Privacy policy

Household Expenses Tracker (HET), an app for phones. Effective from 26 October 2026.

Polityka prywatności po polsku

In short

• Your budget (expenses, income, categories, plans, challenges) stays on your device only. I never receive it.
• The app has no accounts, ads, analytics, tracking or payments.
• The app goes online only for the receipt scan, and sends a photo only after you agree. The photo goes through Cloudflare and my scan service to Anthropic (the Claude model) in the USA. The scan service does not save it.
• You withdraw your consent by turning off Scan receipts in Settings.
• The app is for people aged 16 or older.

Controller and contact

The controller is Mateusz Patyk, a private person and the author of the app. Contact for every privacy matter: privacy@het.com.pl. I have not appointed a data protection officer, as I am not required to.

Budget data on your device

Everything you enter (expenses, income, categories, monthly plans, challenges and deposits, notes, tags, the name given in the setup, settings) is saved by the app on your device. It is not sent to me or anyone else, so I do not process it.

• System backup. Android may copy the app's data to your Google account (backup to Google Drive) if you have it turned on in your phone. This happens in your account, under Google's terms, without my knowledge or access. iCloud backup on an iPhone works the same way.
• Backup and CSV export. The app saves the file in a folder you choose. If that folder syncs with a cloud, the cloud provider processes the file under your agreement with them.
• Deletion. Uninstalling the app, clearing its data in the system settings, or Delete all data in the app's Settings removes the data from the device. Copies saved in a folder you chose are deleted there.

Receipt scan

What is sent: the cropped photo (JPEG, at most 1600 pixels on the longer side), the names of your expense categories (so the AI can assign the purchases to them) and, as with any internet connection, your IP address. The answer holds the entries (category, amount, date, shop), the total printed on the document and the receipt's lines. It reaches only your device, where you save the entries if you accept them.

Why: to read a receipt, an invoice or a screenshot of a payment and turn it into expenses.

Legal basis: your consent (Art. 6(1)(a) GDPR). A receipt may reveal health data, for example a purchase of medicines, so it is explicit consent (Art. 9(2)(a) GDPR). You give it with AGREE AND SCAN on the crop screen, below the description of where the photo goes. Nothing is sent before you agree.

Voluntary: consent is voluntary. Without it the scan does not work, the rest of the app works as usual.

Withdrawing consent: turn off Scan receipts in Settings. Withdrawal does not affect the lawfulness of earlier scans.

The photo's path: your device → Cloudflare (network, tunnel and firewall, which decrypts the connection, so it can technically see the photo and the IP address) → my scan service scan.het.com.pl → Anthropic (the Claude model API) in the USA.

Retention: the scan service does not save the photo or the answer, it keeps them in memory only for the request. Anthropic deletes data sent through its API within 30 days, longer only when the request is flagged as violating its usage policy (up to 2 years) or when the law requires it. Anthropic does not use this data to train models.

AI result: entries made by the AI are marked as AI and shown for review before they are saved. You can correct or reject them. Do not photograph documents with other people's data or card numbers.

Availability check: when the app starts and when the expense form opens, the app asks the scan service whether it works. This request carries none of your data except the IP address, which every server on the internet sees. The scan service does not save it.

Limit of 10 scans a month

Scans are free, but each one costs money. So that nobody uses them up for others, the service counts scans per IP address. It does not store the address itself, only 16 characters of its hash (SHA-256 with a secret salt) and the number of scans. The list is replaced by a new one at the first scan of the next month. The service's logs hold 8 characters of the hash, the photo's dimensions, the result, the time and the cost of the request, without the IP address, the photo or any content, and are deleted after 30 days.

Legal basis: my legitimate interest (Art. 6(1)(f) GDPR): protecting a free service from abuse and costs, and detecting failures. The data is shortened, pseudonymised and kept briefly, so it does not override your interests. I cannot tell who you are from the hash (Art. 11 GDPR). To exercise your rights over this data, write to me with your IP address and the month of the scan, and I will check whether anything is stored.

Email

When you write to privacy@het.com.pl, I process your address and the message to reply (Art. 6(1)(f) GDPR). I keep the correspondence for a year after the last message. The mailbox is run by Google (Gmail).

This website

This website uses no cookies and no analytics. It is hosted by Cloudflare (Cloudflare Pages), which logs technical data of requests, such as the IP address, for security and operation (Art. 6(1)(f) GDPR).

Android permissions

• Internet (INTERNET, ACCESS_NETWORK_STATE): only the receipt scan and the check whether it works.
• Storage (WRITE_EXTERNAL_STORAGE): saving backups and exports on older Android versions. You still choose the file and the folder.
• Camera: the app has no camera permission. It opens the system camera app and receives only the photo you take. A photo from the gallery is picked in the system window.

Recipients

• Anthropic (Anthropic, PBC, USA): reads the receipt. A processor under its Data Processing Addendum.
• Cloudflare (Cloudflare, Inc., USA): network and protection of the scan service, hosting of this website. A processor under its Customer DPA.

I do not sell data and share it with no one for marketing.

Transfers outside the EEA

Anthropic and Cloudflare process data in the USA. The basis is the European Commission's standard contractual clauses (Decision 2021/914, Art. 46(2)(c) GDPR), included in their data processing agreements. Write to me for a copy of these safeguards.

How long

• Budget data: on your device until you delete it.
• Scan photo and answer: not stored by the scan service, up to 30 days at Anthropic (longer in the exceptions above).
• IP hash for the limit: until the first scan of the next month.
• Scan service logs: 30 days.
• Email: a year after the last message.

Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it, object to processing based on legitimate interest, and withdraw consent at any time. Write to privacy@het.com.pl, I will answer within a month. Your budget data is with you: you export it as CSV or a backup and delete it in the app. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority of your EU country.

Profiling and automated decisions

I do no profiling and make no automated decisions about you. A scan result is a suggestion, you decide whether to save it.

Age

The app is intended for people aged 16 or older (Art. 8 GDPR). It is not intended for younger people.

Changes

When I change this policy, I will change the date at the top and describe the change on the News page. Previous versions will be available in an archive on this website.