Privacy, data storage and retention

AI PM Workflow – Expense Tracker is in the beta testing phase. Keep separate copies of your receipts and records. This notice was updated 10 October 2026.

Who is responsible?

Oliver Marnitz operates this app and decides how your personal data is used. For privacy questions or requests, email olivermarnitz@gmail.com.

My data-protection responsibilities

I take responsibility for meeting my UK data-protection obligations and following ICO guidance. I have put in place this privacy notice, verified email sign-in, account-based receipt access, data downloads and a contact route for privacy and deletion requests. Compliance is an ongoing responsibility: ICO fee requirements and applicable provider arrangements still need to be confirmed, and automatic activity expiry is not yet active. Signed-in users can now permanently delete their account and live receipt data. This is not an ICO approval or certification.

What we collect and why

Your email address, account identifier and authentication details let you register, verify your address, sign in and reset your password. Supabase stores a password hash, rather than a readable password. We store the receipt photographs and details you choose to save, including supplier, date, amounts, VAT, notes and any individual line-item descriptions, quantities, unit prices and calculated amounts.

We also record account creation, verification, password changes, sign-ins, reset requests, receipt changes and export actions to support security, troubleshooting and limited beta usage statistics. Administrators see aggregate statistics. Reset-request statistics do not store the requested email address. Service providers may process technical information such as IP addresses and security logs.

Our lawful basis is legitimate interests in providing the service you request, keeping it secure and understanding beta use. We minimise these records and restrict access. You can object by contacting us. Your beta acknowledgement is not consent for marketing. We do not use your address for marketing, sell your data or use advertising trackers.

Storage and service providers

Supabase provides account authentication, with this project's database in London. OpenAI Sites and its Cloudflare infrastructure host the app and store receipt records and photographs. Resend sends verification and password-reset emails and processes email data in the United States. Your receipt text is read in your browser; photographs are uploaded when you save a receipt.

A London authentication database does not mean every provider processes data only in the UK. Providers may use overseas infrastructure and subprocessors. Resend provides a data-processing addendum with Standard Contractual Clauses and a UK Addendum; its GDPR information explains these safeguards. Supabase’s data-processing addendum describes its arrangements. Hosting-specific transfer and recovery-retention arrangements are still being reviewed for this beta. Contact the privacy address for information about the safeguards relevant to your data.

How long we keep data

• Accounts and receipts: kept while your account remains open, until you delete a receipt or close your account. The operator will review whether inactive accounts are still needed; there is no automatic inactivity deletion.
• App activity and account-event logs: activity history is currently stored for security, troubleshooting and beta usage reporting. Automatic expiry has not yet been activated. You can request removal of data associated with your account using the privacy contact.
• Account deletion: use Account and privacy after signing in, then confirm irreversible deletion with your current password. The app removes your live photographs, receipt records and associated app activity before deleting the authentication account and revoking its sessions. If an operation fails, deletion is not reported as complete; retry to finish or contact the privacy address. A one-way account marker prevents concurrent uploads during closure and expires after 24 hours, with expired markers removed on the next page access. It contains no email address or receipt content.
• Transactional emails: Resend states that email and delivery logs on its standard plans are retained for 30 days, with backups lasting 7 days.
• Other provider logs and recovery copies: providers manage these under their own retention policies. Deletion from live systems does not necessarily remove existing recovery copies immediately. Any copy you download remains under your control.

We do not require you to keep tax records here for a fixed period. Keep your own copies for any accounting or tax requirements that apply to you.

Your choices and rights

Once signed in, use Account and privacy to permanently delete your account. You can request a copy of your personal account data through the privacy contact. The in-app account JSON download is available only to the administrator. The ledger's CSV, PDF and Photos + ledger ZIP options let you keep copies of your expense records and photographs. You can edit or delete individual receipts.

Your right to object

You can object to our processing based on legitimate interests by emailing the privacy contact. We will consider your reasons and stop unless a lawful overriding ground applies.

Other data rights

You can ask for access, correction, erasure or restriction of your data. Portability applies where the legal conditions are met; exports are available regardless. Email the privacy contact with your request. We will verify your identity and normally respond within one month, explaining any lawful exception or extension.

You may complain to the Information Commissioner's Office (ICO). Please contact us if you suspect unauthorised access or a data incident.

Failed password attempts

Five failed password attempts through the app, including password confirmation for account deletion, suspend access for the entered email address for one hour across tabs and devices. The app shows the remaining attempts. Provider outages and rate-limit errors are not counted as incorrect passwords. A successful password check resets the counter, and a completed suspension resets it on the next attempt. A password reset does not lift an active suspension. The server stores a one-way reference to the normalised email address, the failure count and temporary lock and request-processing times; no passwords are saved in these records. The same messages apply whether or not the address has an account. A successful password check or account deletion removes the associated counter. Session-timer and password-attempt records are not included in the JSON account download; you can request them through the privacy contact.

Inactivity sign-out

Sign-in cookies are limited to the browser session, so a normal browser session end should require a fresh sign-in. Closing a tab, switching apps or restoring previous tabs may retain the session; browsers do not guarantee immediate sign-out on exit. Use Sign out to end it immediately. The five-minute inactivity timeout remains active.

The app signs out the current browser session after five minutes without interaction, with a warning 15 seconds before expiry and a Keep me signed in option. Activity in another tab using the same session keeps it active; other devices have separate sessions. The app stores the session identifier, a one-way account reference and the most recent activity time for enforcement, not keystrokes or clicked content. These session records are removed when you delete your account. The browser also stores the last activity time locally and removes that entry when signing out. Sleeping devices may show the sign-in screen only when reopened, and unsaved changes may be lost.

Protect your records

Use a unique password, sign out on shared devices and avoid uploading unnecessary information about other people, payment-card details or sensitive personal information. Receipt recognition can make mistakes, so check every figure and line item before saving. The line-item sum is compared with the receipt total; a matching sum does not prove that every item is correct. For a new unsaved receipt, use Retake photo or Crop and read again if the image is unclear. Duplicate warnings help identify matching entries but do not replace your review. You can go back or choose Save anyway for a legitimate separate expense.

Beta testing and feedback

Hands-on testing has included Safari on an iPhone 16 Pro Max running iOS 26.6.2; other devices and browsers still need testing. A read-only testing report and guide is available to everyone. It shows completed checks and results and supports optional structured testing. Print it or use separate notes. The editable master and usage statistics remain administrator-only. The testing process separates automated code checks from hands-on browser results. The PDF records completed automated checks, their methods and evidence, and leaves unperformed user tests as Not tested. Automated checks use simulated services and temporary databases; they are not an independent security audit or proof of live Safari behaviour. Testers should record their device, browser, test ID and reproduction steps, using disposable accounts for lockout and deletion tests. Completed checklists are not submitted automatically. If you email feedback, we use the information you send for beta troubleshooting and may retain it in correspondence until no longer needed. Do not include passwords, reset links or unnecessary personal information. Contact the privacy address with any removal request.