billy Privacy Policy

Parallel Systems · Last updated: June 15, 2026

Key Principles

1. Local-First Design

Your receipt scans and shopping list stay on your device. Receipt scanning uses on-device OCR (Google ML Kit) — no images or text leave your phone. Your purchase history is stored on your device first and works offline; if you sign in as a Participant or Pro member, your purchases also sync to your account on our backend so they map to corporate ownership and follow you across devices. While you use billy as an anonymous Observer, nothing about your purchases leaves your device.

2. Tiered Identity

billy offers three levels of identity, each with different data handling:

Tier	Identity	Data shared
Observer	No sign-in needed (anonymous session)	Your purchases, lists, and receipts stay on your device. Anonymous, aggregate usage and crash diagnostics may be recorded — no name, no email.
Participant	Google or Apple sign-in	An opaque participant ID for voting and proposals. Your email is used for authentication only and is never displayed or shared.
Verified (Pro)	Bank-linked via Plaid (optional)	For Pro members who choose to link a bank, we retrieve up to 24 months of transaction history (merchant, amount, date, category) to map your spending to corporate ownership data. Stored encrypted in our backend. See Bank account connections below.

3. Anonymous Community Features

When you vote on campaigns, endorse proposals, or participate in community coordination, your actions are linked to an opaque participant ID. We never display your name or email to other users. Most community data is shown in aggregate; the exception is the text of statements you post on reasons boards, which is visible to your community (see Deliberation below).

4. Demand Signals

billy collects anonymized, aggregate behavior signals to understand community demand patterns. These include: which alternatives users view, which swaps are tapped, and which searches return no results. These signals contain no user identity — they are anonymous counts used to help local businesses understand what communities need.

To prevent individual re-identification, demand signals in any community-and-category bucket are only displayed once at least five people have contributed to that bucket. Below the threshold, the bucket is hidden entirely — not shown as a low number.

5. Deliberation: Reasons Boards

When your community is thinking through a proposal, billy uses a Polis-style reasons board: people post short statements explaining their reasoning, and others react agree, disagree, or pass on each statement. The system surfaces which reasons cross groups and which divide them.

What we store on our servers when you participate:

Statements you post — the text itself, linked to your opaque participant ID. Statements are visible to other members of your community.
Reactions you give — whether you reacted agree, disagree, or pass to each statement, linked to your opaque participant ID. Reactions are aggregated for display; individual reactions are not shown to other users.
Vote weight — equal for all participants. Stewards have no extra weight; their only authority is corrective (the ability to flag a board for re-deliberation), and that authority is publicly logged.

Statements you post are public to your community by their nature. We don't show your email or name alongside them — only your opaque participant ID — but the text is visible to others. If you delete your account, your statements and reactions are removed from our servers within 30 days.

You can request deletion of a specific statement at any time by emailing privacy@abilli.app.

Bank account connections (Plaid)

Linking a bank is an optional, Pro-only feature, and it is separate from receipt scanning. Receipt scanning always stays on your device (see Local-First Design above); bank linking is the one feature that does involve our server. To link a bank you must first be signed in with a Google or Apple (OAuth) account.

What we retrieve: If you choose to link a bank through Plaid, we retrieve up to 24 months of your transaction history — merchant, amount, date, and category — so we can show you where your money goes, mapped to corporate ownership data.
How it is stored: This transaction data is stored encrypted at rest in our backend (Supabase). The Plaid access token used to fetch it is stored server-side, encrypted, and is never exposed to the app.
Credentials: We never store your bank login credentials. Plaid handles authentication directly — your bank username and password are never seen by us.
No selling, no advertisers: We do not sell this data and do not share it with advertisers.
Disconnecting: You can disconnect at any time from Settings. Disconnecting (or deleting your account) deletes the stored transaction data and revokes the Plaid access token. We keep this data only for as long as your bank stays linked; there is no separate copy retained after you disconnect.
Data processor: Plaid acts as our data processor for bank connections. See Plaid’s end-user privacy policy.

What We Collect

On your device: Receipt scans, shopping list items, barcode scan results, bank statement imports. Your purchase history is stored here first; for signed-in members it also syncs to your account (see below).
On our servers (Supabase): Opaque participant ID (if signed in), community votes and proposals, deliberation statements and reactions you post on reasons boards, anonymized demand signals, campaign participation, and anonymous usage and crash diagnostics. For signed-in members: your purchase history (product, amount, date, mapped company). For Pro members who link a bank: up to 24 months of transaction history (merchant, amount, date, category) and an encrypted Plaid access token — see Bank account connections above.
Location (optional): If you allow it, billy reads your approximate location once, on your device, to suggest a nearby community. It is not stored and is never sent to our servers.
Never collected: Your name (unless you provide it), continuous or background location, contacts, browsing history, advertising identifiers, or any third-party / cross-app tracking.

Third-Party Services

Service	Purpose	Data shared
Supabase	Backend for community features	Opaque participant ID, votes, proposals, anonymous signals
Google Sign-In / Apple Sign-In	Authentication	Email address (for auth only, never displayed)
Google ML Kit	On-device receipt OCR	None — processing is entirely on your device
Open Food Facts	Product barcode lookup	Barcode numbers only
Plaid	Bank connection & transaction history (Pro, optional)	Securely connects your bank and retrieves up to 24 months of transactions (merchant, amount, date, category). Plaid handles authentication; we never receive your bank login. See Plaid’s end-user privacy policy.

Data Retention

On-device data: Retained until you delete it or uninstall the app.
Community participation: Votes and proposals are retained as long as the associated campaign or proposal exists.
Deliberation content: Statements you post and reactions you give on reasons boards are retained as long as the board exists. If a board is closed or archived, its statements remain visible for transparency. Deleting your account removes your statements and reactions within 30 days.
Demand signals: Aggregated anonymously and retained indefinitely for community demand intelligence. Individual signal records are pruned after 12 months.
Bank connections (Pro): Transaction history retrieved via Plaid and the encrypted Plaid access token are kept for a rolling 24 months — transactions older than 24 months are purged automatically. Disconnecting the bank, or deleting your account, deletes the stored transaction data and revokes the token immediately.
Account deletion: You can delete your account and all associated server-side data through the Settings screen.

Your Rights

You can browse, scan, and track your spending without signing in.
You can view and delete all local data through the Settings screen.
You can delete your account and request deletion of all server-side data.
Your community contributions are shown under an opaque ID — never your name or email — and individual contributions are not displayed to other users.
Uninstalling the app removes all local data from your device.

Children

billy is not directed at children under 13. We do not knowingly collect any information from children.

No Ads, No Data Sales

billy does not display advertisements. We do not sell, rent, or share your personal data with any third party for marketing purposes. Our revenue model is based on businesses paying to be listed as local alternatives — not on your data.

Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via the app. The “Last updated” date at the top reflects the most recent revision.

Contact

Questions about privacy? Reach us at:

Email: abilliapp@gmail.com

Your receipts stay on your device. Your purchases stay on your device too while you're an anonymous Observer; if you sign in, they sync to your account. Linking a bank (Pro, optional) stores your transaction history encrypted in our backend, deleted when you disconnect. Community contributions are shown under opaque IDs — never your name or email. No ads, no data sales, no third-party tracking. Ever.