1. Your local ledger and images
CapMoney does not require an app account. Expense names, amounts, currencies, categories, dates, budgets, and sticker attachments are stored in the app's private directory on your device. Your full ledger is not uploaded to our servers. You can edit or delete expenses and their associated attachments in the app. System backups and device migration may copy app data, depending on your Apple settings. When iCloud is available, the app syncs your ledger and attachments to your own iCloud account through Apple CloudKit by default; you can turn this off in Settings > iCloud Sync. Synced data is stored in your private iCloud database, which we cannot access. Shared books are stored in the creator's iCloud and are open only to invited members. Apple handles iCloud data under its own policies.
2. Optional online photo recognition
Only after you explicitly allow online recognition does the app send a compressed photo and category list over HTTPS to our recognition service and then to Alibaba Cloud Model Studio (Qwen). The purpose is to suggest a name, category, receipt amount, and currency. Images and custom categories may contain personal information, including merchant details, addresses, and purchase history. Results become ledger entries only after you review and save them. Refusing or disabling recognition does not prevent local image processing or manual recording. Withdrawing consent does not undo processing that has already taken place.
3. Recognition infrastructure and logs
Our recognition proxies run in Alibaba Cloud regions in Beijing and Hong Kong, China; Singapore; Virginia, United States; Frankfurt, Germany; and Tokyo, Japan, using the corresponding Model Studio workspace endpoints. After you allow online recognition, versions with region preference ask Cloudflare for the country or region and continent inferred from the network exit IP address. This does not read GPS or request location permission. The lookup contains no photo, categories, or device identifier; the region lookup service does not store its result, and the app temporarily caches the selected endpoint in memory. The app checks the preferred regional endpoint first and probes alternatives only when it is unavailable or the region cannot be determined. It sends the locally extracted subject image and categories to one selected endpoint. If subject extraction fails, manual entry remains available and the full original photo is not automatically uploaded. Selection is reconsidered after network changes or request failures. Earlier automatic-selection versions use the fastest healthy response; older versions use DNS routing, normally directing mainland China to Beijing and other requests to Singapore. A VPN or proxy may identify the network exit location instead of your physical location. Network settings, proxies, resolver location, and caching can affect selection. Processing in your region is not guaranteed, and requests from outside China may be transferred to China. The entry region does not establish every location used for model inference or backups. The proxies do not maintain photo archives. Application error logs record error categories rather than photo bodies or recognition content. Health checks, infrastructure operation, and security may still involve IP addresses, request times, status, and diagnostic information. Enabled service logs are currently retained for 30 days. This is not a retention period for Model Studio photos or invocation data.
4. Provider retention
Model Studio's public notice states that it stores model and application invocation data and does not use that data for model training. We do not promise immediate deletion after a request or treat local deletion as provider-side deletion. Provider processing, backups, and retention are governed by its agreements and legal obligations. For related requests, email us; we will check what data can be identified and contact the relevant provider. See the Model Studio privacy notice.
5. Camera, photos, and location
The camera lets you take photos, and the system photo picker imports images you select. Location is optional. Saving does not itself request location permission; a recent location may be attached if permission is already granted, and you may actively add a place. When resolving a place name, the system Maps service may send coordinates to Apple. Location fields are not separately sent to Qwen, although a photo may show an address. You can manage camera and location permissions in iOS Settings.
6. Purchases and subscriptions
Apple processes payments. We use verified StoreKit transaction and entitlement information to confirm Pro access and restore purchases. We do not receive your card number or payment password. Apple handles payment and account information under its own policies. Purchase information visible in a receipt photo is recognition content, distinct from your in-app subscription payment. RevenueCat, Inc. manages subscription status for us: the app sends App Store transactions and purchase history, an anonymous user ID generated by RevenueCat, region and currency, and app and OS versions to RevenueCat to confirm Pro access, restore purchases, and handle subscription management and refund requests. We do not give RevenueCat your name, email address, or other identity information, and we do not use advertising identifiers. See the RevenueCat Privacy Policy.
7. Usage analytics (Microsoft Clarity)
When the app starts, it runs the Microsoft Clarity mobile SDK so we can understand how features are used, diagnose crashes and slowdowns, and improve the experience. It collects device type, brand, model, OS version, screen size, app errors and performance information, taps and gestures, screens viewed, and usage time, and Microsoft infers an approximate region from your IP address. This information is used to reconstruct anonymous usage sessions and produce usage statistics. We enable masking on the app's screens and sheets. According to Microsoft, masked text and images are not captured or uploaded, so expense names, amounts, photos, and ledger content should not appear in analytics data. We do not give Clarity your name, email address, Apple Account, or any other identifier, and we do not use this data for advertising or cross-app tracking. Microsoft states that session playback data is kept for 30 days and heatmaps and labeled sessions for 9 months, after which they are deleted. You can turn it off in Settings > Usage analytics (earlier versions lack this setting; contact us instead). The app then pauses capture immediately and no longer runs Clarity at launch; data uploaded before you turned it off is kept for the periods above. See the Microsoft Privacy Statement and the Clarity mobile SDK privacy guidance.
8. Website and support
Cloudflare hosts this website. To deliver pages and protect the service, it may process IP addresses, request information, and security logs across its global network. See Cloudflare's privacy policy. We have not added advertising, behavioral tracking scripts, analytics SDKs, or non-essential cookies. Emails to support@capmoney.app are forwarded to our support inbox through Cloudflare Email Routing. Email providers process addresses, message content, and attachments. We use support information to respond, troubleshoot, and handle requests, retaining it only as needed for those purposes, disputes, or legal obligations.
9. Purposes, grounds, and disclosure
We process necessary information to provide requested features, handle support, and comply with legal obligations. Optional online recognition and device permissions depend on your authorization. Where applicable law permits, necessary service security and maintenance, and the usage analytics described in section 7, may also rely on legitimate interests. We do not sell personal information or use it for cross-app advertising tracking. We disclose information to the providers described above as needed for their services, or when required by law or necessary to protect lawful rights.
10. Your choices and rights
You can edit or delete local entries, turn off online recognition, iCloud sync, and usage analytics, and manage device permissions. Depending on applicable law, you may also have rights to access, correction, deletion, a copy of data, restriction, objection, withdrawal of consent, and complaints to a supervisory authority. Email support@capmoney.app. We request only information necessary to verify and handle the request and respond within applicable legal deadlines. With no CapMoney account or cloud ledger, we may be unable to link previously processed recognition requests to you. We will explain what we can do and any legal retention requirements.
11. Children, safeguards, and updates
The service is not designed specifically for children. Minors should use it with a guardian's guidance. Contact us if you believe a child provided personal information without required authorization. We use safeguards including encrypted transmission, device-private storage, and service access controls, but no system is risk-free. We will update this page and its date when the policy changes. Where a change requires renewed authorization, we will provide notice and obtain it as required.