Suanpan Privacy Policy
Last updated: 2026-08-06
This policy describes what Suanpan (the "Service") collects, why, and where it goes. Every statement here matches what the code actually does — there is no hedging language covering things we might do later.
The short version
Your ledger is uploaded to a database in Singapore (once you sign in). Your photos are not. Location is off by default, and even when you turn it on we store only the district name. When you use AI features, the sentence you typed is sent to Google's model.
What we collect
1. Account data
- Email — to sign you in, send password resets, and contact you about the service
- Password — stored as a hash only. We cannot see it and cannot look it up for you
- Device identifier — a random value generated by the app, used to recognise the same device and to enforce the three-device limit. It is not your IMEI, advertising ID, or any hardware identifier
2. Ledger data (uploaded only after you sign in)
Amounts, dates, categories, account names, notes, and the names of people you lend to or borrow from. This is uploaded so you can move to a new device and so your daily backup has something to save.
The server does not interpret your ledger. Sync only tracks which row changed and when; the row itself is stored as-is.
3. Approximate location (off by default)
You must turn this on yourself in Settings. When on:
- Only the district name is stored (e.g. "Taiwan Taoyuan City Pingzhen District"). Coordinates are never stored
- Coordinates are converted to a place name on your device and discarded immediately
- Low-accuracy positioning (cell tower / Wi-Fi); the GPS chip is not used
- Levels finer than a district (village, street, lane, house number) are filtered out
It has exactly one purpose: letting reports account for local price levels (Taipei vs Tainan vs Tokyo).
4. What is sent to Google (only when you use AI features)
AI features are powered by Google Gemini. What gets sent:
| Feature | What is sent |
|---|---|
| AI entry | The sentence you typed, your category names, account names and types, counterparty names |
| Editing an existing entry | Your instruction and a summary of the entries it refers to |
| Monthly / yearly reports | Aggregated numbers (category totals, monthly trends) — not individual entries |
| Feature questions | Your question |
Never sent: your email, password, device identifier, photos, or coordinates.
Google's handling of API data is governed by its own terms: https://ai.google.dev/gemini-api/terms.
5. Logged automatically by the server
- Country code derived from your IP (e.g. TW) — cross-checked against your device language to help the AI infer currency and price context. It never overrides your settings, and the full IP is not stored
- Failed sign-in counts — to stop password guessing. Counted per IP and per email
- AI usage — time, type, token count and model for each call. Never the content
What we do not collect
- Photos. Receipt photos stay on the device that took them. They are neither synced nor backed up. They do not follow you to a new phone
- Coordinates. See section 3
- Contacts, messages, call logs, or data from other apps
- Advertising identifiers. There are no ads and no third-party tracking SDKs
Where data lives
| Where | Operated by | |
|---|---|---|
| Ledger, accounts, backups | Singapore | Neon (hosted PostgreSQL) |
| Application server | Singapore | Vercel |
| AI processing | Google's infrastructure | |
| Password reset email | — | Resend |
All traffic uses HTTPS.
How long we keep it
- Ledger and account — for as long as you use the service
- Cloud backup — only the most recent one is kept; each new backup replaces it
- AI usage records — for billing reconciliation and abuse prevention
- Failed sign-in counters — short-lived, cleared automatically
What you can do
- Export — Settings lets you export your whole ledger as a JSON file at any time
- Delete your account — email us and we will delete everything associated with your account on the server (ledger, backups, usage records). Data on your device is unaffected; remove it in the app or uninstall
- Turn location off — the Settings toggle; new entries stop recording location
- Skip AI entirely — without an AI subscription, nothing is ever sent to Google
Third parties
No ads, no analytics, no social plugins. The "Where data lives" table above is the complete list of parties that touch your data.
Payments are handled by Creem (creem.io). We never receive or store your card number.
Children
The Service is not designed for children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date on this page and notify you prominently in the app.