Privacy Policy

Scope and who is responsible

This Privacy Policy applies to the Invoices iPhone app, Shared Invoice, AI Import, the Invoices website, and related support. BitForge Pte. Ltd. (“BitForge,” “we,” “us”) is the organization responsible for the personal data described here. Apple and any cloud provider you choose also act under their own privacy terms for their services.

Information stored on your device and in iCloud

Invoices lets you create invoices, estimates, clients, price-book items, payments, photos, signatures, stamps, business settings, recurring invoice settings, trash state, and numbering state. This business content is stored locally on your device with Core Data.

When Apple's CloudKit sync is available and enabled, app data may be mirrored in the Apple account signed in on the device. Apple controls that account and iCloud storage. BitForge does not receive a copy merely because the app uses CloudKit.

Account and service data

Invoices uses Supabase for authentication and service records. We may process an account identifier, authentication and session records, profile or settings records, subscription status, security and abuse-control records, and related operational metadata.

If you deliberately use Shared Invoice, Supabase stores the private frozen PDF revision you publish, limited display metadata, participant account identifiers, and lifecycle activity needed to provide and revoke access. Shared Invoice does not upload your complete local business, client, or invoice database and does not create a public link.

AI Import

AI Import runs only after you choose the feature and confirm that the selected document may be sent for analysis. The PDF or image you select is uploaded over an encrypted connection to a Supabase Edge Function and then sent to OpenAI's Responses API to extract proposed invoice or estimate fields.

Our function requests store=false, does not place the source document in Supabase Storage or a server invoice table, and is designed not to log the raw document or extracted personal data. OpenAI may nevertheless retain limited API content in abuse-monitoring logs for up to 30 days under its current API data controls, unless account-specific controls reduce that period. We do not use AI Import documents to train our own models or intentionally opt them in to provider model training.

AI output can be incomplete or wrong. It remains an editable proposal: Invoices does not automatically save, send, charge, approve, or make a decision with legal or similarly significant effects. You must review the result and should use only documents you have authority to process.

Purchases, analytics, attribution, and diagnostics

Apple and RevenueCat handle purchases and subscriptions. We may receive product, entitlement, renewal, cancellation, transaction-event, and pseudonymous app-user information needed to unlock features, restore purchases, prevent fraud, and answer billing questions. We do not receive full payment-card details from Apple.

We process limited app events and Apple Search Ads attribution to understand onboarding, feature health, paywall performance, and purchases. The current production configuration does not activate third-party Sentry crash reporting. If Sentry is activated later, we will update the applicable notices and App Store disclosures before diagnostic collection begins.

Support and website data

The private support form is provided by AppTriage. When you submit it, AppTriage may process the message, an email address you provide, browser and device metadata, language, timezone, screen information, and country-level location derived from the network address. We use this information to route, protect, investigate, and respond to the request.

The public website may receive ordinary hosting and security logs such as network address, request time, requested page, browser type, and security events from its hosting provider.

Exports and other providers

If you export to Google Drive, Dropbox, OneDrive, iCloud Drive, or another destination, the file is sent only to the destination you select and is then controlled by that provider and your account settings.

Service providers and recipients may include Apple (App Store, iCloud, and attribution), Supabase (authentication and backend functions), OpenAI (AI Import analysis), RevenueCat (subscription entitlement), AppTriage (support), the hosting provider for this website, and a cloud-export provider you choose. They may process data only for the relevant service, subject to their agreements and applicable law.

Relevant provider notices include Apple Privacy, Supabase Privacy, OpenAI API data controls, RevenueCat Privacy, and AppTriage Privacy.

Purposes and legal bases

• Perform our contract with you by providing app features, authentication, Shared Invoice, subscriptions, and requested support.
• Act on your request or consent when you choose AI Import, a cloud export, optional permissions, or a support submission. You may withdraw consent for future processing, but this does not undo processing already completed lawfully.
• Pursue legitimate interests in securing the service, preventing fraud and abuse, measuring reliability, understanding product performance, and improving support, where those interests are not overridden by your rights.
• Meet legal obligations involving tax, accounting, consumer protection, security, disputes, and valid government requests.

No sale, behavioral advertising, or cross-app tracking

BitForge does not sell personal information, does not share it for cross-context behavioral advertising, and does not use third-party advertising SDKs to track you across other companies' apps or websites. If this practice changes, we will provide the notices and choices required by law before the change applies.

Retention

• Local and CloudKit content remains until you delete it, remove app data, or change the relevant Apple account or iCloud settings.
• Account and service records remain while the account is active and are removed or de-identified after a valid deletion request, except where limited records are needed for security, fraud prevention, accounting, disputes, or legal compliance.
• A Shared Invoice copy remains until access is revoked, a participant account is deleted, or it is no longer needed to provide the feature.
• AI Import source bytes are used for the requested analysis and are not intentionally persisted by our backend. OpenAI's limited abuse-monitoring retention is described above.
• Support, analytics, attribution, purchase, and website-security records are kept only as long as reasonably needed for the stated purpose, then deleted, aggregated, or de-identified unless law requires longer retention.

International processing

BitForge and its providers may process information in countries other than yours. Where required, we use contractual or other legally recognized safeguards and assess provider protections for international transfers. Local and iCloud content remains subject to the device, Apple account, and provider choices described above.

Your rights and choices

Depending on where you live, you may have rights to know or access personal data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, appeal a denied request, and complain to a privacy regulator. Where applicable, you may also ask about categories, sources, purposes, and recipients of personal information. We will not discriminate against you for exercising a privacy right.

Submit a request through the private support form. We may request information reasonably needed to verify identity, authority, and the account involved. An authorized agent may submit a request where local law permits.

Account deletion and subscriptions

Deleting an account in the app removes the Supabase authentication account and supported user-owned server rows, removes private Shared Invoice PDFs where you are a participant, and signs you out. It does not automatically erase local device data, Apple CloudKit data, files exported to another provider, App Store purchase history, or limited entitlement records needed for restoration.

Some analytics, revenue, attribution, security, and idempotency records may be retained for the purposes described above and, where supported, detached from the deleted account. Deleting the account or app does not cancel an Apple subscription; subscriptions must be managed in Apple account settings.

Security and incidents

We use technical and organizational measures designed to protect information, including encrypted transport, authenticated backend requests, access controls, and data-minimizing service contracts. No method is completely secure. If a breach creates a legally reportable risk, we will notify affected people and regulators as required.

Children

Invoices is a business tool and is not directed to children under 13. We do not knowingly collect personal information from a child under 13 without legally valid authorization. If you believe a child provided personal information, contact us so we can investigate and delete it where required.

Changes and contact

We may update this policy as the app, providers, or law changes. We will update the effective date and provide any additional notice required for a material change. For questions, complaints, or privacy requests, contact BitForge through the private support form.