Privacy Policy

Last updated: 7 July 2026

In short: You can use TapXpense completely anonymously. As a guest, your expenses stay on your device — we never upload them, sell your data, show ads, or track you. Cloud backup and cross-device sync happen only if you choose to sign in with Apple or Google. The single exception for guests: the short phrase you type to log an expense may be sent — with no name or identifier attached — to categorise it, and only when your iPhone can't do that on its own.

This Privacy Policy describes how TapXpense ("we", "our", or "the app") handles information when you use our mobile application. By installing or using TapXpense, you consent to the practices described below.

1. Information We Collect

On-device data. When you record an expense, the app stores the amount, title, category, payment method, account, date, and any optional notes locally on your iPhone using Apple's SwiftData framework. Your name and preferred currency are stored the same way.

Account information. If you sign in with Apple or Google, we receive your name and email address (Apple lets you hide your real email) in order to identify your account and synchronise your data across your devices. If you stay a guest, the app runs entirely on your device — we do not create an account for you, and your expense data is never sent to our servers.

Expense parsing. When you log an expense by typing or via the Back Tap shortcut, the text you enter (for example, "10 for coffee") may be sent to a third-party language-model service (OpenRouter, which routes to providers such as Anthropic Claude or Google Gemini) to suggest a category and icon. These requests never include your name, email, account ID, or any other identifier — only the phrase itself. On supported devices this categorisation runs entirely on-device and nothing is transmitted. For guests, this categorisation request is the only data that ever leaves the device.

Notion (optional). If you choose to connect Notion, the expense details you sync — title, amount, currency, category, date, notes, and account name — are sent to the Notion database you select so they appear in your own workspace. We store an access token for your Notion workspace on our backend so syncing can work; disconnecting Notion in Settings deletes that token. Connecting Notion requires signing in.

Website community feedback. If you submit an idea through the TapXpense website community board, we store the name you provide, board/category, title, description, status, vote count, and timestamp in our Supabase project. Community ideas are intended to be public, so do not submit private financial details or personal information in a feedback post.

Diagnostic information. The app does not collect crash reports, analytics events, advertising identifiers, or device fingerprints. We do not integrate with any analytics SDK.

2. How We Use Your Information

We use the information described above only to:

Display your expenses, accounts, and reports inside the app.
Sync your data across the devices on which you sign in with the same account.
Generate category suggestions for the expenses you log.
Send your expenses to your own Notion database, if and when you connect Notion.
Display, prioritise, and respond to public website community feedback.

We do not use your data for advertising, profiling, or any form of targeted marketing.

3. How Your Information Is Stored

Where your data lives depends on whether you sign in:

Always — locally on your device, in the app's private container, encrypted by iOS at rest.
Only if you sign in with Apple or Google — a copy is also stored in our Supabase backend (operated by Supabase, Inc.), in a private Postgres database protected by row-level security policies that ensure each user can only access their own rows. Connections are encrypted in transit using TLS 1.2 or higher.

Guests are never stored on our backend — guest data exists only on the device. Because of that, please keep your own backup (Settings → Export); uninstalling the app permanently removes guest data.

4. Sharing With Third Parties

We do not sell, rent, or share your personal information with advertisers or data brokers. The app interacts with the following third-party services strictly to provide the functionality you have requested:

Supabase, Inc. — cloud storage and authentication, used only when you sign in.
Apple Inc. — only when you choose to Sign in with Apple.
Google LLC — only when you choose to sign in with Google.
OpenRouter, Inc. and the underlying model provider (such as Anthropic or Google) — only to categorise the expense phrase you typed, when on-device categorisation is unavailable.
Notion Labs, Inc. — only when you choose to connect Notion; the expense details you sync are sent to the Notion database you select.
Supabase, Inc. — website community board storage for public feedback posts and votes.

Each of these providers has its own privacy policy. We encourage you to review them.

5. Data Retention and Deletion

Local data persists on your device until you delete the data or remove the app. For guests, deleting the app permanently removes all data, as there is no server copy. If you are signed in, your backend data persists until you delete your account. Disconnecting Notion in Settings deletes the access token we hold for your Notion workspace.

To delete all of your data:

Signed-in users: use Settings → Account → Delete Account inside the app. This immediately and permanently deletes your account, everything synced to our servers (including any Notion connection), and the data on your device. It cannot be undone.
Guests: deleting the app deletes all of your data — nothing exists outside your device.
You can also contact us with any deletion request (see Contact below).

6. Children's Privacy

TapXpense is not directed to children under the age of 13, and we do not knowingly collect information from anyone under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

7. Your Rights

Depending on where you live, you may have rights under the GDPR, CCPA, or similar laws — including the right to access, correct, or delete the personal data we hold about you, and the right to withdraw consent at any time. To exercise any of these rights, please contact us using the link below.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Material changes will be communicated via an in-app notice on first launch after the change.

9. Contact

If you have any questions about this Privacy Policy or your data, please contact us.