Privacy Policy

IOU is made and operated by Enlightened Innovations LLC ("we", "us"). We are the controller of the small amount of personal data described in this policy.

Write to support@ioumoneyapp.com about anything here, including a request to see or delete what we hold. If you need our postal address for a formal request, ask and we will send it to you.

Your ledger data — the people you add, amounts, notes, dates, emoji, due dates, and the receipts and files you attach — is created on your device and stored there. We do not receive your ledger, and there is no account to create. Information you choose to send in a support email is received by us.

The one exception is a receipt image, which is sent to be read. That is described in the next section.

Before the first upload on each device, IOU asks you to allow online receipt scanning. If you agree, receipt images you choose are sent over an encrypted connection to our parsing service — a Cloudflare Worker we operate — which passes it to Anthropic's Claude API to read the merchant, line items, tax, tip and total. The result comes straight back to your phone.

What travels with the image:

• The date you captured it.
• A fixed key that identifies the app itself, not you. It is the same in every copy of IOU.
• The standard request information your iPhone sends, such as the app version and iOS version.

IOU does not attach your ledger, participant list, Apple Account or a device identifier to the request. The photo itself may contain personal information printed on the receipt, such as a name, address or payment details. Our parsing service stores no part of the image — it exists only in memory for the moment the request takes. Anthropic processes receipt images and extracted results under its API terms. Its published API retention policy describes deletion within 30 days by default, with exceptions including legal and safety requirements. IOU does not promise zero retention by Anthropic. Cloudflare processes standard request information, including your IP address; service and error logs may be retained under the applicable service configuration and provider policies.

To stop the free service being abused, the Worker counts requests against your IP address — one count per minute and one per day. The daily counter expires by itself roughly 25 hours after it is written. We do not use these counters to identify you or to build any profile.

If your phone is offline, the scan waits in IOU and can upload automatically when connectivity returns and online scanning is allowed. With iCloud Sync enabled, pending scans can also sync to your other devices. You can turn off new uploads in Settings → Receipt Scanning → Turn Off Online Scanning. An upload already sent may finish; queued receipts remain until you delete them or allow scanning again.

Contacts access is optional, and IOU works without it. When you allow it, IOU reads your contacts to find someone as you type their name, to show their photo beside a balance, and to link your own card as "Me".

When you pick someone, IOU copies their name, their phone numbers and their email addresses into its own store, along with a reference to the contact. The numbers and addresses are kept so IOU can recognise the same person again, including on another one of your devices. Photos are never copied; they are read from Contacts each time they are shown.

Names, phone numbers, email addresses and entry details are also added to Spotlight's index so you can find entries from your phone's search. That index stays on your device. None of this is sent to us.

IOU has no third-party analytics, advertising or crash-reporting SDKs and does not track you across other companies' apps or websites. Our parsing service and website process network request information, including IP addresses, to deliver the service and prevent abuse. The app's privacy manifest discloses receipt-photo processing for app functionality and declares no tracking.

The app keeps a couple of counters on the device to decide when to show the IOU Pro screen. They never leave your phone.

This website uses no analytics, advertising, cookies, browser storage, embedded third-party media or contact forms. Cloudflare hosts the site and processes request information, including IP addresses, to serve pages and protect the service. Email links open your email app; we receive only what you choose to send.

IOU Pro is sold through Apple's In-App Purchase. Apple handles the payment; we never see your card details, billing address or Apple Account email. The app checks Apple's signed purchase information on your device to decide whether to unlock IOU Pro. Apple may also provide developers with sales reports and transaction or subscription notifications under its developer services; these do not give us your payment-card details.

The number of receipt scans you have used in the current month is kept in your own iCloud so the free limit behaves the same way on each of your devices.

iCloud sync is off until you turn it on in Settings → iCloud Sync. With it on, your ledger — people, entries, receipts and their images, attachments and pending scans — syncs through your own private iCloud database. That database belongs to your Apple Account; we cannot read it.

Separately, IOU always uses iCloud's small settings store for three things: which contact you linked as "Me", the app's internal identifier for you, and the number of scans used this month. No balances and no other people's details are kept there.

Your device backups may also include IOU's data. Those backups are governed by Apple's terms, not ours.

• On your device: until you delete the entry, the person, or the app.
• In your iCloud, if you turned sync on: until you delete the data or remove it from iCloud in your device settings.
• Receipt images at our parsing service: not stored at all.
• Abuse-prevention counters: automatically expire within roughly 25 hours.
• Service request and error logs: retention depends on the provider and service configuration.
• Support email and anything you attach: kept while needed to answer you and retain a record of the request, then deleted.

Three companies are involved, each for one job:

• Apple — iCloud sync and backups, and In-App Purchase. Data stays in your own Apple account.
• Cloudflare — hosts our receipt-parsing service and this website, and keeps standard request logs.
• Anthropic — reads the receipt image you scan and returns the line items.

We sell nothing, we run no advertising, and we do not hand your information to anyone for their own marketing.

Depending on your location and applicable law, you may have rights to access, correct, export or delete personal data, restrict or object to processing, and withdraw consent. Withdrawing consent does not undo processing that already occurred. Because almost everything lives on your device, you can act on most of these yourself: read it in the app, edit it, export it from Settings → Backup & Restore → Export Backup, and delete it.

For anything on our side, write to support@ioumoneyapp.com. Depending on where you live you may also have the right to complain to your data-protection authority.

You can erase entries and people in the app, delete the app to remove its data from your phone, and clear the iCloud copy from your device settings if you turned sync on. The Data Deletion Request page sets out each route step by step, and how to ask us in writing.

IOU is not directed at children, and it is not designed for them. Do not use IOU if you are under 13, or under the age at which your country lets you consent to the processing of your data. We do not knowingly hold information about a child; if you believe we do, tell us and we will delete it.

We operate from the United States. Apple, Cloudflare and Anthropic may process data in the United States and other countries where they operate. Online scanning and support requests may therefore involve international transfers, governed by applicable law and the providers’ contractual safeguards. Your ledger otherwise stays on your device and in your own iCloud, unless you choose to export or share it.

Receipt images travel over an encrypted HTTPS connection. Your ledger is protected by your device's own protections — passcode, Face ID or Touch ID, and disk encryption — and by your Apple Account if you sync.

The strongest protection is structural: we hold no ledger, no accounts and no passwords, so there is no store of your balances for anyone to breach. No safeguard is perfect, and we cannot promise that a determined attacker will never succeed.

When this policy changes we update the date at the top of the page. If a change materially affects what happens to your information, we will say so in the app's release notes as well.

Enlightened Innovations LLC · support@ioumoneyapp.com. We answer privacy questions and requests within two working days, and complete them as quickly as we can after that.