Privacy Policy
Pip is designed and built by Baloot MY Digital Agency (baloot.my), a native iOS app developer in Malaysia. Baloot MY Digital Agency is the data controller for the information described here.
Your receipt photos stay on your device. Our servers cannot receive an image — there is no feature, endpoint, or setting that uploads one to us.
1. The short version
A receipt says where you were, when, and what you bought. We think that belongs to you. So Pip reads your receipts on your iPhone, and only a stripped-down copy of the text is sent for interpretation. The picture never leaves your devices. We do not sell data, we do not show ads, and we do not connect to your bank.
2. What goes where
This is the whole map. If something is not in this table, we do not have it.
| Data | Your device | Our server | AI provider |
|---|---|---|---|
| Receipt photo | Yes | Never | Never |
| Raw recognized text | Yes | Never | Never |
| Redacted receipt text | Briefly, while scanning | Short-lived | Sent for interpretation |
| Merchant, items, amounts | Yes | Up to an hour, then deleted | In the reply, in transit |
| Wallets and budgets | Yes | Never | Never |
| Account, scan count, subscription | Cached | Yes | Never |
What "redacted" means
Before any text leaves your phone, Pip removes patterns that look like payment card numbers, email addresses, phone numbers, and labelled identity numbers. This happens on the device, so the unredacted text is never transmitted.
We should be straight with you about the limit of this: redaction works on recognizable patterns. A merchant who prints something unusual — a loyalty note, a handwritten name — may not match a pattern, and that text could be included in what is sent for interpretation. It is a strong reduction, not a mathematical guarantee.
3. Who else processes your data
DeepSeek — receipt interpretation
The redacted text is sent to DeepSeek, an AI provider based in the People's Republic of China, which turns it into structured items and amounts. This means redacted receipt text is transferred outside Malaysia and outside the EEA, and is subject to the laws of that jurisdiction. We are telling you plainly because it is your decision to make: if you would rather no receipt text leave your device at all, you can use Pip's manual entry, which is unlimited, free, and never contacts an AI provider.
Railway — our server
Our backend runs on Railway (United States). It holds your account identifier, your scan count, and your subscription state. It handles redacted text only in passing and does not keep it as part of your record.
Apple — identity
Sign in with Apple gives us a stable identifier for your account and, only if you allow it, an email address (which may be one of Apple's private relay addresses). Apple's handling is covered by Apple's privacy policy.
Your receipts do not sync between devices. They live on the device that saved them. Syncing through your own private iCloud is built and switched off; when we turn it on we will say so here first, and it will still be your storage rather than ours.
Resend — email to you
If you write to support, we use Resend to send replies. That means your email address and your message pass through it.
Exchange rates
Currency conversion uses published European Central Bank reference rates. We request a rate for a date. No information about you is part of that request.
4. How long we keep things
- Redacted text on our server: kept only as long as a scan is in flight, then deleted.
- The scan's result — the merchant, date, amounts and items the AI read — waits on our server for your phone to collect it, for up to an hour. It is deleted the moment you save or discard the receipt, and the copy you keep is the one on your device.
- Account and scan count: kept while your account exists.
- Your receipts: kept until you delete them. They live in your storage, so this is your call, not ours.
- Logs: we record events, timings and error codes. Receipt text, merchant names, item names, amounts and images are never written to a log.
5. Your rights and controls
Under Malaysia's Personal Data Protection Act 2010 and, where it applies to you, the EU/UK GDPR, you can ask to access, correct, or erase your personal data, object to or restrict processing, and receive a portable copy. In the app you can, at any time:
- Export your receipts as a spreadsheet — Settings → Export receipts. Every item, with both the original and converted amounts.
- Delete any receipt, from the receipt itself.
- Delete your account — Settings → Delete account. This erases your data from our server and from this device. It cannot be undone.
- Lock the app behind Face ID — Settings → Lock. This hides your receipts from someone holding your unlocked phone. It is a cover, not encryption: your files are protected by iOS either way.
Deleting your account does not cancel an App Store subscription — only Apple can do that, in your Apple Account settings. We will tell you this in the app at the point of deletion rather than let it surprise you.
To make any request, email hello@baloot.my. If you are in the EU or UK, our legal basis is performing our contract with you (running the app you asked for) and our legitimate interest in keeping the service working and secure.
If you are not happy with how we handle a request, you can complain to a regulator: in Malaysia, the Personal Data Protection Department (JPDP); in the EU or UK, your local data protection authority.
6. Children
Pip is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, email hello@baloot.my and we will delete it.
7. Security
Traffic is encrypted with TLS. Receipt images are stored in protected storage on your device — that is iOS file protection, and it applies whether or not you turn on the app lock. Sensitive tokens are kept in the iOS Keychain. No secret needed to reach the AI provider is ever shipped inside the app.
No system is perfect, and we would rather say that than imply otherwise.
8. This website
This site sets no cookies and runs no analytics or trackers — we do not know you visited, and we like it that way. It is hosted on Vercel (United States), which keeps standard access logs (IP address, time, page requested) for a short period to run and secure the service.
9. Changes
If we change how your data is handled, we will update this page and its date, and for anything significant we will tell you in the app before it takes effect.
10. Contact
Pip is provided by Baloot MY Digital Agency (baloot.my). For any question or request about this policy, email hello@baloot.my.