Data & Permissions

A plain-language explanation of every device permission CountaBill requests, every third-party service it connects to, and exactly why each one is needed. Nothing is collected or shared beyond what is described here.

Device permissions

CountaBill requests the following device permissions. Each permission is requested only when you first use the feature that needs it — never upfront on install.

📷 Camera Optional

Used to take photos of receipts for AI-powered extraction.

When it's used: only when you tap "Scan Receipt" and choose to take a new photo. The camera is not accessed at any other time.
Can I use the app without it? Yes. You can upload receipt photos from your gallery instead, or enter transactions manually. Receipt scanning requires either camera or gallery access.

🖼️ Photo Library Optional

Used to select an existing photo from your gallery for receipt scanning.

When it's used: only when you choose "Select from gallery" in the receipt scanner.
Can I use the app without it? Yes. You can use the camera directly to capture receipts, or enter transactions manually.

📍 Location (When in Use) Optional

Used in the moment you scan a receipt, to work out which shop the slip came from and to let you set or correct that shop on a map.

When it's used: only at the moment you scan a receipt. The app does not track your location at any other time and does not run location services in the background.
What we store, and where: the coordinates for a scan are kept on your device, against that scan — they are not uploaded to our servers. The pin that identifies a merchant does sync to your account, so the same shop is recognised on your other devices.
If you share price data: the location attached to a price observation is first reduced to an approximate area of roughly 1 km. Price sharing is off unless you turn it on.
Can I use the app without it? Yes. Location is entirely optional. Receipt scanning works without it — you just set the shop yourself instead.

👤 Split names Not a permission

The app does not request access to your device contacts. When splitting a bill, you type names manually.

Where names are stored: split names, and any phone or WhatsApp number you choose to save against one so you can send a reminder, are held in your device's secure storage (iOS Keychain) only — deliberately never uploaded to our servers, because they are another person's details rather than yours to share.
Payment requests: when you send a reminder, the app uses the system share sheet (WhatsApp, Messages, email, etc.) with a plain message like "Please pay R X for [item]" — no banking details included.

🔔 Notifications Optional

Used to send push notifications for store specials and price changes on items you follow.

When it's used: only when you follow a store in the Insights tab and a price change is detected for an item you have previously purchased.
Can I use the app without it? Yes. All features work without notifications. You can check the Specials section manually in the Insights tab at any time.

You can review and revoke any permission at any time in your device's Settings > Privacy & Security. Revoking a permission means the related feature will not be available until you re-enable it.

Third-party services and integrations

CountaBill connects to the following third-party services. We have selected each one because it provides the best available option for the required function. No personal financial data is shared with any of these services beyond what is explicitly described.

Firebase Auth
Google LLC Manages your account login. Supports email/password and Sign in with Apple. Email address, authentication tokens.

Cloud Firestore
Google LLC Cloud database that stores your financial data (transactions, budgets, income, settings) when you are signed in, so it syncs across devices. Your transaction, budget, and income records. Accessible only to your account.

Firebase Crashlytics
Google LLC Captures crash reports automatically so we can fix bugs. Sends a stack trace and device info when the app crashes. Device model, iOS version, app version, and crash stack trace. Does not include financial data.

Firebase Analytics
Google LLC Tracks which features are used in aggregate so we can prioritise improvements. All analytics are anonymised. Anonymised usage events (e.g. "receipt scan started", "budget created"). No financial amounts or personal details.

Firebase Cloud Messaging (FCM)
Google LLC Sends push notifications for store specials to devices that have followed a store. Your device push token (an anonymous device identifier). Sent when you enable notifications.

Google Gemini
Google DeepMind AI model used for receipt text extraction. The receipt image is sent to Gemini via our secure Cloud Functions and line items are extracted. The receipt image only. No account information, name, or financial history is attached.

Nominatim / OpenStreetMap
OpenStreetMap Foundation Converts merchant names from receipt scans into map coordinates (geocoding), so the app can suggest which shop a slip came from and show it on the map when you set or correct it. Merchant name strings only (e.g. "Checkers, Claremont"). No personal data.

Data storage location

All Firebase services (Firestore, Auth, Crashlytics, Analytics, FCM) store data in the United States on Google infrastructure. Google complies with SOC 2 and ISO 27001 standards. All data in transit is encrypted via TLS 1.2 or higher.

International transfers

As a South African user, your data is transferred to the United States for cloud storage and AI processing. This is done under standard contractual safeguards as recognised under POPIA. We have no practical alternative to using US-based cloud infrastructure for the AI and sync features CountaBill depends on.

Your data controls

You are in control of your data. Here is what you can do at any time:

Opt out of analytics: Settings > Data & Privacy > toggle off Analytics. Firebase Analytics will stop collecting usage events.
Opt out of receipt data collection: Settings > Data & Privacy > toggle off Receipt Data. Scans will continue to work but your anonymised receipt data will not be retained for AI training.
Disable notifications: Settings > Data & Privacy or your device's Settings > Notifications > CountaBill.
Revoke location permission: device Settings > Privacy & Security > Location Services > CountaBill.
Export your data: Settings > Profile > Export my data. Downloads a copy of all your records.
Delete your account and all data: Settings > Profile > Delete account & data. Permanently removes your Firebase account and all associated cloud data. Local device data is also cleared.
Exercise POPIA rights: email support-budget.app@logicalsolutionsinnovations.com to request access to, correction of, or deletion of your personal data.

What we do not do

We do not sell your personal data to any third party.
We do not share your financial records, transaction history, or income data with any third party, except as required by law.
We do not read your SMS messages. The app has no SMS feature and asks for no messaging permission.
We do not run location services in the background.
We do not upload the GPS coordinates of where you scanned a receipt — those stay on your device.
We do not use your data to serve you targeted advertising.
We do not access your device contacts — split names are typed manually and stored in device secure storage only.