Privacy Policy
Last updated: October 31, 2026 · ภาษาไทย (the Thai version prevails if the two differ)
In short: your financial data does not leave your iPhone/iPad and your own private Apple iCloud (on Android: your device, plus any backup location you choose — see section 5). We have no server that stores your transactions, balances, or accounts. The only things "sent out" are the images/text you ask the AI to read — slips, card statements, order-history screenshots, and voice-note text (to Anthropic, via a Cloudflare Worker). AI requests carry only a "random ID" used to count quota and prevent overuse; it is not your name, email, or Apple ID and does not say who you are.
1. Who we are
DooSpend is an independent iOS and Android app (indie developer) built by Apiwat Pengjam. Contact: hello@doospend.com
2. Data we keep and where it lives
| Data | Where it is kept | Notes |
|---|---|---|
| Income/expense entries, balances, accounts, categories, budgets, installments, subscriptions | On your iPhone/iPad + your own private Apple iCloud | We have no server that stores your financial data, and we cannot see it |
| Books (shared accounts) + the entries in them | Apple CKShare → iCloud shared database | Only people the book's owner invites by link can see it. The owner can end sharing at any time |
| Slip photos (when you tap "Snap slip") | On your iPhone/iPad + private iCloud | Kept until you delete them — Settings → "Image storage" lets you delete them in groups |
| Images/text sent for the AI to read — slips, card statements, order-history screenshots (Shopee/Lazada/etc.) | Sent through a Cloudflare Worker → Anthropic Claude API (US) | Sent only when you use that feature, once, to be read; not stored permanently. A random ID is attached for quota counting (not your name/email/Apple ID) |
| Speech (when you tap "Speak") | Converted to text by Apple's SFSpeechRecognizer (Apple may process the audio on Apple's servers) | Raw audio is not sent to our proxy or to Anthropic — only the transcribed text is passed to the AI. Audio processing follows Apple's policy |
| AI usage (number of uses per month) | Counted at our proxy (tied to the random ID) + shown on your device | Used to check the Free/Pro quota — the same quota applies to every device on the same Apple ID |
| Pro subscription purchases | Apple StoreKit (not through us) | Apple handles billing and stores payment information under Apple's own policy |
3. Data we do not collect
- We use no analytics / tracking SDKs (Google Analytics, Firebase, Facebook SDK, etc.) — the only usage counts are the AI-request counts described in section 4
- There are no user accounts / logins — you can use the app without signing up
- We do not read SMS, contacts, location, calendar, or health data
- We do not sell data to third parties (we have no data to sell)
4. Third-party services we use
4.1 Anthropic Claude (via Cloudflare Worker)
When you use an AI feature, the following images or text are sent through a Cloudflare Worker (our own proxy) to the Anthropic Claude API to read the amount, merchant, and date and to suggest a category: slip images, credit-card statement images/text, order-history screenshots (e.g. Shopee, Lazada, TrueMoney), and voice transcripts. This data may contain financial details (merchant, amount, date) — we send it to the AI only when you ask. The app asks for your consent before sending anything to the AI for the first time (stating clearly what is sent and to whom), and you can turn it off or withdraw consent at any time in Settings › Your data — when it is off, the app sends nothing to the AI.
- Requests carry a random ID (a random UUID created on your device and kept in the Keychain) in the
x-device-idheader, used to count monthly AI quota and prevent overuse. This ID survives deleting and reinstalling the app, but it is not your name, email, or Apple ID and cannot tell who you are. Requests also carry the tier (free/pro), the app version, the platform (iOS/Android), and the name of the entry point you used (e.g. "snap slip", "share", "type") — a fixed label, never your content. We use the random ID and these labels only to count overall usage (how many devices use AI and which entry points are used most); they are not linked to who you are. - Since version 1.8.2 this ID is kept in iCloud Keychain, so every device signed in to the same Apple ID uses the same ID — AI quota is therefore counted together across iPhone and iPad instead of separately. We never receive your Apple ID; only the random UUID is synced, and if you turn off iCloud Keychain the app falls back to an ID for that device only.
- Anthropic does not receive this device ID (only our proxy uses it), and its policy states it does not use API requests to train models (Anthropic Privacy)
- Anthropic processes requests under its Commercial Terms + privacy policy, which provide the same level of protection as described in this policy — inputs/outputs are not used to train models and are kept only temporarily for abuse monitoring, then deleted on Anthropic's schedule
- Our Cloudflare Worker proxy does not log images or content — it records only the number of requests per device ID for quota / rate limiting
4.2 Apple iCloud + Apple StoreKit
Data in the CloudKit database is your own private database under your Apple ID. Apple stores it encrypted and does not read it. We have no access to it.
4.3 Sharing books via CKShare
When you invite others to a book, Apple's CKShare API handles permissions and syncing between the participants' iCloud accounts:
- Invite links work only for Apple IDs the owner allows → people who were not invited cannot open the link
- Data in a shared book lives in the owner's Apple iCloud shared database — Apple handles encryption + access control
- We have no central server for books — when the owner stops sharing, participants lose access immediately
- "Added by: name" on an entry uses Apple's Apple ID record name — not your email or phone number
5. The Android app
The Android app follows the same principles as iOS (no analytics · no user accounts · we have no server that stores financial data). It differs in where data lives and which system services it uses:
| Topic | On Android |
|---|---|
| Financial data, slip photos, settings | On the device only (the app's database) · no syncing between devices, and shared books are not available on Android yet |
| AI reading slips/text | Same as section 4.1 — consent is asked before the first send · sent through a Cloudflare Worker to Anthropic · carries a random ID created on the device (not your name/email/Google account) · this ID does not sync between devices, but it comes back if the device restores the app's data from Google's backup |
| Speech | Converted to text by the Android system speech recognizer (usually Google's, which may process audio on that provider's servers under its own policy) · raw audio is not sent to our proxy or to Anthropic |
| QR scanning / reading text in images | Done on the device (Google ML Kit for QR · Tesseract for text) · ML Kit may send usage and performance metrics about the API itself to Google under ML Kit's terms — no images or financial data |
| Buying Pro | Through Google Play Billing · Google handles payment under Google's policy · the app sends the purchase token + the random ID to our proxy to check with Google Play that the purchase is real — no name, email, or card details |
| Google's backup (Android Backup) | If you have Google backup turned on for the device, Android may copy the app's data to your Google Drive so it can be restored when you reinstall or switch phones · Google stores and encrypts it; we cannot access it · you can turn it off in the device settings |
| Daily auto backup (in the app) | Off by default · when on, the app writes a .json backup file once a day to a folder you choose (keeping the latest 3) · the file contains all your financial data (without attached images) and is not encrypted — if you choose a cloud folder (e.g. Google Drive), the file is under that provider's care and policy · we never receive this file |
| Notifications | Created on the device, not through a server |
6. Deleting data
- Delete a single transaction: swipe it in the list
- Delete slip photos in groups: Settings → "Image storage" → by image age
- Delete everything on the device: delete the app (from the Home Screen) → this removes the data on the device and in your iCloud private database
- Android: Settings → Delete all data, or uninstall the app → removes the data on the device · backup files in the folder you chose and the copy in Google's backup are not deleted with it — delete them yourself in that folder / Google Drive
7. Children
DooSpend is designed for adults (17+ per the App Store rating). The app keeps no separate data about children. If a child uses the app, the data stays on that child's device/iCloud as usual.
8. Changes to this policy
If we change this policy, we will update the date at the top of this page. Significant changes (such as adding a new third party) will also be announced in the app.
9. Privacy contact
Questions or requests about your data — hello@doospend.com