Last updated: June 2026

Privacy Policy

A plain-language look at what bonbox collects, why, and where your data lives.

What we collect

Here's everything we collect — and only what we actually need to run bonbox:

Receipt data

The receipt images you upload, plus what we read from them — vendor, amount, date, currency, and so on.

Bank statements

When you import a PDF bank statement, we use it only to extract your transactions — the statement itself is processed on the fly and not stored.

Account info

Your email and sign-in details when you sign in with Google, Apple, or an email and password.

Usage & device data

How you use the app and basic device info (type, operating system). This helps us improve bonbox and fix crashes.

How we use it

We use what we collect to:

Run the core features — scanning, expense tracking, invoices, and reports.

Sign you in and keep your data in sync across your devices.

Understand how bonbox is used so we can make it better.

Spot and fix crashes and performance issues.

Reach you about your account or important updates.

Who helps us run bonbox

A few trusted services help us run bonbox. They only process your data on our behalf:

Infomaniak

Stores your receipt images and PDFs — in Switzerland (Geneva).

Supabase

Hosts your account info and receipt details, and handles sign-in — in Switzerland (Zurich).

Google Gemini

Reads your receipts. When you scan one, the image goes to Google to pull out the details.

Sentry

Catches crashes so we can fix them. It gets device info and error details when something breaks. (Hosted in the US.)

PostHog

Helps us understand how the app and website are used. No cookies, and it’s hosted in the EU.

RevenueCat

Manages subscriptions. It receives an app-specific ID and your purchase history. (Hosted in the US.)

Google Places

Suggests addresses as you type when you add a customer — the text you type is sent to Google.

Each one is contractually bound to keep your data safe and only do what we ask.

Where your data lives

Almost everything stays in Switzerland: your receipt images and PDFs (Infomaniak, Geneva) and your account info and receipt details (Supabase, Zurich). A few services process limited data abroad — Google’s Gemini reads your scanned receipts, while Sentry (crash reports) and RevenueCat (subscriptions) are US-based — all under standard data-protection safeguards.

Keeping your data safe

Your data is encrypted in transit and at rest, on top of Supabase’s security infrastructure. We only access it when we need to keep the service running.

How long we keep it

We keep your data for as long as your account is active. Delete your account and we delete your data — except the minimal records the law requires us to keep. Crash reports expire on their own after a short time.

Your rights

It’s your data. You can view, correct, export, or delete most of it right inside the app. Want a full copy or a complete wipe? Just email us and we’ll take care of it. If you’re in the EU, you can also complain to your local data-protection authority — though we’d love the chance to fix things first.

Get in touch

Questions about this policy? Reach us at hi@bonbox.io.