This Privacy Policy explains how GEEKDEV TECHNOLOGIES, SRL ("we," "us," or "our") handles information in connection with the Bolsillo mobile app and this website (together, the "Service"). Bolsillo is a manual expense tracker: it never connects to your bank, and it does not ask you to create an account.
The short version
- Your financial data — transactions, categories, payees, accounts, budgets and goals — lives on your device. We never receive your ledger.
- Scanning is optional. If you scan a receipt, an invoice or a bank-app screen, a copy of that picture, the text read from it and the names of your categories go through our server to TypeSafe and OpenAI, who read it for us. Our server keeps neither. Nothing is sent unless you scan.
- Bolsillo has no bank connection of any kind. We have no access to your bank or card accounts.
- We do collect usage analytics (through PostHog) so we can see which features are used and fix bugs: the screens you open and the buttons you tap, and a screen recording of each session with every amount, balance, note and name you typed hidden. They are about how the app is used — never your exact amounts or your words; for an expense we record only a range (for example 20–100 in your currency). They also receive your subscription events (a trial starting, a renewal, a cancellation) from RevenueCat, so we can see what makes Bolsillo worth paying for.
- We measure which of our ads brought you to Bolsillo (through AppsFlyer). If you allow tracking when the app asks, that includes your device's advertising identifier; if you don't, no advertising identifier is shared and ads are matched only through Apple's anonymous, aggregated reports.
- We never sell your personal information.
1. Information stored on your device
Your transactions, categories, payees, accounts, budgets, goals and preferences are stored locally on your device. If you turn on iCloud backup (a Premium feature), a copy is written to your own private iCloud account, which we cannot read. You can also export your ledger to a file that you keep. None of this is transmitted to us. If you delete the app, the copy on your device goes with it.
2. Bank accounts and card details
Bolsillo does not link to banks. We do not use Plaid or any similar aggregator, we never ask for online-banking credentials, and we have no access to your accounts, cards or statements. Every figure in the app is one you entered yourself.
3. Apple Pay logging (optional)
If you set up the optional Shortcuts automation, iOS hands the details of an Apple Pay payment — the amount, the merchant name and which card was used — from your own device into Bolsillo, so you can file it under a category. That information moves inside your device only. We never receive it, and Bolsillo can neither start a payment nor read your Wallet on its own.
3a. Scanning a receipt, an invoice or a bank screen (optional)
When you choose to scan a document, Bolsillo first reads it on your device with Apple's text recognition. To tell what kind of document it is and to fill in what it cannot read for sure, it then sends a smaller copy of the picture (at most 1,568 pixels on its longest side) and the text read from it — with the names of your categories, so a category can be suggested — to two services that read documents: TypeSafe and OpenAI. The transactions you then save stay on your device, like any other.
These requests go through our own server, which holds the services' keys. It checks that a request comes from the real Bolsillo app (with Apple's App Attest, which gives your install an anonymous key), counts requests so the service cannot be abused, and passes them on. Our server does not keep the picture, the text or the answer. For each request it keeps only its time, size, duration, cost and outcome, under an anonymous identifier for your install, for 90 days.
TypeSafe does not train or fine-tune AI models on what it receives; it keeps it for as long as it considers reasonably necessary to provide its service, under its own policy at typesafe.ai/privacy, and its service is hosted in the United States. OpenAI does not use it to train its models and keeps it in its abuse-monitoring logs for up to 30 days, longer only where the law requires it or to prevent harm; see OpenAI's data controls.
If you never scan, nothing in this section happens.
4. Information you send us
When you contact us through the support form or by email, we receive what you provide — typically your email address, the message you write, and any details you include (such as your device model or app version). Our support form is processed by Formspree, which delivers your message to us by email. See Formspree's privacy practices at formspree.io/legal/privacy-policy.
5. Analytics & diagnostics
To understand how Bolsillo is used and to find and fix problems, we use PostHog, a product-analytics and event-logging service.
These analytics may include: app interaction events (for example, opening a screen, tapping a button or adding an expense), counts that describe your setup (how many accounts, budgets or goals you have, whether reminders and backup are on), the range an expense falls in and its currency, the category type it was filed under (a built-in category, or simply "custom"), your device type, operating system and app version, a randomly generated identifier, and a general location (such as country or region) derived from your IP address. If you use the Apple Pay automation, the app also records that an expense was logged that way. If the app crashes or hits an internal error, we also receive a crash or error report containing a stack trace, the technical place and code of the error and, for errors from Apple's or our payment provider's systems, their own technical description — never your data.
Session recordings. PostHog also records a picture of the screen while you use the app, so we can see where something is confusing. Every amount, balance, budget limit, goal target, note and every name you typed (accounts, categories, payees, budgets, goals) is covered before the picture leaves your device. Recording pauses while you type an amount. One exception: words you type into a search box can show in a recording. Recordings are kept for 30 days.
None of this includes the contents of your ledger: exact amounts, payees, notes and account names stay on your device.
You can read about PostHog's privacy practices at posthog.com/privacy. If you would prefer not to share usage analytics, contact us and we will help.
PostHog also receives, from RevenueCat, when a trial starts or ends and when a subscription is bought, renewed, changed, cancelled or resumed, expires, moves to another install or is refunded, or a payment fails, with the price — tied to the same random identifier as the usage events. Those events also carry the identifier Apple gives your purchase and the device details RevenueCat holds, listed in section 6. They never contain anything from your ledger.
Separately, Apple may provide us with aggregated, anonymised analytics about app usage and crashes if you have opted in to sharing that with developers in your device settings. It is not linked to your identity.
6. Purchases
Buying a subscription is handled by Apple; we never see your payment details. We use RevenueCat to tell whether a subscription is active on your device. RevenueCat receives a randomly generated identifier and the purchase information Apple provides — never your name, your email or anything from your ledger. So that it can pass the events in section 6a to AppsFlyer, RevenueCat also receives the AppsFlyer install identifier, your device’s vendor identifier (IDFV), your IP address and device type, whether you allowed tracking, and, if you did, your device’s advertising identifier (IDFA). RevenueCat also receives the random identifier PostHog uses for your install, so the events in section 5 are filed under it. See revenuecat.com/privacy.
6a. Measuring our ads
We advertise Bolsillo, and to learn which campaign brought you to the app we use AppsFlyer, a mobile-measurement service. AppsFlyer receives an identifier AppsFlyer generates for this install, your device's vendor identifier (IDFV), your device type, operating system and app version, your IP address (used for an approximate country), and a signal each time you open the app. From RevenueCat it also receives when a trial starts, when a subscription is bought, renewed, cancelled or expires, or when a payment fails, together with the price paid. It never receives your transactions, accounts, balances or anything else from your ledger.
The first time you open Bolsillo, iOS asks whether to allow tracking. If you allow it, AppsFlyer also receives your device's advertising identifier (IDFA), so an ad network can tell that its ad led to your install. If you don't, no advertising identifier is shared and the measurement relies only on Apple's anonymous, aggregated SKAdNetwork reports. You can change the choice at any time in iOS Settings → Privacy & Security → Tracking. See appsflyer.com/legal/services-privacy-policy.
7. How we use information
- To read a document you choose to scan.
- To respond to your support requests and feedback.
- To diagnose and fix bugs you report.
- To understand how features are used and improve the app.
- To check whether your subscription is active.
- To measure which of our advertising campaigns bring people to the app.
- To see which parts of the app lead people to subscribe, renew or cancel.
8. Sharing
We do not sell your personal information. We share information only with the service providers that help us run the Service — Formspree (support email), PostHog (product analytics and subscription events), RevenueCat (subscription status), AppsFlyer (measuring our own ads, section 6a), and TypeSafe and OpenAI (reading a document you choose to scan, through our own server, section 3a) — and only as much as each needs. The advertising identifier reaches AppsFlyer, and through it the ad network whose ad you saw, only if you allowed tracking. We may also disclose information if required by law.
9. Data retention
Data on your device is kept until you delete it or remove the app. A document you scan is not kept by our server; TypeSafe and OpenAI keep it as described in section 3a. Support correspondence is kept for as long as needed to help you and to keep a record of our communications, after which it is deleted. Usage analytics and subscription events are kept by PostHog, subscription records by RevenueCat and Apple, and ad measurement data by AppsFlyer, each under their own retention schedule; deleting the app does not remove them, but you can ask us to (section 10).
10. Your rights
Depending on where you live (for example, under the GDPR or CCPA/CPRA), you may have rights to access, correct or delete personal information we hold about you, and to object to or restrict certain processing. Because your financial data stays on your device, you can exercise most of these rights directly — edit or delete it in the app, or uninstall the app. For information we hold from support requests or analytics, contact us using the details below.
11. Children's privacy
Bolsillo is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.
12. Security
We take reasonable measures to protect the information we receive, and data sent to our providers is encrypted in transit. No method of transmission or storage is completely secure.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, give further notice.
14. Contact us
Questions about this policy? Reach us through the support page or at info@geekdevtech.com.