billy and parley — Privacy Policy

Parallel Systems · Last updated: October 6, 2026

Key Principles

1. Local-First Design

Your receipt scans and shopping list stay on your device. Receipt scanning and photos of written shopping lists are read with on-device OCR (Google ML Kit) — no images or text leave your phone. If you add to your list by voice, billy listens only while you’re speaking, and your speech is turned into words on your phone; if your phone can’t do that on its own, billy tells you and does not send it anywhere. Your purchase history is stored on your device first and works offline; if you sign in as a Participant or Pro member, your purchases also sync to your account on our backend so they map to corporate ownership and follow you across devices. While you use billy as an anonymous Observer, nothing about your purchases leaves your device.

2. Tiered Identity

billy offers three levels of identity, each with different data handling:

3. Anonymous Community Features

When you vote on campaigns, endorse proposals, or participate in community coordination, your actions are linked to an opaque participant ID. We never display your name or email to other users. Most community data is shown in aggregate; the exception is the text of statements you post on reasons boards, which is visible to your community (see Deliberation below).

4. Demand Signals

billy collects anonymized, aggregate behavior signals to understand community demand patterns. These include: which alternatives users view, which swaps are tapped, and which searches return no results. These signals contain no user identity — they are anonymous counts used to help local businesses understand what communities need. To see whether people come back, the app also sends a single count when it is opened (and when you join a campaign, back one, or start a switch) within a new window after you installed it — for example, “installed in the week of September 21, opened again in its second week.” That count carries only the day you installed and whether you opened the app or took an action: no account, no device ID, no time of day. Your phone remembers which windows it has already counted, so each is counted once.

To prevent individual re-identification, demand signals in any community-and-category bucket are only displayed once at least five people have contributed to that bucket. Below the threshold, the bucket is hidden entirely — not shown as a low number.

5. Deliberation: Reasons Boards

When your community is thinking through a proposal, billy uses a Polis-style reasons board: people post short statements explaining their reasoning, and others react agree, disagree, or pass on each statement. The system surfaces which reasons cross groups and which divide them.

What we store on our servers when you participate:

• Statements you post — the text itself, linked to your opaque participant ID. Statements are visible to other members of your community.
• Reactions you give — whether you reacted agree, disagree, or pass to each statement, linked to your opaque participant ID. Reactions are aggregated for display; individual reactions are not shown to other users.
• Vote weight — equal for all participants. Stewards have no extra weight; their only authority is corrective (the ability to flag a board for re-deliberation), and that authority is publicly logged.

Statements you post are public to your community by their nature. We don't show your email or name alongside them — only your opaque participant ID — but the text is visible to others. If you delete your account, your statements and reactions are removed from our servers within 30 days.

You can request deletion of a specific statement at any time by emailing privacy@abilli.app.

6. Facts you send

You can send billy a fact about who owns a company, who it buys from or what it is certified by, with a link to where it is shown. A fact you send is not shown to anyone until another member, acting as a reviewer, has checked it against its source. What we keep: the fact, its link, and its status. Who sent it and who reviewed it are kept separately, can’t be read by other members, and are never shown next to the fact. You can see the facts you sent and where each one is. Deleting your account removes the record of who sent them; the facts themselves stay, with no one attached.

Bank account connections (Plaid)

Linking a bank is an optional, Pro-only feature, and it is separate from receipt scanning. Receipt scanning always stays on your device (see Local-First Design above). Bank linking passes through our server, but your transactions are not kept there. To link a bank you must first be signed in with a Google or Apple (OAuth) account.

• What we retrieve: If you choose to link a bank through Plaid, we retrieve up to 24 months of your transaction history — merchant, amount, date, and category — so we can show you where your money goes, mapped to corporate ownership data.
• How it is stored: Your transactions are stored encrypted on your phone, never on our server. They pass through our server (Supabase) on the way to your phone and are not saved there. The Plaid access token used to fetch them is stored server-side, encrypted, and is never exposed to the app.
• Sharing a spending range (coming, not yet in the app): When it arrives, you will be able to choose to share one monthly spending range with a campaign, such as “$50–100”, never a transaction or an exact amount, and withdraw it at any time.
• Never sold or shared: We never sell or share your spending data with anyone, including businesses listed in billy.
• Credentials: We never store your bank login credentials. Plaid handles authentication directly — your bank username and password are never seen by us.
• No selling, no advertisers: We do not sell this data and do not share it with advertisers.
• Disconnecting: You can disconnect at any time from Settings. Disconnecting (or deleting your account) deletes your transactions from your phone and revokes the Plaid access token. Signing out also removes your bank transactions from the phone.
• Data processor: Plaid acts as our data processor for bank connections. See Plaid’s end-user privacy policy.

What We Collect

• On your device: Receipt scans, shopping list items, barcode scan results, bank statement imports, and bank transactions if you link a bank (encrypted). Your purchase history is stored here first; for signed-in members it also syncs to your account (see below).
• On our servers (Supabase): Opaque participant ID (if signed in), community votes and proposals, deliberation statements and reactions you post on reasons boards, anonymized demand signals, campaign participation, and anonymous usage and crash diagnostics. For signed-in members: your purchase history (product, amount, date, mapped company). For Pro members who link a bank: an encrypted Plaid access token (your transactions stay on your phone) — see Bank account connections above.
• Location (optional): If you allow it, billy reads your approximate location on your device, or uses a postal code you type, to suggest a nearby community and to find your MP. billy keeps that approximate location on your device so it doesn't have to ask again. It is not stored on our servers. A rough spot about a kilometre wide goes to them, and is not kept, in two cases: to list the towns near you when you choose a community, and when you ask who represents you in the US Congress (below). When billy first reads it, it may ask OpenStreetMap for the name of the place (see the table below).
• Your MP (optional, only when you tap “Find my MP”): billy sends Open North, a Canadian non-profit, a rough spot about a kilometre wide (or the postal code you typed) to find your federal riding and its MP. Nothing else goes with it. billy keeps the MP’s name and riding on your device and shows which companies it follows lobbied that MP, from Canada’s public Registry of Lobbyists.
• Your members of Congress (optional, only when you tap to look them up): When you ask billy for your members of Congress, by your spot or a US ZIP code you type, billy sends its own database the rough spot about a kilometre wide (or the ZIP code) to find your congressional district in billy’s copy of the US Census Bureau’s district maps. No other company or government sees it, and billy does not store it. billy then shows your House member and senators, how they voted, and which companies it follows gave to their campaigns through a PAC, all from public records.
• Reminders near shops (optional, off unless you turn them on): You can save where a shop is, and billy will remind you of your list when you arrive there, even when billy is closed. This needs location permission “all the time”. Your phone watches only for the shops you saved and wakes billy when you arrive at one. billy keeps no record of where you go. The saved shops stay on your device, are never sent to our servers, and are forgotten when you turn reminders off.
• Never collected: Your name (unless you provide it), a record of where you go, contacts, browsing history, advertising identifiers, or any third-party / cross-app tracking.

parley

parley is a second app from the same people, for neighbours deciding and doing things together. It is a separate download with its own name and icon, and it shares one account and one database with billy. Everything above about who we are, what we never collect, ads, data sales and your rights applies to parley exactly as it applies to billy. What follows is what parley itself holds.

One account across both apps

Signing in to either app signs you in to the same account. Deleting your account in either app deletes it for both — there is no way to delete one and keep the other. parley’s delete button is on the You screen, under “Shared account”. Signing out of parley signs you out of parley only; it does not touch billy on the same phone, and it does not remove you from your neighbourhood or any village.

What parley collects

• The neighbourhood you join. One place, stored against your account. You can change it, and changing it moves the one membership both apps share.
• How you grade your neighbourhood. parley asks how healthy you think your place is across eight kinds of wealth. Your own grades are yours to see; what neighbours see is the group’s figure, and only once at least five people have answered.
• What you write. Reasons behind a grade, statements and votes when a neighbourhood is working something out, proposals, notes and offers inside a village. These are written to be read by the people you share a place or a village with — that is the point of them.
• What you join and back. Villages you are a member of, proposals you are behind, callings you claim, events you say you are coming to.
• Anonymous usage and crash diagnostics, the same as billy.

Social, through Bluesky (optional)

parley’s Social tab shows public posts from Bluesky and lets you post to your own Bluesky account.

• Reading needs no account. Your phone asks Bluesky for the posts directly, the way a web browser asks a website, so Bluesky sees that request. It does not go through our server.
• Writing, following, muting and blocking need a Bluesky account. You connect one of two ways. With Continue with Bluesky, you sign in on Bluesky’s own page, so parley never sees your password. Or you use an app password you make in Bluesky; parley uses it once to sign in and does not store it. Either way, the sign-in Bluesky gives back is kept encrypted on your phone, never on our server, and signing out of Social removes it.
• Posts you write go to Bluesky, not to us. They are public, anyone on Bluesky can see them, and Bluesky’s own privacy policy covers them. Each one carries a hidden tag, “parleyapp”, so parley can tell its own posts apart. parley does not keep copies of your posts, your follows or your Bluesky profile.
• Mutes, blocks and reports are made on your Bluesky account. A mute is private. A block is public on Bluesky, like a follow. A report goes to Bluesky’s moderators; the person is not told who sent it. If you are not connected, you can hide a person on your phone; that list stays on the phone.
• A village can have a public feed. Its keeper can give it a tag, and anyone who posts with that tag posts to the village’s feed. We store the tag against the village. We do not store who posts under it, and the feed never says who is in the village. Tagging a post with a village is your choice, each time, and it is public.

Location

parley does not send your location anywhere. If you allow it, parley reads your approximate location once, on your phone, to put the neighbourhoods nearest you at the top of a list. That reading stays on the phone and never reaches our servers.

Until 18 September 2026, checking in to grade your neighbourhood sent one location reading to our servers, which compared it against the neighbourhood’s centre and kept only whether you were inside on that date. The coordinates were never stored. That check has been removed, and parley no longer asks the phone where it is for any purpose other than sorting that list. If it is ever brought back, this policy will say so before it ships.

Counts of people

parley never shows a number of people below five. Where fewer than five people have done something, it says so in words rather than naming the number, so that a figure can never point at one identifiable neighbour.

What parley never collects

No bank connections, no purchase history, no receipts, no barcode scans — those belong to billy and stay there. And no continuous or background location (billy’s optional reminders near shops are billy’s alone), no contacts, no browsing history, no advertising identifiers, and no third-party or cross-app tracking.

Third-Party Services

Data Retention

• On-device data: Retained until you delete it or uninstall the app. Bank transactions are the exception on iPhone: see below.
• Community participation: Votes and proposals are retained as long as the associated campaign or proposal exists.
• Deliberation content: Statements you post and reactions you give on reasons boards are retained as long as the board exists. If a board is closed or archived, its statements remain visible for transparency. Deleting your account removes your statements and reactions within 30 days.
• Demand signals: Aggregated anonymously and retained indefinitely for community demand intelligence. Individual signal records are pruned after 12 months.
• Bank connections (Pro): Your transactions stay on your phone until you disconnect, sign out or delete your account. The encrypted Plaid access token is kept on our server only while your bank is linked; disconnecting or deleting your account revokes it immediately.
• Account deletion: You can delete your account and all associated server-side data through the Settings screen.

Your Rights

• You can browse, scan, and track your spending without signing in.
• You can view and delete all local data through the Settings screen.
• You can delete your account and request deletion of all server-side data.
• Your community contributions are shown under an opaque ID — never your name or email — and individual contributions are not displayed to other users.
• Uninstalling the app removes its local data from your device. On iPhone, bank transactions are kept in the phone’s secure storage until you disconnect, sign out or delete your account.

Children

billy and parley are not directed at children under 13. We do not knowingly collect any information from children.

No Ads, No Data Sales

billy and parley do not display advertisements. We do not sell, rent, or share your personal data with any third party for marketing purposes. Our revenue model is based on businesses paying to be listed as local alternatives — not on your data.

Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via the app. The “Last updated” date at the top reflects the most recent revision.

Contact

Questions about privacy? Reach us at:

• Email: abilliapp@gmail.com

Your receipts stay on your device. Your purchases stay on your device too while you're an anonymous Observer; if you sign in, they sync to your account. Linking a bank (Pro, optional) keeps your transactions encrypted on your phone, never on our server. Community contributions are shown under opaque IDs — never your name or email. No ads, no data sales, no third-party tracking. Ever.

See also: methodology · corrections

Parallel Systems · Gabriola Island, BC, Canada