Privacy Policy

This policy explains what happens to your data when you use Billy, the envelope budgeting app for iPhone. Billy is made by Felipe Passos, an independent developer (“we”, “us”). It describes what the app actually does, not a generic template.

The short version: Billy has no user accounts, and no server holds your budget. Your budget, your transactions, your receipts and everything else you put into Billy stay on your iPhone, and we never see them. Billy sends a small amount of usage data and crash reports, tied to a random analytics ID, to PostHog, an analytics service hosted in the European Union, so we can understand how the app is used and fix problems. That data never includes anything you enter or choose about yourself or your budget, such as amounts, balances, payees, notes, names or your onboarding answers. No ads, no tracking, and we never sell data.

1. Your budget stays on your iPhone

Everything you create in Billy (budgets, accounts, jars, transactions, goals, payees, notes, receipt images, imported statements and your settings) is stored only on your device, in Billy’s private storage. Billy’s widgets and controls read the same data on the same device. There’s no Billy account and no server that stores any of this, so we have no copy of it and no way to access it.

Like other app data, Billy’s data is included in your iPhone backups (iCloud Backup, or a backup to your computer) if you have them turned on. Billy doesn’t sync your data to iCloud on its own.

Billy never asks for your bank login and never connects to your bank. The only financial information it has is what you enter or import yourself.

2. Receipts and the camera

Billy uses the camera only when you scan a receipt. The receipt’s text is read on your iPhone, using Apple’s on-device text recognition, to fill in the amount, date and merchant. The receipt image is saved with its transaction on your device and is never uploaded. If you pick a receipt from your photos instead, Billy receives only the image you choose.

3. Statement imports

When you import a bank statement (CSV, OFX, QFX, CAMT.053 or MT940), Billy reads the file you choose on your iPhone. The file is never uploaded. For CSV files, Billy remembers how the columns map so the next import from the same bank is quicker. You can delete these import profiles in Billy’s Settings.

4. Face ID and App Lock

If you turn on App Lock, iOS handles Face ID or your passcode. Billy only learns whether unlocking succeeded. Biometric data never reaches Billy.

5. Reminders

Bill reminders and Billy’s other notifications are scheduled on your iPhone. Billy doesn’t use push notifications, so no notification token is sent anywhere.

6. Purchases

Billy Pro (Monthly or Lifetime) is sold and billed by Apple, and we never receive your payment details. Billy checks your purchase with Apple on your device and remembers the result on your device, so it keeps working offline. When you buy Billy Pro, the app attaches its analytics ID (see section 7) to the purchase. This lets us match purchases with the app’s usage data. Apple also gives us sales reports that don’t identify you.

7. Usage analytics

To understand how Billy is used and where it can improve, the app sends a small, fixed set of events to PostHog, an analytics service, using its servers in the European Union (PostHog Cloud EU, in Frankfurt, Germany). They cover three things:

• Usage: that the app was opened, how long it was used, and which features were used, for example adding a transaction, scanning a receipt, importing a statement, moving money between jars or closing a month.
• Purchases: whether the paywall was shown, which plan was selected, and whether a purchase or a restore succeeded.
• Progress: which onboarding steps were reached or completed, whether an action was completed, cancelled or failed, error codes, and whether you allowed notifications when asked.

Nothing you enter or choose about yourself or your budget is sent to analytics: no onboarding answers or goals, no amounts or balances, no payees, notes or categories, no names of your jars or accounts, no receipt images or statement contents, and nothing you type. Each event is a single action, such as adding one transaction, with no amount, payee or category attached. The only price the events ever carry is what you paid for Billy Pro: when you buy it, the purchase event includes the product, its price and currency, and the purchase’s original transaction ID, but never your App Store receipt or payment details.

Each event also carries technical details: the app version and build, the iOS version, the device model, your device’s language and region settings and Billy’s language, the time zone, the App Store country, whether it’s a TestFlight (beta) build, when the app was installed, and a random ID for the current session, plus a few basic details PostHog’s SDK adds, such as the device type, whether the app is running on a Mac or in a simulator, and the SDK’s version. Once after you install Billy, the app also asks Apple’s AdServices framework whether the install came from an Apple Ads campaign, and sends the result (such as the campaign, ad group and keyword, or that the install didn’t come from an ad). This doesn’t use your device’s advertising identifier or App Tracking Transparency, and it isn’t tracking.

Events are grouped by a random analytics ID that Billy creates the first time it opens and keeps in your iPhone’s Keychain (or, if the Keychain isn’t available, in the app’s own storage). It isn’t an account, and it isn’t your name, your Apple Account, or an advertising or device identifier. Billy also attaches it to Billy Pro purchases (section 6), so purchases can be matched with usage. Because all events share this ID, they’re pseudonymous rather than anonymous: we can see what one installation of Billy did, but not who you are. The analytics ID is also PostHog’s identifier for your installation, so PostHog keeps a pseudonymous profile under it, with that installation’s events and the Apple Ads result described above. iOS usually keeps Keychain items even after an app is deleted, so if you delete and reinstall Billy, it usually continues with the same analytics ID. When you ask us to delete your analytics data (section 11), we delete the ID’s profile and its events from PostHog; the ID itself stays on your iPhone, so anything you do in Billy afterwards is recorded under it again.

Apart from crash reports (section 8), we’ve turned off all of PostHog’s automatic capture, such as screen views and taps, so the app sends only the events described here. Session recording, surveys and feature flags are off, and the SDK doesn’t add device details to the profile itself; PostHog does copy a few basic ones from the events onto it, such as the app version, iOS version and device type.

PostHog receives your IP address, because that’s how data travels over the internet, but we’ve set our PostHog project to discard it, so it isn’t stored. Billy also turns off PostHog’s location lookup for every event, so your IP address isn’t used to work out where you are. The only location-related details we have are the ones listed above: your App Store country, your time zone and your device’s region setting (and, for an install from an Apple Ads campaign, that campaign’s country).

Development versions of Billy never send analytics. TestFlight (beta) versions and the App Store version do, and events from beta versions are marked as beta.

We use this data only to keep Billy working and improve it. We don’t use it for advertising, we don’t sell it, and we don’t combine it with data from other companies.

8. Crash reports

If Billy crashes, the app sends a crash report through PostHog’s error tracking, with the same analytics ID: the type of error and its message, a stack trace showing where in Billy’s code the problem happened, the app version and build, the device model and the iOS version, plus the same technical details as other events and the names of the app’s code libraries in the trace (used to make the trace readable). It includes no screen contents, none of your budget data and nothing you typed. It tells us what went wrong and where, so we can fix it.

If you’ve chosen to share analytics with app developers in your iPhone’s settings (Privacy & Security, then Analytics & Improvements), Apple may also share crash reports and usage statistics with us, under Apple’s privacy policy.

9. What we don’t do

• No advertising, and no advertising SDKs.
• No session recording or screen recording. The only third-party software in Billy is PostHog’s SDK (including its built-in crash reporter), which sends the analytics and crash reports described above.
• No tracking: we don’t combine data from Billy with data from other companies’ apps or websites, and we don’t use your device’s advertising identifier.
• We never sell, rent or trade your data.
• No bank connections and no data brokers.
• No user accounts, so there’s nothing to sign in to.

These Billy pages don’t use analytics or cookies either.

10. Who processes data for us

• PostHog, Inc. receives the usage analytics and crash reports described above and stores them in the European Union (PostHog Cloud EU, in Frankfurt, Germany), under PostHog’s Data Processing Agreement. See PostHog’s privacy policy.
• Apple processes purchases, downloads, Apple Ads attribution, crash reports you choose to share and any iPhone backups you make, under Apple’s privacy policy.

Where a law such as the GDPR or Brazil’s LGPD requires a legal basis, we rely on our legitimate interest in keeping Billy working and improving it, using only the limited, pseudonymous data described above.

11. Keeping and deleting your data

Your budget stays on your iPhone until you delete it. To erase everything, open Billy’s Settings, then Data, then Delete All Data, or delete the app. Data from before that may remain in older iPhone backups until they’re replaced.

Exports and backups you make from Billy’s Settings are files you save wherever you choose, such as the Files app or iCloud Drive. From then on, they’re under your control and the terms of the service you saved them to.

Analytics events and crash reports are kept in PostHog for up to 7 years, the retention period of our PostHog project. You can ask us to delete them sooner at any time: email support@getcorpus.app with the analytics ID shown in Billy’s Settings, and we’ll delete that ID’s profile and its events from PostHog. Deleting Billy, or deleting its data in Settings, doesn’t delete analytics that were already sent.

12. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, the LGPD in Brazil or the CCPA in California), you may have the right to access, correct, export or delete your personal data, and to object to how it’s processed. Your budget data is entirely in your hands: you can export it or delete it from Billy’s Settings at any time. For anything else, including your analytics data, email us at support@getcorpus.app (for analytics, include the analytics ID shown in Billy’s Settings). You can also contact your local data protection authority.

13. Children

Billy isn’t directed at children under 13 (or the minimum age in your country), and we don’t knowingly collect data from them.

14. Changes to this policy

If this policy changes in a meaningful way, we’ll update the date at the top of this page and, for significant changes, tell you in the app.

15. Contact

Felipe Passos, support@getcorpus.app. Please mention Billy in the subject.