Privacy policy

Summary

SmartBill is local-first. Your receipts are read and your assistant answers are produced on your phone. Receipt text, item lines, and assistant prompts are never sent to a third-party AI service.

All your financial records are fully encrypted (Encrypted) and cannot be read by any other party. Your records are stored in an encrypted database on your device; when sync is enabled, an encrypted copy is also stored in your own private cloud account so you can use more than one device and recover after losing a phone.

What we store

Account: email address, display name, and the sign-in provider you chose (email/password or Google).

Financial records you create or import: wallets, transactions, categories, budgets, goals, warranties, tags, recurring templates, receipts and their extracted fields, and assistant conversations.

Device data: a push notification token (only if you allow notifications), your app preferences, and a device identifier used to order sync changes.

Storage: "Save" in this app means secure encrypted storage on your device (local storage); when sync is enabled, an encrypted copy is also stored in your own private cloud account (cloud storage) — your data is never stored with any third party.

Receipt images

Recognition runs entirely on your device using models downloaded to the app. Images are not uploaded for processing.

Uploading receipt images to your account for backup is a separate setting you control in Account. When it is off, the image stays on the device and only the extracted fields sync.

Assistant

Every figure the assistant states is computed locally from your own records. When the on-device model is installed it only rewords those computed facts; when it is not, the app answers with the deterministic text and labels it as such.

Nothing about your finances is sent to a general-purpose chatbot or used to train any model.

Gmail import

If you connect Gmail, SmartBill requests read-only access and looks only for receipt-like messages in the date range you pick.

Message bodies are parsed on your device. Gmail message, part, and history identifiers are kept on the device and excluded from sync and from exports; you can disconnect at any time.

Diagnostics

Crash reports are sent only if a monitoring key is configured for the build. Reports carry the error type, a redacted message, and the stack trace. User identity, request bodies, breadcrumbs, and any extra context are stripped before sending, and receipt or financial content is never attached.

Your control

Export: Account → Export produces a portable ZIP with your data, spreadsheets, and readable local receipt files. Credentials, push tokens, encryption keys, device identifiers, and sync internals are excluded.

Delete: Account → Delete account removes your cloud records and the device copy. Removing data from this device only is a separate action that leaves the account intact.

Website analytics

The SmartBill website loads Google Analytics only after you grant analytics consent to measure visits, understand page usage, and improve the site. Google may process browsing and device data under its own policies.

We do not send financial records, receipt images, or assistant content to Google Analytics.

Retention and sharing

Your records remain in your encrypted storage (on your device or in your private cloud account) until you delete them or delete your account. SmartBill never sells your personal data and does not share it with advertisers or any third party for marketing purposes.

All your financial data is fully encrypted at rest and in transit, and no employee or external party can read its contents.

Processing relies on infrastructure providers — cloud storage for the account backend, Google for optional sign-in and Gmail import, Expo for push delivery — each of which only receives what is needed for that function, while your financial data remains encrypted.