Privacy

What the AI providers receive

WholeBudget works with OpenAI and Anthropic, and with TypeSafe for Jev. Each AI feature sends its request either with your own key, straight from your Mac or iPhone to that provider, or through WholeBudget AI (below). Either way, this is what each feature sends:

• Reading a receipt: the photo and the text read from it.
• Reading a paystub: the page, or only its text when the text can be read on your Mac.
• Sorting bank transactions and income into categories: their descriptions, amounts and dates.
• Insights: a summary of your bills, subscriptions and income.
• Jev, the category helper: the items on a receipt, sent to TypeSafe, with your TypeSafe key or through WholeBudget AI.
• Finding a store’s website for its logo: the store’s name.
• Search and category suggestions: the words you search for, store names and descriptions, and your category names.
• Describing a category (“Describe with AI”): the category’s name, where it sits in your list, and the names of the categories under it.

WholeBudget AI

With Plus, whether bought, on a free trial or from a code the WholeBudget team gave you, WholeBudget AI runs AI features without keys of your own: on the iPhone it reads and sorts receipts and runs Jev, and on the Mac it runs every AI feature listed above. Each app asks before it first sends anything to WholeBudget AI, and you can withdraw that in Settings. If you turn on “Use my own keys instead” on the Mac, it uses your keys and leaves WholeBudget AI alone.

What a feature needs goes to WholeBudget’s server (Supabase, in Canada), which passes it straight to OpenAI, to Anthropic for a receipt that needs a second look, and to TypeSafe for Jev, under WholeBudget’s own API accounts.

Our server does not store or log the photo or the text it sends. It keeps a usage record (the job, the model, the number of tokens and the cost) to count your household's monthly allowance, a daily count of the requests it turned away for your household and why (no Plus, the monthly allowance, too many at once, or Jev's own limit), and, for 24 hours only, an encrypted copy of the answer so a retry after a dropped connection isn't charged twice. The WholeBudget team can see these records and counts, by household and device, in a private dashboard, to run the service and watch what it costs. They never include what you sent, which the server does not keep. Your iPhone proves it is the real WholeBudget app with Apple's App Attest, and your Mac proves it with its signed-in account; neither involves your receipts.

Plus and AI top-ups are bought through Apple. WholeBudget never sees your card or Apple Account details. When you buy, your iPhone sends Apple's signed receipt for that purchase to our server, which checks it with Apple and keeps the product, its dates, its status and Apple's transaction ids against your household, to know whether Plus is on and how much top-up credit is left. Apple also tells our server when a subscription renews, lapses or is refunded.

A code from the WholeBudget team can also turn Plus on for your household, for a set number of days or for good. When you redeem one, our server keeps a record of the code, your household, the account that entered it and the time, for as long as the household exists, so it knows your Plus came from that code and can end it if the code is withdrawn. If you redeem a code on our website, you sign in by approving it with your iPhone, the site only gets a ticket that can redeem a code for 10 minutes, and checking a code there counts requests per network address using a hash of it, which is deleted shortly after and never kept.

How the providers treat it

Each provider handles your requests under its own API terms and privacy policy, which apply between you and that provider because the key is yours. With WholeBudget AI, the requests go under WholeBudget's API accounts, on the same terms. OpenAI and Anthropic say they keep API requests only for a limited time and do not train their models on them by default. Their policies are at openai.com/policies and anthropic.com/legal/privacy.

OpenAI, Anthropic and TypeSafe process these requests in the United States. That means what an AI feature sends leaves Canada, and while it is there it can be accessed by courts and authorities of the United States under United States law. We do not send anything to an AI provider that the feature does not need, and the apps ask before they first use WholeBudget AI. Our own server and the optional account are in Canada, as described below.

Apart from the optional account described below, WholeBudget sends your data to no one else.

Testing how well Jev sorts

To check how good Jev, the category helper, is, WholeBudget can run it quietly beside your own choices (“Shadow”). Shadow sends the same thing Jev sends, the items on a receipt, to TypeSafe, and only for a household whose AI consent covers TypeSafe. Jev’s answer is compared with the category you chose, in a log kept on your Mac. In Shadow, Jev’s answer changes nothing on your receipts. WholeBudget uses the comparison only to judge how well Jev sorts, and pays for these requests itself; they never use up your household’s monthly allowance.

Other connections

The Mac app checks GitHub, where it is published, for new versions. To show a store’s logo, it asks Google’s favicon service and the store’s own website for it, sending only the store’s web address. Like any web request, these reveal your internet address to the site that answers.

To show a receipt or expense in another currency in Canadian dollars, the Mac app downloads that day’s exchange rate from the Bank of Canada. The request names only the currency and the dates, never an amount, a store or anything about you, and the rates are kept on your Mac so it works offline. Like any web request, it reveals your internet address to the Bank of Canada.

Each time you open it, at most every 15 minutes, a test version of the iPhone app (installed through TestFlight) checks GitHub for a newer build. It downloads a version number and sends nothing about you; like any web request, it reveals your internet address to GitHub. If you turn on “Tell me about every test build”, the same check reads a second file that lists builds before they reach the household. You can turn the check off in the app’s Settings.

If you use the optional account, the apps contact the account service to sign in and to keep you signed in. Like any web request, that reveals your internet address to it.

While the Mac app is open, it announces itself on the network it is on so your iPhone can find it. You can share your AI keys from the Mac to your paired iPhone; they travel over the same encrypted connection as everything else.

If a paired iPhone has both the household library and Share card list turned on, the Mac also sends it the bank line each receipt is matched to: the date, the amount the bank charged, the card as its network and last four digits, and the bank’s own description, with long numbers cut to their last four. For a receipt matched to a recurring bill instead, it sends that bill’s name, date and amount. It travels only over your home network, only to an iPhone you’ve allowed, and never to our cloud. The iPhone keeps it to itself and deletes it when you turn the card list off for that phone.

The optional account (in testing)

The account is optional: nothing is created until you sign in, and the app works fully without it. If you use it, you sign in with Apple on your iPhone; Apple may give WholeBudget a private relay email address instead of your own. Your Mac then signs in by scanning a code with your iPhone.

The account is stored with Supabase, in Canada (Montreal, ca-central-1). What it holds is:

• An account id, and the email address Apple provides, which may be a private relay address.
• Apple's sign-in refresh token, encrypted on our server, kept only so that deleting your account can also end your Sign in with Apple link with WholeBudget.
• The names of your signed-in devices (for example "Alex's iPhone") and when each was last used, which the people in your household can see under Household devices.
• Which household the account belongs to and who is in it. Your household’s name travels end-to-end encrypted, like your receipts, so we can't read it.
• Your devices’ public keys, and encrypted key wraps: keys locked so that only your own devices can open them.
• For an iPhone that uses WholeBudget AI, the public key Apple’s App Attest made for it.
• For each iPhone in the household, a short storage note for Settings › Storage on your Mac: the phone’s model (such as “iPhone 17 Pro”), whose phone it is, and how many pictures it keeps on the phone, in your iCloud and in the household’s iCloud, with their total sizes. It is end-to-end encrypted like your receipts and never includes the pictures, their names or what is in them.
• Your household’s categories: their names, how they are arranged, whether they are still in use, and their descriptions, so every device in the household has the same list. Each device sends the changes it makes, end-to-end encrypted like your receipts.

Receipts and the account

With cloud sync on, each of your devices uploads its copy of each receipt's details — store, date, amounts, items, categories, the event it belongs to, card ending and payments, links between papers, and deletions — so your household's iPhones and Mac stay in sync away from home. Syncing receipts is free; it does not need Plus.

These copies are stored with Supabase in Canada (Montreal, ca-central-1). Members of your household can read them; nobody else can.

When a receipt is read on an iPhone in your household, whether it is a new scan or a re-read, a short summary of how it was read goes to your household's other devices: when, on whose device, the steps, the AI models tried, how long each took and how it ended. It never includes what was read or the AI's answer. It travels over your home network to your Mac and, with cloud sync on, encrypted with the rest of the receipt in WholeBudget cloud.

Every copy is encrypted on your device with your household's key before it leaves, using AES-256-GCM. The key never reaches us: it stays on your household's devices (and your recovery key in your iCloud Keychain). WholeBudget and Supabase, which stores it, cannot read your receipts. Even the receipt identifiers are hidden from the server.

Receipt pictures stay on your devices by default — on the iPhone that took them and, if you have one, your Mac. Your iPhone can keep only recent pictures (Settings › Storage) and fetch older ones from your iCloud, your Mac or, if you use it, WholeBudget cloud; it never removes a picture that has no other copy.

If your household uses the optional account, your iPhone can also keep its pictures in your own iCloud, in WholeBudget's private iCloud storage that only your Apple Account can reach. Each picture is encrypted on the device with your household's key before it leaves, so neither WholeBudget nor Apple can see it. You can turn this off in Settings › Storage, which removes those copies from your iCloud after your iPhone has kept what it needs.

Someone in your household can also choose to share pictures through their iCloud (Settings › Storage). The household's iPhones then keep their pictures, still encrypted with the household's key, in a WholeBudget space in that person's iCloud, which counts against their storage. The other phones join it through the household's encrypted sync, and stopping sharing ends everyone else's access.

When your iPhone is away from your home network, it can leave an encrypted copy of a new receipt's picture in a mailbox for your household's Mac. The copy is encrypted on the iPhone with your household's key, so neither WholeBudget nor Cloudflare can read it, and it is kept only until your Mac downloads it, then deleted — at most 14 days. This is free and needs no setting.

Your Mac can also read your household's encrypted pictures from iCloud when it is signed in to iCloud: the household's shared WholeBudget space and, with the same Apple Account as your iPhone, your own. It only reads — it never adds, changes or removes anything there — and the pictures stay encrypted with your household's key until they reach your Mac.

WholeBudget cloud for pictures is optional, needs Plus, and is off until someone in your household turns it on. Then each picture is encrypted on the device with your household's key before upload and stored with Cloudflare R2 (North America), so neither WholeBudget nor Cloudflare can see it. Turning it off asks whether to delete the household's pictures there; deletion happens 30 days later so every device can keep its own copies first.

To leave, sign out in Settings › Account — nothing more is uploaded. Delete account (Settings › Account) removes your account and the household's copies when you are its only member; otherwise the household continues with its other members. Your receipts on your devices are never deleted by this.

What the iPhone app asks permission for

Each of these is used only on your devices:

• Camera: to scan receipts, and to scan your Mac’s pairing code.
• Local network: to find your Mac and sync with it.
• Contacts: only when you tap “Use my photo from Contacts”, to use the photo on your own card as your photo in the app, which your paired Mac also shows.
• Face ID: only to check it’s you before the app shows your household’s recovery key. WholeBudget never sees your face data; iOS only tells it yes or no.

Diagnostics you choose to send

After a crash or an error, the Mac asks before sending a crash report to WholeBudget, and the iPhone does the same from the version that adds it. If you chose Always send in Settings, the report goes without asking; if you chose Never, nothing is sent. A report holds call stacks and error names, the app version, the device model and its operating system, the names of the last screens and actions, and a random number made for this install so that repeat crashes from one install can be grouped. It holds no receipts, names, amounts or prompts, and it carries your household only if you are signed in.

Reports are stored with Supabase in Canada, and the WholeBudget team reads them to find and fix bugs. Each is deleted 90 days after it arrives. The server does not keep your internet address: to limit how often reports arrive, it keeps only a scrambled form of it for a day.

Share diagnostics still works for sending them yourself. On the iPhone, Settings › General › About › Share diagnostics bundles the hang and crash reports iOS keeps about WholeBudget. On the Mac, Settings › About › Share diagnostics saves a zip of the crash reports and the update log. A zip you save this way leaves your device only if you send it.

Taking your data with you

On the Mac, Settings › Data & backup › Export everything saves one zip with your receipts and each of their lines, your expenses and your income as spreadsheets, and every receipt’s picture. It is written straight to your disk and nothing is uploaded. The same page shows where your data folder is, if you would rather copy it whole.

Deleting your data

• Mac: quit WholeBudget, then delete the WholeBudget folder in ~/Library/Application Support. Deleting the app alone leaves your data in place. Your AI keys, and the account sign-in if you use it, are stored there too, encrypted by macOS.
• iPhone: deleting the app deletes its data. Your AI keys are kept in the iPhone’s Keychain, which iOS can keep after an app is deleted, so remove them in the app’s Settings first if you want them gone too. Pictures kept in your iCloud stay there after the app is deleted; turn off iCloud in the app’s Settings › Storage first, or remove WholeBudget in your iPhone’s iCloud storage settings.
• Account: in the iPhone app, go to Settings › Account › Delete account. What the account holds on our server is then deleted. When a whole household is deleted, its AI usage stays only as anonymous monthly totals of calls and cost, with no household or account attached. If you own a household that other people still belong to, ownership passes to the member who has been in it longest and the household carries on. Crash reports already sent lose their link to your household and are deleted 90 days after they arrived.
• A paired iPhone and Mac each keep their own copy. Delete on both to remove everything.

How long data is kept

On your devices, until you delete it. At an AI provider, as long as that provider’s terms say. For the optional account, until you delete the account. Without an account we hold nothing about you beyond any crash reports you chose to send, which are deleted 90 days after they arrive.

On our own server, these are the records and how long each is kept:

• Account, household, devices, encrypted receipts and encryption key wraps: until you delete the account, or the household is deleted.
• Plus and top-up records (the product, its dates and status, and Apple’s transaction ids): while the household exists, and deleted with it. A separate log of the notices Apple sends our server about subscriptions, which holds no household or name, is kept as a billing record.
• AI usage records (the job, the model, tokens and cost): 24 months, then deleted. Only anonymous monthly totals of calls and cost remain, with no household, account or device attached.
• AI replies kept for a retry after a dropped connection, and the one-time checks that prove an iPhone is the real app: deleted within minutes of expiring, and the replies expire after 24 hours.
• Sign-in requests from a Mac scanning a code: deleted an hour after they expire. Household invites and join requests: guesses at an invite code are deleted after a day, and join requests a week after they expire.
• Pictures in WholeBudget cloud: deleted 30 days after the household turns the cloud off and chooses to delete them. A picture waiting in the mailbox for your Mac: deleted when the Mac downloads it, or after 14 days at most.
• Crash reports you chose to send: 90 days.
• Server logs: Supabase keeps the logs of our server functions for the period its plan allows. They hold error messages and event types, never your receipts, pictures or what you sent to an AI.

Who is responsible for your information

Alexander (Alex) Bisgould, an individual in Toronto, Ontario, is the person in charge of protecting personal information at WholeBudget, and the person who decides how it is handled. You can reach him at support@wholebudget.io.

Your rights

You can ask us what personal information we hold about you, and ask us to correct it if it is wrong. Write to support@wholebudget.io, and we will answer within 30 days. What we hold on our server is small and described above; what is on your own devices you can already see and change yourself. You can also withdraw your consent to WholeBudget AI in the app’s Settings, and delete your account there.

If you are not satisfied with how we have handled your information, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you live in Quebec, to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

How we govern your information

In short, the rules we follow, including those Quebec’s privacy law asks us to publish:

• One person, named above, is in charge, and answers requests and complaints.
• We collect only what a feature needs, keep it only as long as the retention list above says, and encrypt what your household syncs so that we cannot read it.
• Before we send personal information outside Quebec, such as an AI request to the United States, we assess the risks and what protects it, and we keep that assessment.
• We keep a register of every confidentiality incident. If one carries a real risk of serious harm, we tell the people affected and the privacy authorities, and we take steps to limit the harm.
• We review these rules whenever what leaves your devices changes, and this page changes first.

Changes to this policy

If WholeBudget ever changes what leaves your devices, for example by uploading receipts to the optional account, this page changes first and the date at the top moves.