Privacy Policy
1. Who we are
Siaupoa (“the App”) is developed and operated by Goodsvalu Inc. (“we”, “us”). For any privacy question, contact support@goodsvalu.com.
2. What stays on your device
The App is local-first. All of the following is stored in a database file on your phone and is never uploaded to us:
- Ledgers, accounts, categories and budgets
- Every transaction — amount, date, merchant, notes, currency
- Your app settings, including your display language and currency
- Reminder schedules (all notifications are scheduled locally on the device; the App does not use push notifications and never registers a push token)
Backups are produced on demand and handed to your operating system’s share sheet. Where a backup file goes — your own cloud drive, email, or local storage — is entirely your choice. We never receive it.
3. What is sent off the device, and when
Nothing leaves your device unless you do something that needs it. There are three cases, and no others:
| You do this | What is sent | To whom |
|---|---|---|
| Take or pick a receipt photo and confirm | The image, resized and re-encoded as JPEG on your device before it is sent | Our server, then the AI provider |
| Type or dictate a description and tap submit | That text | Our server, then the AI provider |
| Open Reports or Settings, open the subscription screen, or sign in | An identifier, and the question “does this person have a subscription?” | Our subscription provider |
The first two happen only after you have given consent on the in-app consent screen, and only for the recognition you just asked for. The request also carries the names of your expense categories, so the AI can pick one that already exists in your books, plus today’s date, your app version and a random one-time request identifier.
The third is deliberately not covered by the AI consent screen, because none of your content is involved: no photo, no text, no transaction, not even your email address. What is sent is an identifier — your account identifier once you have signed in, or one the subscription provider generates for the installation if you have not — so that the App can find out whether you are subscribed. Until the App needs that answer it does not contact the subscription provider at all, so launching the App, entering transactions and reading your books contact nobody.
Photos
- A photo is never written to permanent storage and is never displayed anywhere in the App.
- Before sending, the image is resized, re-encoded, and its metadata segments (EXIF, XMP, IPTC and comments) are explicitly removed — not left to the re-encoding step to discard. That metadata is where a camera records GPS coordinates, so location data is not transmitted. Our server checks every image it receives and raises an alert if any metadata survived.
- As soon as recognition finishes — whether it succeeded or failed — the temporary file is deleted from your device.
Voice
The App has no speech-recognition component and requests no microphone permission for this purpose. When you “speak” an entry you are using your phone keyboard’s own dictation button, which is a function of your operating system. The App only ever receives the finished text. No audio is ever recorded, accessed or transmitted by the App.
4. What our server stores
Requests pass through our own server before reaching the AI provider, so that we can count usage and keep costs under control. That server keeps no content. Its database has no column capable of holding an image or any text you wrote — this is a structural guarantee, not just a promise.
| Stored | Why |
|---|---|
| Your email address and an account identifier | To keep your monthly free allowance attached to you rather than to a device |
| Number of recognitions used this month, stored against the hashes below rather than against your account | Enforcing the free allowance. Storing it against the hashes is what stops the allowance resetting each time an account is deleted and recreated. |
| Per-request: timestamp, whether it was a photo or text, success or failure, token counts, cost, response time, model name, app version, a one-time request identifier | Cost accounting, abuse detection, debugging |
| Your subscription level and the date it expires | The monthly AI allowance depends on it. Your phone cannot simply tell our server that it is entitled to a larger allowance — the server asks the subscription provider directly and stores the answer. |
| A one-way, salted hash of your email address and of a device identifier — the hash only, never the address or the identifier itself | So the monthly allowance, and the larger first-month allowance, follow the person rather than the account. Without this, deleting the account and signing up again would hand out a fresh allowance every time, which we would ultimately pay for. |
5. What we never collect
- No name and no phone number
- No password — signing in uses a one-time code sent to your email, so there is nothing to store and nothing to leak
- No contacts, calendar, location or photo library contents
- No advertising identifiers; there is no advertising in the App. The App does read one device identifier provided by your operating system (Apple's vendor identifier, or Android's SSAID), used only to stop the free allowance being claimed over and over. It is not used for advertising or for tracking you across other apps or websites, and it is never sent to Anthropic — our own server hashes it and keeps only the hash. Separately, our subscription provider generates an identifier of its own for this installation, so that a subscription can be matched back to the right person. That one is never combined with the hash above, and is likewise never used for advertising or for tracking you elsewhere.
- No analytics or crash-reporting SDK of any kind is included in the App. The one third-party SDK we do include is our subscription provider’s, and purchase and renewal events do appear on their dashboard — see section 7
- No financial account credentials — the App does not connect to any bank
6. Your account
AI recognition requires an account. You sign in with an email address and a one-time code we send to it — there is no password. Everything else in the App works without an account.
The account exists for one purpose: to keep your monthly free allowance attached to you rather than to the device. Tying it to the device meant a reinstall handed out a fresh allowance, which we would ultimately have to pay for. Your email address is not used for marketing, and we do not send you anything other than sign-in codes. A credential for the session is held in your device’s secure keychain.
7. Third parties
| Who | What they receive | Where |
|---|---|---|
| Anthropic PBC | The receipt photo or text you submit, and your category names | United States |
| Our email delivery provider | Your email address, in order to deliver your sign-in code | See their privacy policy |
| RevenueCat (our subscription provider) | An identifier for this installation or for your account, and the fact that a subscription was started, renewed, cancelled or expired. Never your email address, and never anything from your books. | United States |
| Supabase (our hosting and authentication provider) | The usage records in section 4. Photos and text pass through in memory and are not stored. | Servers located in Tokyo, Japan |
Anthropic processes your submission to produce the extracted amount, date and merchant. Under Anthropic’s commercial API terms, inputs submitted through the API are not used to train their models. Anthropic’s own handling and retention are governed by their privacy policy at anthropic.com/legal/privacy.
We never see your payment details. Subscriptions are charged by the app store — Google Play or Apple — and your card or payment method stays with them. It does not pass through us, and it does not pass through RevenueCat.
We do not sell or share your data with anyone else, for any purpose.
8. International transfer
We are established in the United States. If you are located outside the United States, submitting a photo or text for AI recognition transfers that content to the United States for processing by Anthropic PBC. You are told this on the consent screen before the first transfer, and this transfer only happens because you chose to use the feature. The usage records described in section 4 are held on servers in Japan and are accessible to us in the United States.
9. Legal bases (EEA/UK users)
- Consent — for sending photos or text to the AI provider. You give it on the consent screen and may withdraw it at any time in Settings → Privacy, with no effect on the rest of the App.
- Legitimate interests — for the usage records in section 4, to enforce the free allowance, detect abuse and keep the service financially sustainable.
10. Retention
- Photos and text: not retained by us at any point. Held in memory only for the duration of the request.
- Per-request usage records: kept while your account exists.
- The allowance hashes, and the count of recognitions used in the current month: kept even after you delete your account. That is deliberate — deleting them would defeat their only purpose, which is to stop the allowance being reset by deleting and recreating an account. The hashes cannot be turned back into your email address or device identifier, the count is a single number, and neither is used for anything else. The monthly count is discarded when the month ends.
- Your subscription record: kept while your account exists, and deleted together with it. An expired record is kept until then rather than removed, so that we can answer questions about a past subscription.
- Your bookkeeping data: kept on your device until you delete it. We cannot access it and cannot delete it for you.
11. Your rights and controls
- Withdraw AI consent: Settings → Privacy → AI Recognition & Data Processing. Nothing is sent afterwards.
- Delete your account: Settings → About & Support → Delete Account. This permanently deletes your account, your email address and the per-request usage records described in section 4, with one deliberate exception: the one-way hashes, and this month's recognition count stored against them, are kept — otherwise deleting and recreating an account would simply reset the allowance (see section 10). It does not delete the books on your phone, because we cannot reach them, and it does not cancel a paid subscription — subscriptions belong to your Google Play or Apple account, so cancel one there.
- Delete your local data: Settings → Data → Reset, or simply uninstall the App.
- Export your data: Settings → Data → Backup produces a complete database file; transaction lists can also be exported as CSV, Excel or PDF.
- Access, rectification, objection: since we hold no personal content, these mostly apply to the usage records — write to support@goodsvalu.com.
12. Children
The App is not directed at children under 13 (or the minimum age of digital consent in your country) and we do not knowingly collect data from them.
13. Changes to this policy
If we change how data is handled in a way that affects you, we will update this page and, where the change concerns AI processing, ask for your consent again inside the App rather than relying on your previous agreement.
14. Contact
隱私政策
1. 我們是誰
Siaupoa(以下稱「本 App」)由 Goodsvalu Inc.(以下稱「我們」)開發與營運。 隱私相關問題請聯絡 support@goodsvalu.com。
2. 留在你裝置上的資料
本 App 以本機為主。以下全部存在你手機裡的資料庫檔案,從不上傳給我們:
- 帳本、帳戶、分類與預算
- 每一筆交易——金額、日期、商家、備註、幣別
- 你的 App 設定,包含顯示語言與幣別
- 提醒排程(所有通知都在裝置本機排程;本 App 不使用推播通知,也從不註冊推播 token)
備份檔是你按下按鈕才產生,並交給作業系統的分享面板。檔案最後去哪裡——你自己的 雲端硬碟、信箱、或本機儲存空間——完全由你決定,我們不會收到。
3. 什麼情況下會送出資料
除非你做了需要送出資料的事,否則不會有任何東西離開你的裝置。就三種情況,沒有別的:
| 你做的動作 | 送出的內容 | 送給誰 |
|---|---|---|
| 拍照或選相簿照片並確認 | 該圖片(在你的裝置上先縮小並重新編碼成 JPEG 才送出) | 我們的伺服器,再轉送 AI 服務 |
| 輸入或口述一段描述後按送出 | 那段文字 | 我們的伺服器,再轉送 AI 服務 |
| 開啟「報表」或「設定」、開啟訂閱畫面,或登入 | 一個識別碼,以及「這個人有沒有訂閱」這個問題 | 我們的訂閱服務商 |
前兩種必須你已經在 App 內的同意畫面上同意過才會發生,而且只針對你當下要求的那一次 辨識。請求另外會帶上你的支出分類名稱(讓 AI 從你已有的分類裡挑一個)、今天的日期、 App 版本,以及一個隨機的一次性請求識別碼。
第三種刻意不受 AI 同意畫面的管轄,因為它完全不涉及你的內容:沒有照片、 沒有文字、沒有任何一筆交易,連你的電子郵件位址都沒有。送出的是一個識別碼——你登入之後 就是你的帳號識別碼,還沒登入的話則是訂閱服務商自己為這次安裝產生的一個——目的只是讓 App 問出「你有沒有訂閱」。在 App 需要這個答案之前,它完全不會連線訂閱服務商;所以 開啟 App、記帳、看自己的帳本,不會連到任何人。
照片
- 照片絕不寫入永久儲存空間,也絕不在 App 的任何畫面顯示。
- 送出前會先縮小、重新編碼,並主動移除中繼資料區段 (EXIF、XMP、IPTC 與註解)——不是交給重新編碼順便處理。相機記錄 GPS 座標的 位置就在那些區段裡,所以不會傳送位置資訊。我們的伺服器會 檢查每一張收到的圖片,一旦還殘留中繼資料就發出警報。
- 辨識一結束——不論成功或失敗——暫存檔立刻從你的裝置刪除。
語音
本 App 沒有任何語音辨識元件,也不為此請求麥克風權限。你「口述」記帳時用的是手機 鍵盤自己的聽寫按鈕,那是作業系統的功能。本 App 從頭到尾只拿到聽寫完成的文字。 本 App 從不錄製、讀取或傳送任何音訊。
4. 我們的伺服器存了什麼
請求會先經過我們自己的伺服器再送到 AI 服務,以便計算用量與控制成本。那台伺服器 不保留內容:資料表裡根本沒有任何欄位能存放圖片或你寫的文字——這是結構上的保證, 不只是一句承諾。
| 存了什麼 | 為什麼 |
|---|---|
| 你的電子郵件位址與一個帳號識別碼 | 讓每月免費額度綁在你身上,而不是綁在裝置上 |
| 這個月已使用的辨識次數,記在下方的雜湊上而不是記在你的帳號上 | 執行免費額度上限。記在雜湊上正是為了讓額度不會因為「刪除帳號再重建」而重置。 |
| 每次請求:時間、是照片還是文字、成功或失敗、token 數、成本、回應時間、模型名稱、App 版本、一次性請求識別碼 | 成本歸屬、濫用偵測、除錯 |
| 你的訂閱層級與到期日 | 每月 AI 額度取決於它。你的手機不能單方面告訴伺服器「我有較高的額度」——伺服器會自己向訂閱服務商查證,再把答案存下來。 |
| 你的電子郵件位址與一個裝置識別碼的單向加鹽雜湊——只有雜湊,絕不存位址或識別碼本身 | 讓每月額度與較大的首月額度都跟著「人」而不是跟著帳號走。沒有它的話,刪除帳號再重新註冊每次都能再領一份,而那筆錢最終是我們付。 |
5. 我們不會蒐集的東西
- 不蒐集姓名與電話號碼
- 沒有密碼——登入用的是寄到你信箱的一次性驗證碼,所以沒有密碼可存、也沒有密碼可外洩
- 不讀取通訊錄、行事曆、位置或相簿內容
- 沒有廣告識別碼;本 App 沒有廣告。本 App 確實會讀取一個由作業系統提供的裝置識別碼 (Apple 的 vendor identifier 或 Android 的 SSAID),**僅用於**防止免費額度被反覆領取。 它不用於廣告,也不用於跨其他 App 或網站追蹤你,而且**絕不會傳給 Anthropic**—— 是我們自己的伺服器把它雜湊後只保留雜湊值。另外,訂閱服務商會為這次安裝產生一個 它自己的識別碼,用途是讓一筆訂閱能對應回正確的人。那個識別碼絕不會與上述雜湊 合併使用,同樣不用於廣告,也不用於在別處追蹤你。
- App 內不含任何分析或當機回報 SDK。唯一內建的第三方 SDK 是訂閱服務商的, 購買與續訂事件確實會出現在它的後台——見第 7 節
- 不蒐集金融帳戶憑證——本 App 不連接任何銀行
6. 你的帳號
AI 辨識需要帳號。你用電子郵件加上我們寄給你的一次性驗證碼登入,沒有密碼。 本 App 的其他功能都不需要帳號。
帳號存在的唯一目的,是讓每月免費額度綁在你身上,而不是綁在裝置上——綁在 裝置上的話,重新安裝就能再領一次額度,而那筆錢最終是我們付。你的信箱位址不會用於 行銷,除了登入驗證碼之外我們不會寄任何東西給你。這次登入的憑證存放在你裝置的安全 金鑰儲存區。
7. 第三方
| 對象 | 會收到什麼 | 所在地 |
|---|---|---|
| Anthropic PBC | 你送出的收據照片或文字,以及你的分類名稱 | 美國 |
| 我們的郵件寄送服務商 | 你的電子郵件位址,用來把登入驗證碼寄給你 | 見其隱私政策 |
| RevenueCat(我們的訂閱服務商) | 這次安裝或你的帳號的一個識別碼,以及「訂閱開始/續訂/取消/到期」這件事。絕不包含你的電子郵件位址,也絕不包含你帳本裡的任何東西。 | 美國 |
| Supabase(我們的主機與認證服務商) | 第 4 節的用量紀錄。照片與文字只在記憶體中經過,不落地儲存。 | 伺服器位於日本東京 |
Anthropic 處理你送出的內容以產生擷取後的金額、日期與商家。依 Anthropic 的商用 API 條款,透過 API 送出的輸入不會被用於訓練其模型。Anthropic 自身的處理與保存方式, 以其隱私政策為準: anthropic.com/legal/privacy。
我們看不到你的付款資料。訂閱是由應用程式商店(Google Play 或 Apple) 收款的,你的信用卡或付款方式一直留在他們那裡,不會經過我們,也不會經過 RevenueCat。
我們不會為任何目的把你的資料販售或分享給其他人。
8. 跨境傳輸
我們是設立於美國的公司。若你不在美國境內,送出照片或文字做 AI 辨識時,該內容會傳輸 到美國由 Anthropic PBC 處理。第一次傳輸之前,同意畫面上會先告知你這件事;而且這個 傳輸只會因為你自己選擇使用該功能才發生。第 4 節所述的用量紀錄存放於日本的伺服器, 我們在美國可以存取。
9. 法律依據(歐洲經濟區/英國使用者)
- 同意——用於把照片或文字送給 AI 服務。你在同意畫面上給予, 並可隨時在「設定 → 隱私」撤回,不影響 App 其餘功能。
- 正當利益——用於第 4 節的用量紀錄,以執行免費額度、偵測濫用, 並讓服務在財務上可持續。
10. 保存期限
- 照片與文字:我們在任何階段都不保存,僅在請求期間存在於記憶體中。
- 逐次的用量紀錄:在你的帳號存在期間保留。
- 額度雜湊值,以及記在雜湊上的本月已用次數:即使你刪除帳號之後仍然 保留。這是刻意的——刪掉就等於讓它唯一的用途失效,也就是防止「刪除帳號再重建」把額度 重置一次。雜湊無法還原成你的電子郵件位址或裝置識別碼,已用次數只是一個數字,兩者都 不會用於其他任何用途。本月的次數會在月份結束時作廢。
- 你的訂閱紀錄:在你的帳號存在期間保留,並隨帳號一起刪除。已經過期的 紀錄在那之前不會清掉,這樣才回答得出關於過去訂閱的問題。
- 你的帳目資料:留在你的裝置上直到你自己刪除。我們讀不到,也沒辦法替你刪。
11. 你的權利與控制方式
- 撤回 AI 同意:設定 → 隱私 → AI 辨識與資料處理。撤回後不會再送出任何東西。
- 刪除帳號:設定 → 關於與支援 → 刪除帳號。會永久刪除你的帳號、電子郵件位址與 第 4 節所述的逐次用量紀錄,但有一個刻意的例外:那些單向雜湊值,以及記在雜湊上的本月 已用次數,會被保留——否則刪除帳號再重建就等於把額度重置一次(見第 10 節)。 不會刪除你手機裡的帳目,因為我們碰不到它;也不會取消已購買的訂閱 ——訂閱屬於你的 Google Play 或 Apple 帳戶,要取消請到那裡。
- 刪除本機資料:設定 → 資料 → 重新設定,或直接解除安裝本 App。
- 匯出你的資料:設定 → 資料 → 備份資料會產生完整的資料庫檔案; 交易清單另可匯出成 CSV、Excel 或 PDF。
- 查閱、更正、反對:由於我們不持有任何個人內容,這些權利主要適用於 用量紀錄,請來信 support@goodsvalu.com。
12. 兒童
本 App 並非以未滿 13 歲(或你所在國家的數位同意最低年齡)的兒童為對象,我們也不會 在知情的情況下蒐集他們的資料。
13. 本政策的變更
若我們變更資料處理方式且會影響到你,我們會更新本頁面;涉及 AI 處理的變更,我們會 在 App 內重新請求你的同意,而不會沿用你先前的同意。