these are logged with your IP address and approximate location for 7 days.

Telegram and WhatsApp

You can also log spending by messaging Billy on Telegram or WhatsApp. Those messages pass through Telegram or WhatsApp under their own privacy terms, and are read by the same AI models as the app. We store what you send as entries tied to your Telegram ID or WhatsApp phone number, separate from any app account. Photos are stored like receipts, and voice notes are turned into text by DeepInfra. We also keep a log of the messages you send for 90 days.

How it's protected

Everything between your phone or browser and our servers travels over encrypted HTTPS connections, and so does everything we send to the companies above. Our database and file storage providers encrypt the data they store.

What we don't do

We don't sell your data or share it with advertisers. There are no ads in BillyPocket, and the app doesn't track you across other companies' apps or websites.

Changes

We'll email you before any change that could affect your data. No fine-print surprises.

Questions

Email hi@billypocket.com.