隐私政策Privacy Policy

保存在设备上的数据

以下内容保存在这台设备上（使用 SwiftData 数据库和本机设置）：

• 账单：商家、金额、日期和时间、分类、备注、支付方式、收入或支出、所属账本、成员、识别出的收据文字，以及你添加的地点
• 你选择保留的收据图片
• 自定义分类、账本和成员
• 周期账单（例如房租、订阅）及其提醒设置
• 每月、每年和各分类的预算
• “这个商家上次用的分类”
• “最近取消”中的识别结果（保留 7 天，之后自动删除）
• 已生成的 AI 分析结果
• App 的各项设置

导出的 CSV 文件和完整备份文件由你自己保管。通过系统分享发出之后，接收方如何处理由接收方决定。

iCloud 同步

“iCloud 同步”是帐旅 Pro 功能，默认关闭，需要你在设置中手动开启。

• 开启后，账单（包括收据图片、识别出的文字和地点）、自定义分类、周期账单、账本和成员会保存在你自己 iCloud 账户的 CloudKit 私有数据库中，并在登录同一 Apple 账户的设备之间同步。
• 预算、商家分类记忆、AI 分析结果和 App 设置不会同步，只保存在各自的设备上。
• 这些数据存放在你的 iCloud 账户中，开发者无法访问。数据的存储和传输由 Apple 提供，适用 Apple 的 iCloud 条款和隐私政策。
• 为了及时得知其他设备上的更改，系统会通过 Apple 推送通知服务向帐旅发送静默通知。这些通知由 Apple 的 iCloud 服务发出，开发者没有推送服务器，也不会收到推送令牌。
• 关闭“iCloud 同步”后（下次打开 App 时生效），账单继续保留在这台设备上，之后的修改不再上传。已经保存在 iCloud 中的副本会保留，直到你删除它（见“数据保留和删除”）。
• 订阅结束后，同步会暂停，账单仍保留在这台设备上。

小组件、实时活动和分享扩展

帐旅的 App、小组件和分享扩展通过同一个 App Group 共享容器交换数据。这个容器位于你的设备上，数据不会因此离开设备。

• 主屏幕和锁定屏幕小组件：App 把当前账本本周、本月、今年的支出合计、预算余额和本月最多的分类写入共享容器，小组件在本机读取并显示。没有有效的 Pro 订阅时，小组件不显示这些数字，而是显示升级提示。
• 控制中心的“扫描收据”控制：只用于打开 App 的扫描界面，不读取账单数据。
• 实时活动（锁定屏幕和灵动岛）：只在本机显示当前这次识别的进度，不通过远程推送更新。
• 分享扩展和快捷指令：你从其他 App 分享收据图片给帐旅时，扩展会把图片保存到共享容器的收件箱。帐旅下次打开时读取这些图片并进行识别，处理后立即从收件箱删除。

相机和相册

• 相机只在你拍摄收据时使用。
• 相册只在你选择收据图片时使用。
• 如果开启了“保存后询问删除原照片”，从相册导入的收据保存后，App 会询问是否删除相册中的原照片。删除的照片会进入“最近删除”，30 天内可以恢复。你可以拒绝，也可以在设置中关闭询问。
• 收据图片不会上传到开发者的服务器或 AI 服务。开启“iCloud 同步”时，保留的收据图片会随账单保存到你的 iCloud 账户。

位置

• 你点按“添加当前地点”，或开启自动添加地点后当场拍摄收据时，App 会在获得系统权限后获取一次位置，不会在后台持续定位。搜索地点不要求获取当前位置；搜索词及已有地点的附近范围（如有）会发送至 Apple 地图服务以查找结果。
• 坐标会发送给 Apple 的地图服务以获取地名，适用 Apple 的隐私政策。坐标和地名随这笔账单保存在设备上；开启“iCloud 同步”时也会保存到你的 iCloud 账户。
• 位置不会发送给开发者或 AI 服务。
• 你可以在设置中关闭“记账时添加地点”。关闭后不再提供定位，已保存的地点仍会保留，你可以在账单中删除。

文字识别和 AI 功能

“AI 功能”默认关闭。只有你在首次使用引导或设置中明确同意后才会开启；你可以随时关闭。

收据识别

1. 帐旅先在设备上使用 Apple 的 Vision 框架从图片中读出文字。这一步不会离开设备。
2. “AI 功能”开启时，读出的文字会发送到开发者部署在中国大陆的服务器（火山引擎函数服务 veFaaS，华北 2（北京）cn-beijing 区域），由服务器转交给火山引擎方舟平台上的豆包大模型，整理出商家、金额、分类、日期和备注。
3. 请求中只包含：识别出的收据文字、当天日期、你的自定义分类名称（最多 20 个），以及识别轮次。请求中不包含图片、账单数据库、地点、预算或周期账单。
4. 如果云端连接或处理失败，且系统报告本机模型可用，帐旅会自动切换至 Apple Intelligence，无需手动选择。App 先用 Vision 读取图片文字，再由设备端语言模型整理文字，并非把收据图片直接交给 Apple Intelligence。若模型不可用或本次解析失败，则使用本地规则整理。设备端模型与本地规则处理均在设备上进行，不会为这一步再次向开发者或云端 AI 发送收据内容。

Apple Intelligence 需设备和系统支持、在系统设置中已开启且模型已就绪；支持的语言和地区以 Apple 当前提供的服务为准。自动回退不会撤回此前可能已发送到云端的文字，也不代表整次识别始终离线。确认页会标明“云端 AI”“Apple Intelligence”或“本地规则”等来源，并提示核对后保存。

收据上如果印有姓名、电话、地址、会员号或卡号后几位，这些文字会包含在识别结果中一起发送。请不要拍摄与记账无关的文件。

支出分析

统计页的“AI 分析”是帐旅 Pro 功能，只在你点按之后才会发送请求。请求包含当前账本、当前时间范围的汇总：

• 账本名称、时间范围
• 支出和收入合计，以及上一期的支出和收入合计
• 已设置预算时的预算金额和已支出金额
• 各分类合计（最多 12 项）、支出最多的商家及金额（最多 8 项）、按时间的趋势（最多 40 项）
• 按成员的合计及成员名称（最多 6 项）
• 界面语言（中文或英文）

请求中不包含备注、收据图片、收据文字、地点或逐笔账单列表。

开发者服务器处理什么

• 为防止滥用，每个请求都会附带一个随机生成的安装标识符和签名。这个标识符由 App 首次使用时生成并保存在本机钥匙串中，不与你的 Apple 账户、姓名或广告标识符关联。
• 服务器只把安装标识符和 IP 地址的单向哈希值用于次数限制计数。这些计数会在 2 天内自动过期。
• 服务器的访问日志只记录请求结果状态、耗时、安装标识符的哈希值和错误类型，不记录收据文字、统计汇总、AI 返回的内容或图片。
• 服务器不保存收据文字、统计汇总或 AI 返回的结果。转交给火山引擎方舟后，文字如何处理适用火山引擎的服务条款和隐私政策。

关闭 AI 功能

关闭“AI 功能”后，App 不会再向开发者的服务器或任何云端 AI 发送内容，正在进行的请求也会取消。拍照识别也随之停用，你仍然可以手动记账。统计页不再生成新的分析；以前生成的分析仍保留在这台设备上，并标明是此前生成的。

AI 生成的内容

AI 整理的结果会在确认页标明来源（例如“由云端 AI 识别”），保存前你可以修改。统计页的分析以“AI 分析”标示。AI 生成的内容可能不准确，仅供参考，不构成财务建议。

帐旅 Pro 和 Ultra 订阅

• 新用户可在 App 内免费使用全部 Pro 功能 14 天，无需先订阅，试用结束不会自动扣款。到期后恢复免费版权限，已有账单及自定义图表配置保留，Pro 专属功能需有效订阅才能继续使用；Ultra 专属权益不包含在 Pro 试用中。
• Pro 和 Ultra 均提供按月或按年的自动续期订阅，价格和周期以购买页面显示为准。
• 购买、续订、退款和付款均由 Apple 通过 App Store 处理。开发者不会收到也不会保存你的付款信息、Apple 账户信息或联系方式。
• App 只通过 StoreKit 向 Apple 查询订阅是否有效，并在本机缓存这一结果，以便在启动时和小组件中使用。
• 你可以在 iPhone 的“设置 > [你的姓名] > 订阅”中管理或取消订阅。

通知

• 预算提醒、周期账单提醒和识别完成提醒都是在设备上生成的本地通知，需要你允许后才会发送。
• 开发者没有推送服务器。启用“iCloud 同步”时，Apple 的 iCloud 服务会发送静默通知，用于告知 App 有新的更改，这些通知不会显示给你。

App 锁

开启“App 锁”后，帐旅使用系统的面容 ID、触控 ID 或设备密码进行验证。验证由 iOS 完成，App 只会得到“成功”或“失败”的结果，生物识别数据不会提供给 App，也不会离开设备。

问题报告

“摇一摇报告问题”默认开启，可以在“设置 > 高级”中关闭。摇动 iPhone 时，App 会截取当前屏幕并打开报告页面，此时不会发送任何内容。只有你在报告页点按“发送”，你写的描述、App 版本、系统版本、设备型号和语言，以及截图（可以选择不附带），才会通过你自己的邮件或系统分享发出。App 锁定时不会截图。

数据保留和删除

• 在 App 内，你可以逐笔删除账单，也可以在设置中使用“删除全部账单”。开启“iCloud 同步”时，删除操作会同步到 iCloud 和你的其他设备。
• 删除帐旅后，系统会删除这台设备上的数据和共享容器中的数据。
• 保存在 iCloud 中的数据不会因删除 App 而删除。你可以在 iPhone 的“设置 > [你的姓名] > iCloud > 管理账户储存空间”中找到帐旅并删除其数据；也可以在仍开启同步时先在 App 内删除账单，再关闭“iCloud 同步”。
• 开发者服务器上的次数限制计数会在 2 天内自动过期。访问日志不含可以识别你身份的信息。
• 由于开发者不保存你的账单，也无法访问你的 iCloud 数据，开发者无法替你查看、导出或删除这些数据。你可以随时在 App 内导出 CSV 或完整备份。

儿童

帐旅不是面向儿童的服务，开发者不会有意收集儿童的个人信息。请不要让儿童使用帐旅拍摄含有个人信息的收据。

政策变更

如果数据的使用方式发生实质变化，开发者会更新本政策并修改上方的日期，必要时在 App 内提示。

Data stored on your device

The following is stored on this device, in a SwiftData database and local settings:

• Expenses: merchant, amount, date and time, category, note, payment method, income or expense, ledger, member, the recognized receipt text, and any location you add
• Receipt images you choose to keep
• Custom categories, ledgers, and members
• Recurring bills and their reminder settings
• Monthly, yearly, and per-category budgets
• The category you last used for each merchant
• Recognition results in Recently Canceled (kept for 7 days, then deleted automatically)
• AI insights you have generated
• App settings

CSV exports and full backup files are yours to keep. Once you share them through the share sheet, how the recipient handles them is outside this policy.

iCloud Sync

iCloud Sync is a PennyTrace Pro feature. It is off by default and you turn it on in Settings.

• When it is on, your expenses (including receipt images, recognized text, and locations), custom categories, recurring bills, ledgers, and members are stored in the private CloudKit database of your own iCloud account and synced across devices signed in to the same Apple Account.
• Budgets, merchant category memory, AI insights, and app settings are not synced. They stay on each device.
• This data is in your iCloud account and the developer cannot access it. Apple stores and transmits it under Apple’s iCloud terms and privacy policy.
• To learn about changes made on your other devices, the system delivers silent notifications to PennyTrace through the Apple Push Notification service. These are sent by Apple’s iCloud service. The developer has no push server and does not receive a push token.
• If you turn iCloud Sync off (it takes effect the next time you open the app), your expenses stay on this device and later changes are no longer uploaded. The copy already in iCloud remains until you delete it (see “Data retention and deletion”).
• If your subscription ends, syncing pauses and your expenses stay on this device.

Widgets, Live Activities, and the share extension

The PennyTrace app, its widgets, and its share extension exchange data through a shared App Group container. This container is on your device, so using it does not send data anywhere.

• Home Screen and Lock Screen widgets: the app writes this week’s, this month’s, and this year’s spending totals for the current ledger, remaining budget, and this month’s top category to the shared container, and the widgets read and display them on the device. Without an active Pro subscription, widgets show an upgrade prompt instead of these numbers.
• The Scan Receipt control in Control Center only opens the app’s scanner. It does not read your expenses.
• Live Activities (Lock Screen and Dynamic Island) show only the progress of the current scan, on the device. They are not updated by remote push.
• Share extension and Shortcuts: when you share a receipt image to PennyTrace from another app, the extension saves the image to an inbox in the shared container. The next time PennyTrace opens, it reads and recognizes the image, then removes it from the inbox right away.

Camera and photo library

• The camera is used only when you photograph a receipt.
• The photo library is used only when you choose a receipt image.
• If Ask to Delete Original Photos is on, after you save a receipt imported from your photo library, the app asks whether to delete the original. Deleted photos go to Recently Deleted and can be recovered for 30 days. You can decline, or turn the question off in Settings.
• Receipt images are not uploaded to the developer’s server or to an AI service. If iCloud Sync is on, receipt images you keep are saved with your expenses in your iCloud account.

Location

• With your system permission, the app gets your location once when you tap Add Current Location, or when you photograph a receipt with automatic location enabled. It does not track your location in the background. Searching for a place does not require your current location. Search terms and the area around an existing place, if any, are sent to Apple Maps to find results.
• The coordinates are sent to Apple’s map service to look up the place name, under Apple’s privacy policy. The coordinates and place name are saved with that expense on your device, and in your iCloud account if iCloud Sync is on.
• Your location is never sent to the developer or to an AI service.
• You can turn off Add Location When Recording in Settings. Locations you already saved are kept, and you can remove them from each expense.

Text recognition and AI features

AI Features is off by default. It turns on only after you explicitly agree during onboarding or in Settings. You can turn it off at any time.

Receipt recognition

1. PennyTrace first reads the text in the image on your device using Apple’s Vision framework. This step does not leave your device.
2. When AI Features is on, the recognized text is sent to the developer’s server in mainland China (Volcengine veFaaS, North China 2 (Beijing), cn-beijing region). The server passes it to the Doubao model on Volcengine Ark, which extracts the merchant, amount, category, date, and note.
3. The request contains only the recognized receipt text, today’s date, the names of your custom categories (up to 20), and which recognition pass it is. It does not contain the image, your expense database, locations, budgets, or recurring bills.
4. If the cloud connection or processing fails and the system reports that the local model is available, PennyTrace automatically switches to Apple Intelligence without requiring you to select it. Vision first reads text from the image; the on-device language model then organizes that text. The receipt image is not passed directly to Apple Intelligence. If the model is unavailable or cannot parse the receipt, built-in rules are used instead. Both fallback steps run on your device and do not send receipt content to the developer or cloud AI again.

Apple Intelligence requires a supported device and system, Apple Intelligence enabled in Settings, and a ready model. Supported languages and regions depend on Apple’s current availability. Automatic fallback does not retract text that may already have been sent to the cloud, and does not mean the entire scan was offline. The confirmation screen identifies the source, such as Cloud AI, Apple Intelligence, or Local Rules, and asks you to review the result before saving.

If a receipt shows a name, phone number, address, membership number, or the last digits of a card, that text is part of the recognized text and is sent with it. Please do not photograph documents that are unrelated to an expense.

Spending insights

AI Insights on the Stats screen is a PennyTrace Pro feature. A request is sent only after you tap it. It contains totals for the current ledger and period:

• The ledger name and period
• Total spending and income, and the totals for the previous period
• Your budget amount and how much you have spent, if you have set a budget
• Category totals (up to 12), top merchants and amounts (up to 8), and the spending trend over time (up to 40 points)
• Totals by member, with member names (up to 6)
• The interface language (Chinese or English)

It does not contain notes, receipt images, receipt text, locations, or a list of individual expenses.

What the developer’s server handles

• To prevent abuse, each request includes a randomly generated installation identifier and a signature. The app creates this identifier the first time it is needed and keeps it in the device keychain. It is not linked to your Apple Account, your name, or the advertising identifier.
• The server uses only one-way hashes of the installation identifier and your IP address for rate-limit counters. These counters expire automatically within 2 days.
• The server’s access logs record only the response status, latency, a hash of the installation identifier, and the error type. They do not record receipt text, spending totals, AI output, or images.
• The server does not store receipt text, spending totals, or AI results. After the text is passed to Volcengine Ark, Volcengine’s terms of service and privacy policy apply.

Turning AI Features off

When AI Features is off, the app does not send anything to the developer’s server or to any cloud AI, and requests in progress are canceled. Receipt scanning is turned off as well, and you can still add expenses manually. The Stats screen does not generate new insights. Insights you generated earlier stay on this device and are labeled as previously generated.

AI-generated content

The confirmation screen shows where a result came from, such as “Recognized by Cloud AI”, and you can edit it before saving. Insights on the Stats screen are labeled AI Insights. AI-generated content may be inaccurate. It is for reference only and is not financial advice.

PennyTrace Pro and Ultra subscriptions

• New users can use all Pro features free for 14 days without starting a subscription. The trial does not automatically charge you when it ends. Afterward, Free access resumes; existing expenses and custom chart configurations remain, while Pro-only features require an active subscription. Ultra-only benefits are not included in the Pro trial.
• Pro and Ultra are available as monthly or yearly auto-renewing subscriptions. The purchase screen shows the current price and period.
• Purchases, renewals, refunds, and payments are handled by Apple through the App Store. The developer does not receive or store your payment information, Apple Account details, or contact information.
• The app only asks Apple, through StoreKit, whether your subscription is active, and caches that result on the device for use at launch and in widgets.
• You can manage or cancel your subscription in Settings > [your name] > Subscriptions on your iPhone.

Notifications

• Budget alerts, recurring-bill reminders, and scan-complete alerts are local notifications created on your device. They are sent only if you allow notifications.
• The developer has no push server. When iCloud Sync is on, Apple’s iCloud service sends silent notifications to tell the app about new changes. These are not shown to you.

App Lock

When App Lock is on, PennyTrace uses the system’s Face ID, Touch ID, or device passcode. iOS performs the check and tells the app only whether it succeeded. Biometric data is not available to the app and does not leave your device.

Problem reports

Shake to Report a Problem is on by default. You can turn it off in Settings > Advanced. When you shake your iPhone, the app captures the current screen and opens a report screen. Nothing is sent at this point. Only when you tap Send are your description, the app version, OS version, device model, and language, and the screenshot (which you can leave out), sent through your own email or the share sheet. No screenshot is taken while the app is locked.

Data retention and deletion

• In the app, you can delete individual expenses, or use Delete All Expenses in Settings. If iCloud Sync is on, deletions sync to iCloud and your other devices.
• Deleting PennyTrace removes its data from this device, including the shared container.
• Data in iCloud is not deleted when you delete the app. You can delete it in Settings > [your name] > iCloud > Manage Account Storage on your iPhone by selecting PennyTrace. You can also delete your expenses in the app while sync is still on, then turn iCloud Sync off.
• Rate-limit counters on the developer’s server expire within 2 days. Access logs contain nothing that identifies you.
• Because the developer does not store your expenses and cannot access your iCloud data, the developer cannot view, export, or delete this data for you. You can export a CSV file or a full backup in the app at any time.

Children

PennyTrace is not directed at children, and the developer does not knowingly collect personal information from children. Please do not let a child use PennyTrace to photograph receipts that contain personal information.

Changes to this policy

If the way data is used changes in a material way, the developer will update this policy and the date above, and will let you know in the app when appropriate.