Rowly app — Privacy Policy

1. Controller and contact

The controller of personal data related to the Rowly mobile app (Android and iOS) is Krzysztof Lipiec, the app's author, who runs klip-apps.com.

Contact for privacy and personal data matters: krzysztof.lipiec.web.dev@gmail.com. We respond to messages about personal data without undue delay, and no later than within 30 days.

This policy covers the Rowly app and the informational site klip-apps.com. It does not cover third-party services you use on their own terms (Google, Apple), nor the internal policies of our subprocessor (OpenAI) — links to their policies are below.

2. Key points at a glance

3. How the app works (and why it matters for privacy)

Rowly connects to exactly three places on the network. This list is complete — beyond these addresses, the app sends nothing anywhere:

• Your budget: phone → Google Sheets API (sheets.googleapis.com). Once signed in with your Google account, the app writes and reads budget entries directly in the sheet you chose. We have no access to that traffic and keep no copy of your budget data.
• AI analysis: phone → OpenAI (api.openai.com). A receipt photo or dictated text travels over an encrypted connection straight from your phone to OpenAI — there is no intermediary. The app authenticates with an API key built into the package and paid for by the app's author. The author cannot see the contents of these requests: they go past him, not through him.
• Sign-in: phone → Google (accounts.google.com, oauth2.googleapis.com). The standard Google sign-in screen and access-token refresh.

On the free plan on Android there is a fourth channel: Google AdMob — but only after your consent, and only when you yourself choose to watch an ad (section 7).

This architecture cuts both ways, and it's worth knowing both. On our side there is nothing to leak and nothing to hand over — we hold nothing of yours. But equally, we have nothing to return to you and nothing to delete on our end, because we hold nothing: your data lives in your own Google Sheet, on your phone, and — transiently — at OpenAI on the terms set out in section 5.

4. Data in Google and access scopes

Sign-in happens on Google's official screen (OAuth 2.0). On Android the app requests two permission scopes; on iOS, only the first one:

The app does not request access to your whole Google Drive, mail, contacts, calendar, or cloud photos. You point to your sheet with the “Choose sheet” button (which opens the system's Google Picker window) or create one with the “New sheet” button — there is no field anywhere in the app for pasting an identifier or a link.

The content of your budget (expense names, amounts, categories, income, any payee data you enter yourself) is stored solely in your own Google Sheet and is subject to Google's Privacy Policy and whatever sharing settings you assign to that file yourself.

The app's use of data received via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data from your sheets is not used for advertising, is not sold or passed on to third parties, and is not used to train models.

5. Receipts, voice, and AI analysis

Receipt photos

When you scan a receipt, the photo (or several photos of one receipt) is sent over an encrypted connection straight from your phone to OpenAI, to the api.openai.com interface. There is no intermediary: the app does not send the photo to the app's author or to any other service. The model reads a title, amount, and suggested category off the receipt, and the app shows you the result to correct before saving.

Authentication to OpenAI uses an API key built into the app and paid for by the author. The author cannot see the contents of these requests — his OpenAI bill shows usage, not your receipts.

How long a photo lives at OpenAI

We state this plainly, because it is easy to promise more here than can be delivered. Rowly uses the standard OpenAI API terms, without Zero Data Retention enabled. According to the provider, that means:

• data sent through the API is not used to train models;
• but it may be retained by OpenAI for up to 30 days for abuse monitoring, and is deleted afterwards.

The app's author has no access to those copies, cannot inspect them or delete them early, and cannot guarantee that a photo disappears the moment analysis finishes. The current rules are set out in the OpenAI documents linked below — they take precedence over this description if the provider changes them.

Photos stay on your phone permanently

A scanned receipt is saved permanently on your device, and deliberately so — it is your receipt archive, available later on the expense detail screen:

• Android: in the Pictures/Rowly folder, that is, somewhere visible in your gallery and in any file browser;
• iOS: in the Rowly folder available in the Files app (“On My iPhone”).

The app never deletes these files itself — deleting an expense removes the entry, but the photo stays where you can look at it and delete it yourself. Because the folder sits outside the app's sandbox, uninstalling Rowly does not remove them either. Section 12.2 explains how to delete them.

No photo ever reaches your Google Sheet — only the text you approve does.

Voice dictation

Rowly does not record audio and never receives an audio file. Speech-to-text is done by a mechanism built into the operating system: on Android that is the system dictation screen (usually Google's speech recognition service), on iOS it is Apple's Speech Recognition.

What we cannot promise is that your voice never leaves the phone, because that isn't up to us. Depending on the device and system settings, recognition may happen locally or on the operating system vendor's servers (Google, Apple) — the system decides, not the app, and it is governed by Google's and Apple's policies. That is precisely why iOS asks for a separate speech recognition permission.

From that mechanism the app receives only finished text, and it sends that text directly to OpenAI to split the utterance into individual expenses with amounts. At OpenAI, the transcript is subject to the same retention rules as photos (no model training, retention of up to 30 days for abuse monitoring).

What is not held on our side

Earlier versions of this policy had a table here listing data stored “on the operator's server”. It has been removed, because no such server exists and none was ever built. The app's author runs no user database and stores none of the following:

• your receipt photos, transcripts, or analysis results,
• the content of your budget or your sheet's identifier,
• your account identifier, an analysis counter, or timestamps,
• logs of your OpenAI requests — those never pass through us at all.

The counter of used AI operations is purely local — it lives in the app's settings on your phone (DataStore on Android, NSUserDefaults on iOS) and is never sent anywhere. Clearing the app's data also resets the counter; that is a deliberate cost of not running an account on our side.

The only trace left on our side is the standard web server logs of klip-apps.com (IP address, browser headers, response code), created when you visit this site. The site is statically hosted by an external provider, and its access logs are subject to that provider's standard retention.

OpenAI as a subprocessor

OpenAI is the controller's subprocessor: it processes submitted photos and transcripts in order to perform the analysis requested by the app. The rules for processing data sent to the API are described in OpenAI's Privacy Policy and its full set of policies and terms (including the terms covering data submitted through the API). We use the standard API terms: no model training on submitted content, with possible retention of up to 30 days for abuse monitoring. We recommend reviewing the current version of these documents before scanning receipts that contain sensitive data — they, and not this description, are what binds OpenAI.

6. Premium, limits, and payments

The app runs on a freemium model. On the free plan you get 15 AI operations per month (one operation is one successful model request — analysing a whole receipt, or splitting one dictation). On Android, watching a rewarded ad adds 2 operations on top of that allowance. Premium — 11.99 PLN per month or 97.99 PLN per year — removes the free plan's allowance and turns off ads; it is subject in turn to a separate, much higher fair-use limit described in section 15. The store always shows the current price before purchase.

Buying Premium is currently possible on Android only (Google Play). The iOS app contains no purchase or ad module — there, only the 15-operations-per-month allowance applies.

Payments

You buy and cancel the subscription exclusively through Google Play. Google handles the entire transaction, and it's Google you provide your payment details to.

• We don't see or store your card details or any other payment instrument — they never pass through the app. Nor do we run a billing system of our own for them to land in.
• Google Play tells the app only whether the subscription is active (purchase confirmation and, where available, a renewal date). That information stays on the device.
• Billing, invoices, refunds, and payment complaints are governed by Google's rules.

7. Ads in the free plan

When your monthly AI allowance runs out on the free plan, you can add 2 more operations by watching a rewarded ad. Ads are served by Google AdMob, appear in that one format only (never as a banner, and never as a full-screen ad you didn't choose), on Android only, and only on the free plan.

If you have Premium active, the ad SDK is never even initialised — it isn't that the ad fails to appear; the advertising code never starts up at all, so there is no way for it to process any identifier. The iOS app contains no ad SDK whatsoever.

Before the first ad is shown, we ask for consent through Google's consent form (User Messaging Platform, UMP). AdMob processes device advertising identifiers and other technical data needed to serve and bill the ad, in line with Google's policy for partner sites and apps. We don't share your budget content, email address, or sheet identifier with AdMob — the app has no channel through which it could.

You can review and change your consent at any time in the app: Settings → Manage consent.

8. Data stored on your device

Since we have no server, your device is the only place where Rowly remembers anything (apart from your own Google Sheet). It's worth knowing exactly what sits there:

This data does not leave the device other than in the ways described in section 3: the token — to Google; a budget entry — to your sheet; a photo or transcript — to OpenAI. The local database and the operation counter are never sent anywhere.

The app no longer has a field for entering your own OpenAI key, or any storage where such a key could be kept — that feature has been completely removed from the code. If you're updating Rowly from an older version that let you enter a key, the first launch of the new version automatically deletes the key saved by that older build — nothing from that earlier record stays on your device.

Uninstalling the app removes everything in the table except the photo files — those sit in your gallery or in Files and stay there until you delete them yourself (section 12.2).

9. What we don't do

• we run no server that receives your data — there is no Rowly backend, no user database, no copy of your budget,
• we don't store receipt photos or transcripts, because they never reach us at all — they go from the phone straight to OpenAI (section 5),
• we don't collect usage statistics — the AI operation counter never leaves your device,
• we use no analytics and no crash reporting whatsoever: the app contains no Firebase Analytics, Crashlytics, Google Analytics, Sentry, or any other tracking or telemetry SDK,
• we don't show ads to Premium subscribers — for them the ad SDK never even starts (section 7),
• we don't share your budget content, email, or sheet identifier with the ad network — only technical advertising identifiers, and only with your consent,
• we don't profile users beyond what standard AdMob ad-network operation involves on the free plan on Android,
• we don't sell, rent, or share personal data with third parties,
• we don't create separate password-based accounts and don't store passwords — you sign in with your Google account,
• we don't see or store card payment data,
• we don't use your data to train our own models, and we have no models of our own.

klip-apps.com is a static site: it doesn't use cookies for marketing purposes or analytics tools. Typefaces are loaded from Google Fonts, which involves sending your IP address to Google's servers when the page loads — in line with Google's Privacy Policy.

10. App permissions

The app requests the smallest possible set of permissions, always at the moment they're actually needed:

You can revoke any of these permissions in your system settings — the app will keep working, just without the corresponding feature. The app does not use location, contacts, SMS, call history, or access to files other than the photo you select and its own receipt folder.

11. Legal basis and your rights (GDPR)

The scope in which the controller processes personal data at all is narrow, precisely because he runs no server. It amounts to: receipt photos and transcripts entrusted to OpenAI (the app commissions their processing but does not itself collect them), your IP address in the klip-apps.com access logs, and your email address in correspondence. Everything else stays on your device and in your Google Sheet. The legal bases are:

• Article 6(1)(b) GDPR — necessity to perform a contract: providing the app features you request (receipt and dictation analysis, saving an entry to your sheet) and handling Premium entitlement;
• Article 6(1)(f) GDPR — legitimate interest in handling requests and correspondence from users, and in maintaining and securing the klip-apps.com site (access logs);
• Article 6(1)(c) GDPR — legal obligations related to billing the paid service, to the extent they apply to the controller;
• Article 6(1)(a) GDPR — consent, which you give by granting the app access to your Google account, to the camera and microphone, and to personalized ads on the free plan (UMP consent form, section 7); you can withdraw any of these consents at any time.

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing, and to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Since your budget data exists only in your own Google Sheet and on your own device, the fastest way to exercise your rights of access, correction, and erasure in that scope is to do it yourself — by editing or deleting the sheet, deleting the receipt photos, and uninstalling the app. For anything that requires action on our part (chiefly email correspondence), write to the address given in section 1.

Please bear in mind, though, one side effect of a serverless design: we have no way to identify your data on our side, because we do not hold it. An access or erasure request addressed to us can only concern email correspondence and the site's access logs — everything else is out of our reach, and you must either do it yourself or approach Google, Apple, or OpenAI.

Data may be transferred outside the European Economic Area as part of the Google and Apple services you use directly, and as part of the processing entrusted to OpenAI as the controller's subprocessor — receipt photos and transcripts reach OpenAI's infrastructure straight from your phone. This takes place under the terms set by these providers, including standard contractual clauses.

12. Data deletion and revoking access

This section also serves as the official data-deletion instructions required by Google Play.

12.1. Revoking access to your Google account

• In the app: Settings → sign out. The sign-in token is then immediately removed from the device.
• In your Google account: go to myaccount.google.com/permissions, find the Rowly app, and choose “Remove access”. From that moment, the app has no way of connecting to your sheets.

12.2. Deleting data from your device

• Uninstalling the app removes the data inside the app's sandbox: the sign-in token, settings, the AI operation counter, and the local receipt database.
• Without uninstalling: System settings → Apps → Rowly → Storage → Clear data (Android), or deleting and reinstalling the app (iOS).
• Receipt photo files are deleted separately — they sit outside the app's sandbox, so uninstalling does not remove them. On Android you'll find them in your gallery or a file browser, in the Rowly album (the Pictures/Rowly folder); on iOS, in Files → On My iPhone → Rowly. You delete them like any other photo or file.

12.3. Deleting your budget data

• Your budget data lives in your own Google Sheet — you delete it by removing rows, tabs, or the whole file at drive.google.com (and then emptying Drive's trash). Uninstalling the app does not delete the sheet — that's a deliberate, separate action you take yourself.
• The app's author holds no copy of your budget data, so there is nothing for us to delete on our end. If you've corresponded with us by email, you can ask us to delete it by writing to krzysztof.lipiec.web.dev@gmail.com — we'll delete it within 30 days, unless we need to keep it for legal reasons.

12.4. Data at OpenAI and your subscription

• We have no billing data to delete, because we run no server and no user account (section 3). There is no counter of your analyses and no identifier of your account on our side.
• Photos and transcripts sent to OpenAI are subject to that provider's retention (up to 30 days for abuse monitoring, section 5). We have no access to those copies and cannot delete them earlier or on your request — questions about them have to go to OpenAI directly.
• You cancel a Premium subscription in Google Play — we have no control over it and cannot end it on your behalf.
• The klip-apps.com web server access logs (your IP address when you fetch the page) expire under the hosting provider's standard retention.

13. Children

The app is not directed at children and is not intended for people who cannot create a Google account on their own or independently enter into a paid subscription contract. We do not knowingly collect data from people under 16. If you believe a child has provided us with data, please write to us — we will delete it promptly.

14. Policy changes

We may update this policy when the app's operation changes (e.g. a new integration is added) or when applicable law changes. The current version is always available at klip-apps.com/en/privacy-policy.html, and the effective and last-updated dates are shown at the top of the document. We will announce significant changes in the app's store update description.

Version 3.6 · from 11 September 2026. This version describes a narrowed OAuth scope in section 4: the app no longer requests the "spreadsheets" scope (spreadsheets), which covers every sheet on the account, only the drive.file scope, which works per file — the grant covers exactly the one sheet you pick in Google Picker or that the app creates. The field for pasting a sheet's identifier or link is gone from Settings. On Android the second scope (email address) is unchanged; on iOS it is gone, because Google does not allow combining the drive.file scope with any other — Settings on iOS now shows only “Account connected.”

Version 3.5 · from 5 September 2026. This version removes, throughout the document, all mentions of a free trial period for the Premium subscription — the app does not offer one: Google Play carries only the base plan for both subscriptions (monthly and yearly), with no trial offer at all. The description of pricing and the fair-use limit is unchanged (sections 6 and 15).

Version 3.4 · from 5 September 2026. In this version Premium can only be obtained through the store: the app no longer has any other way of granting that entitlement. With it go the remembered result of the configuration check stored on the device (section 8) and the right to have Premium granted outside the store withdrawn (section 12), and the fair-use limit now applies to a store subscriber (section 15). The description of the klip-apps.com web server access logs created when you visit this site is unchanged (section 5).

Version 3.3 · from 5 September 2026. This version simplifies the description of the app's network connections in section 3 and tidies up the related mentions later in the document. The description of the klip-apps.com web server access logs created when you visit this site is unchanged (section 5).

Version 3.2 · from 5 September 2026. This version shortens the description of the settings stored on your device and tidies the cross-references between sections. The description of the access logs created when you visit this site is unchanged.

Version 3.1 · from 5 September 2026. This version removes the last remaining mentions, throughout the document, of the "user's own OpenAI key" feature — it has been completely removed from the app's code (not merely switched off by a flag), and the app now automatically deletes any key saved by an older version on first launch (section 8). Version 3.1 also adds a description of the fair-use limit that applies to every account without the free plan's operation allowance — 300 AI operations per calendar month and 50 per day (section 15) — and points to it from every place in the document that previously described Premium as removing the limit "entirely."

Version 3.0 · from 5 September 2026. This was a correction of how the data flow is described. Versions 2.0 and 2.1 described an “operator's server” that supposedly received receipt photos, forwarded them to OpenAI, and stored billing metadata. That server was never built: the app has always connected to OpenAI directly from the device. Version 3.0 removed that non-existent component from the whole document, described the actual retention at OpenAI (up to 30 days for abuse monitoring, replacing the earlier promise of “not stored”), corrected the description of photos saved permanently on the device, and completed the list of the app's network connections (section 3). Version 2.1 was in force from 25 August 2026, version 2.0 from 21 August 2026, and version 1.0 from 20 August 2026.

15. Terms of use

The following rules form a simplified set of terms of use for the Rowly app. By installing and using the app, you accept them.

• The app is provided “as is”, without warranty of uninterrupted operation, being error-free, or fitness for a particular purpose. You use it at your own risk.
• Free plan. Without Premium you get 15 AI operations per month; the counter resets at the start of each calendar month. On Android, watching a rewarded ad adds 2 operations. Because the counter is purely local, clearing the app's data resets it — that is not a circumvented safeguard, but a consequence of our not running an account on our side.
• Premium. Premium (11.99 PLN per month or 97.99 PLN per year) removes the free plan's operation allowance and turns off ads; it is subject instead to a separate fair-use limit, described further down in this section. The subscription is offered and billed by Google Play on its own terms. The current price is shown by the store before purchase. You can cancel the subscription at any time in your Google Play settings — it remains active until the end of the paid period. Refunds and payment complaints are handled by the store, under its own terms; this does not limit your statutory consumer rights.
• Price and scope changes. We inform you in advance of any price change or material change to the subscription's scope, in line with the store's rules; a change does not apply retroactively to an already-paid period, and you may choose not to renew.
• Your Google account, your sheet, and your photos. You're responsible for your sheet's content, its backups, and who you share it with. We recommend periodic backups (File → Make a copy in Google Sheets). You are equally responsible for the receipt photos saved to your gallery or Files — we have no access to them and keep no copies.
• Fair-use limit for accounts without the free-plan allowance. The app's author bears the cost of AI model requests, so every account for which the app does not count the free plan's allowance — that is, a Premium subscriber — is subject to a separate fair-use limit: 300 AI operations per calendar month and 50 operations per day. That is far more than a typical household needs — a few dozen receipts a month sit well inside it with room to spare; its purpose is to protect the service from a handful of extreme outliers, so that Premium's price can stay low for everyone else. Once the limit is reached, AI features are paused until the period ends: the monthly limit renews on the first day of the next calendar month, the daily one the following day. Independent of this limit, we may restrict or block automated, bulk, or otherwise abusive use of the analysis, including by withdrawing the key built into a given version of the app.
• AI analysis results need checking. The model can misread an amount, name, or category — the app always shows the result for approval before saving. The app is not accounting software and does not provide tax or financial advice.
• Limitation of liability. To the maximum extent permitted by law, the author is not liable for damages arising from use of the app, including loss or incorrect saving of data in the sheet, loss of receipt photos stored on the device, interruptions in Google, Apple, or OpenAI services, or financial decisions made based on calculations in the app. This does not limit consumer rights arising from mandatory legal provisions.
• Permitted use. The app may not be used unlawfully or to circumvent the terms of Google, Apple, and OpenAI services, or to circumvent subscription limits. Copyright to the app and the sheet template belongs to the author.
• Governing law. Polish law; disputes with consumers are resolved in accordance with generally applicable regulations.

← Back to the app page