Privacy

The short version

• Everything works with no account and no network. On a phone that has never signed in, nothing you type leaves the device at all.
• An account is optional. It exists so that losing the phone does not lose the books, and so a second device can pick them up.
• Three things leave the phone, and each only when you press a button that says so: a picture you ask to have read, a recording you ask to have transcribed, and — if you have an account — your books and receipt photographs.
• There is no advertising identifier, no tracking across apps or websites, and no analytics package of any kind.
• You can delete your account, and everything in it, from inside the app.

What is kept on your phone

Your businesses, clients, invoices, estimates, line items, payments, expenses, time entries, jobs and saved rates are stored on the device, in the app's own storage. Receipt photographs and job attachments are stored as files beside them. None of this is readable by other apps.

Deleting the app removes all of it. Settings has a way to empty the books without deleting the app, and it says plainly that it cannot be undone.

If you sign in

An account is optional and off until you create one. Signing in uses Apple, Google, or a link or code sent to your email address. There is no password — the app never holds one.

The account holds:

• Your email address and a user id, so the books can be given back to the right person.
• A copy of your books, as one document, which is whatever is on your phone at the time it was last saved.
• Your receipt photographs and job attachments, in private storage. They are readable only through a link the app signs for you, which expires; there is no public address for any of them.

This is hosted on Supabase, in the United States. Rules on the database restrict every row and every file to the account that owns it.

Signing out of a phone leaves the books on it and leaves the account alone. Deleting the account removes the cloud copy and the photographs with it — see Leaving.

Reading a photograph

The receipt scanner and “Read a photo” send one picture to a vision model so that the figures on it can be filled in for you. This happens only when you press the button that says it will read the picture. Nothing is sent in the background, nothing is sent on a timer, and no screen sends a photograph you have not seen.

The picture goes to a server run for this app, which passes it to DeepSeek and returns the text. The picture is not stored on that server. What DeepSeek does with a request is governed by their own terms; at the time of writing, API traffic is not used to train their models.

The scanner keeps the photograph on your phone either way. The reading is a convenience on top of the evidence, not a replacement for it, and a build with no reader configured simply asks you to type the figures.

Speaking an invoice

The voice screen records only while your finger is on the button that says it is recording. When you press the button that says it will read it, the recording is sent to a transcription service and the words come back; you are then shown a draft to check before anything is written. The recording is not kept after that.

Reading a document

Settings › Ask about a document reads a PDF or text file on the phone and shows you the words it found before anything is sent. Only those extracted words and your question go to the model. The file itself never leaves the device.

Permissions, and what each one is for

Camera

Photographing receipts, and reading the words off a job sheet or delivery note.

Photo library

Your business logo, receipts you file as expenses, and pictures you ask the app to read.

Microphone

The voice screen, and only while you hold the button.

Contacts

Filling a client's name, email and phone from a card you pick, instead of typing it again. The app reads the card you choose; it does not read or upload your address book.

Notifications

Reminding you about invoices that have gone overdue. These are made on the phone. Nothing is sent to a server to produce them.

Each of these is asked for at the moment it is first needed, and the app works without any of them.

Sending an invoice to a client

Invoices and estimates are sent using your phone's own mail app or share sheet. The document is handed to the app you choose and goes from your own address. Invoice Koi does not send email on your behalf and does not keep a copy of what you sent or of who you sent it to, beyond the record in your own books.

Leaving

Settings › Account › Delete my account removes your receipt photographs from storage, then deletes the account itself. Your invoices, clients, expenses and everything else in the cloud copy go with it. It is immediate and cannot be undone.

The books on your phone are not touched by this, and keep working without an account. If you want those gone too, delete the app, or use the option in Settings to empty it.

Settings › Import and export writes the whole book to a file first, if you want to keep a copy.

Children

Invoice Koi is a tool for running a trade business. It is not directed at children and is not designed for them.

Changes

If what the app does with your information changes, this page changes with it, and the date at the top changes too. Material changes will be described in the app's release notes rather than only here.

Asking

Questions about any of this, or a request about your own data, go to weijunphang@gmail.com.