Privacy Policy.

AnytimeBudget (the “Service”) is designed so that your financial records remain on your device. This Privacy Policy explains the limited circumstances in which data leaves your phone, where it goes, how long it lasts on our side, and the rights you have in relation to it.

01.Overview

• Your transaction history is stored locally on your device. We do not maintain a copy on our servers.
• AI-assisted features stream your request through our backend to a third-party AI model. The response is streamed back. No copy of the request or response is written to our storage.
• We do not retain usage logs, request histories, quota counters, or any per-user records.
• We do not use your data to train any model.
• We do not sell your data, serve advertisements, or use third-party trackers on this website.

02.Data we process

2.1  Data stored on your device

Transactions, accounts, categories, budgets, receipt images, voice recordings, settings, and locale preferences are stored locally in the application. We have no access to this data unless you actively transmit it through an AI-assisted feature.

2.2  Data processed in transit

When you invoke an AI-assisted feature, the following items pass through our backend on their way to the AI provider:

• The receipt image, audio clip, text, or document you submitted.
• The base currency code requested for exchange-rate lookups.
• A device-generated request identifier transmitted in the X-User-ID header. The identifier is anonymous, is used only for the duration of the request, and is not stored.

These items reside in our backend's memory only for the lifetime of the request. They are not written to any database, object store, log file, cache, or other persistent medium.

2.3  Data we do not collect

• Your name, email address, telephone number, or any other contact identifier.
• Precise location, contacts, calendar, or any other device data not strictly required by a feature.
• Behavioural analytics or web tracking on this website.
• Persistent records of your AI requests, responses, or usage patterns.

03.Legal basis for processing

Where applicable data-protection law requires us to identify a legal basis, we rely on the following:

• Performance of a contract — to provide the Service you requested, including the transient processing of AI requests.
• Legitimate interests — to operate, secure, and maintain the Service, in a manner that does not override your rights.
• Consent — where you have provided it, such as by initiating an AI-assisted feature.

04.Purposes

We process the in-transit data described above for the following purposes only:

• To produce a structured result from the AI request you submitted.
• To return current foreign-exchange rates for the base currency you specified.

We do not use your data for analytics, model training, advertising, profile-building, or any other purpose.

05.Third-party processors

We share only what is strictly necessary to deliver each feature. Requests sent to third-party processors do not include your name or any persistent identifier.

• Google Firebase (Cloud Functions, Hosting) — provides our backend infrastructure. Firebase does not store AI request payloads on our behalf. Subject to Google's Privacy Policy.
• AI model providers — depending on the request, one of OpenRouter, xAI, Alibaba Cloud, or Perplexity receives the submitted payload to perform the extraction. Each provider's own retention, training, and security policies apply to data they receive.
• ExchangeRate-API — receives only a base currency code (no personal data) and returns exchange-rate tables. See their terms.
• Apple App Store / Google Play — process subscription billing if you upgrade to Plus or Pro. We receive only the receipt metadata necessary to unlock your subscription.

06.Retention

We do not retain your AI request data. Each request streams through our backend, is forwarded to the AI provider, and the response streams back to your device. No copy of the request, the response, the image, the audio, or any intermediate state is written to our storage.

Subscription receipts held by Apple or Google for billing purposes are retained by those platforms under their own policies, not ours.

07.Security

All traffic between the application and our backend is encrypted in transit using TLS. Credentials for third-party AI providers are held in Google Cloud Secret Manager and are not accessible from outside the server. Because no AI request data is written to disk on our side, there is no AI-request data store that could be compromised.

No system is perfectly secure. We follow reasonable industry practices but cannot guarantee that data in transit is never intercepted, or that infrastructure on which we depend is never compromised. The security and retention practices of third parties are governed by their own policies.

08.Your rights

Depending on the jurisdiction in which you reside, applicable data-protection law may grant you rights including:

• Access — to obtain a copy of the personal data we hold about you.
• Rectification — to correct inaccurate personal data.
• Erasure — to request deletion of personal data.
• Restriction — to limit how we process your personal data.
• Portability — to receive your personal data in a structured, machine-readable format.
• Objection — to object to processing based on our legitimate interests.
• Withdrawal of consent — at any time, where processing relies on consent.

Because we do not retain your AI request data, there is no server-side record for us to provide, correct, port, or delete. The same rights extend to data on your device, which you can exercise directly:

• Delete individual records in-app, or clear all data from Settings.
• Uninstall the application to remove every record at once.
• Subscription billing records are administered by Apple or Google under their respective policies.

09.Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has used the Service, please take appropriate steps to remove the application from the device.

10.International transfers

Our backend operates from Google's asia-east2 region (Hong Kong). The third-party AI providers and rate services listed above may process data in other jurisdictions, including the United States, the United Kingdom, mainland China, and the European Union. By using AI-assisted features, you acknowledge that the in-transit payload may cross these borders during the request, even though no copy is retained on our side.

11.Changes to this Policy

We may update this Privacy Policy from time to time. The version in force is the one displayed at this URL; the “Effective” and “Last updated” dates above reflect the current version. For material changes, we will provide notice within the application before the change takes effect.

End of document · Vol. I