Your data is yours. Period.

• Expense data (local only): amounts, dates, notes, categories, and user attribution are stored exclusively on your device. The App does not upload your expense data to our servers.
• Receipt photos (local only): if you scan or attach a receipt, the photo is stored privately on your device, where other apps can’t reach it. It never leaves your device unless you turn on receipt sync in Settings.
• Past choices for each store (local only): when you save an expense that came from a scan, BillPlex remembers the notes and category you kept so the next scan of the same store pre-fills them. This learning stays on your device.
• Settings & preferences: language, UI options, and budget settings are stored locally on your device.
• Information the App does not collect: names, email addresses, account credentials, precise location data, advertising identifiers, usage analytics of our own, or behavioral tracking data.
• If you email us: we receive your email address, your message and the technical details the App adds to it (app version, operating system, device model and, for sync questions, the sync status). You can read or delete these details before sending. We use them only to help you and keep them only for as long as that takes.

Data stored on your device is processed locally to provide the App’s core functionality, including expense tracking, insights, statistics, and optional import/export or local device-to-device sync initiated by you. Legal basis: the little that reaches us — the random codes used by automatic sync, our server’s technical logs and the emails you send us — is processed to provide the features you turn on and to answer you (Art. 6(1)(b) GDPR), and in our legitimate interest in keeping the service secure and free of abuse (Art. 6(1)(f) GDPR).

• Files (Import & Export): when you choose to import or export data, the App accesses only the files you explicitly select to read or write an encrypted backup.
• Local Network / Nearby (optional): for Wi-Fi sync between your own devices, BillPlex may use local connectivity frameworks. You control when syncing starts, which devices pair, and when it stops.
• Microphone & Speech Recognition (optional): used only when you choose voice input. The conversion of speech to text is performed by your device’s system speech recognition — Apple Speech on iOS and Google’s speech recognizer on Android. Depending on the device and language, this may send the audio to Apple’s or Google’s servers for processing, under their own privacy policies. BillPlex does not record, store, or send your audio to our own servers, and only the resulting text is used in the App.
• Camera (optional): used only when you tap the receipt-scan button on the amount field. We never run the camera in the background.
• Photo library / Picker (optional): used only when you choose to attach an existing receipt from your library instead of scanning a fresh one. We read only the photo you pick.
• On-device text recognition: receipt scanning runs Apple Vision on iOS and Google ML Kit on Android, entirely on your device. The receipt image and the recognised text never leave the device for our servers. Google ML Kit is a third-party SDK by Google; per Google ML Kit Terms, Google may receive anonymous diagnostic and usage statistics about ML Kit (not the image, not the text, not your expenses).

We do not collect your expense data on remote servers and do not sell, rent, or share it with third parties. If you export a backup or use local sync, the data you choose to transfer moves directly between your devices, or through a file you control, never through our servers. Receipt photos are not shared with other household devices by default; you can opt in via Settings → “Share receipt photos”, and even then the image only travels over the same encrypted local-network sync channel, only to devices you have paired. The App does not embed third-party analytics or advertising SDKs. Apple and Google may collect diagnostic or usage information at the platform level, including the limited ML Kit telemetry mentioned in Section 3, in accordance with their own privacy policies. We do not have access to this information. In-app purchases (BillPlex Pro): payments are processed by Apple or Google under their own privacy policies. We never receive your payment details, and the App checks the purchase on your device. To share BillPlex Pro with your household, paired devices exchange only the plan status (which plan, until when, whether it renews) over the same encrypted local sync — no payment or account details. Automatic sync (optional, off by default): when you turn it on, a silent signal sent through Firebase Cloud Messaging (Google) and the Apple Push Notification service wakes your devices so they can sync. Each request is checked with Firebase App Check, which confirms it comes from the genuine BillPlex app. It carries none of your data — only two random codes, one for the household and one for the device. The sync itself happens, as always, directly between your devices.

• On-device storage: data is stored in the App’s local database on your device.
• Backups: exported backup files are encrypted and protected with a PIN chosen by you. Keep your PIN safe — we cannot recover it.

All expense data remains under your control on your device. You can delete entries within the App, uninstall the App to remove local data, and delete any exported files you have created. For automatic sync, our server keeps one counter per household so it can limit abuse. It holds no personal data and is deleted automatically after 30 days. Our server also keeps technical logs for 30 days to find faults and stop abuse. They record when each request arrived and shortened versions of the household and device codes, and may also include the network (IP) address it came from. Our server runs in the European Union. Turning automatic sync off removes your device from the household signal.

We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable. Because we do not host or process your personal data on our servers, rights such as access, correction, deletion, restriction, or portability are exercised directly by you within the App by managing or deleting your data on your device. For the little that does reach us (Sections 4 and 6) and for emails you send us, you can exercise these rights by writing to us. You also have the right to lodge a complaint with a data protection authority: in Greece, the Hellenic Data Protection Authority (www.dpa.gr), or the authority of the EU country where you live.

BillPlex is designed for general household use and is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time to reflect improvements, legal requirements, or changes in the App’s functionality. The “Last updated” date will be revised accordingly.