Bleed privacy policy

Bleed is a mobile app that helps you see what you pay for: subscriptions, bills, and charges you don't recognise. This policy explains what information Bleed handles, why, where it goes, and what you can do about it. We have tried to write it the way we would want to read it.

1. Information Bleed handles

1.1 An anonymous account identifier

When you first open Bleed, the app silently creates an anonymous account with our backend provider, Supabase. This gives you a random identifier so your data can be backed up and kept separate from everyone else's. There is no sign-up form, and the identifier is not linked to your name, email address, phone number, or device identifiers.

1.2 Financial information you type in

Bleed stores the subscriptions and bills you add:

• Subscriptions: merchant name, price, currency, billing cycle, and next renewal date.
• Bills: name, amount, due date, and whether you have marked it paid.

You enter this information yourself, or confirm it after a screenshot scan. Bleed does not access your bank accounts, card statements, email, or any financial institution, and it does not process payments.

1.3 Screenshot text

You can scan a screenshot of a signup or billing page to add a subscription faster. To do this Bleed asks for access to your photos, and reads only the image you pick. Here is exactly what happens, in order:

1. Text recognition runs on your phone. The image itself is never uploaded anywhere and Bleed does not keep a copy of it.
2. A sensitive-data check runs on your phone. Before the recognised text is used for anything, Bleed checks it for full card numbers, card security codes, bank account, routing and IBAN numbers, and Social Security or national ID numbers. If any are found, the scan is stopped, the text is discarded, and nothing is sent anywhere. You see a message asking you to crop or retake the screenshot.
3. Bleed tries to read the details itself. If the on-device parser finds the merchant, price and billing cycle with enough confidence, the process ends here and nothing has left your phone.
4. Only if the on-device parser is unsure, the recognised text is sent through our own server to OpenAI, an AI service provider, which returns the merchant, price, cycle and renewal date it can identify. We do not store the text on our server. If the AI service returns an error, a short technical excerpt of its reply may be kept in our server logs for a limited time so we can fix the fault. OpenAI's published API data usage policy states that content sent through its API is not used to train its models and may be retained for a limited period for abuse monitoring; please refer to OpenAI's policy for current details.

Whatever the result, you review and confirm every field before anything is saved.

1.4 Charges you look up

The Oops tab lets you look up a charge you don't recognise against a built-in dictionary. Two different things can be recorded:

• Charges you save. If you keep a lookup in the Oops tab, the charge text you typed, Bleed's guess at what it is, and whether you have marked it resolved are stored with your anonymous account, the same way your subscriptions and bills are.
• Searches with no match. If your search finds nothing, Bleed logs the search term so we can add common charges to the dictionary in future updates. This log contains only the search text and the time it was searched. It is not linked to your anonymous account, device, or anything else about you, and it automatically skips anything that looks like an email address or a long run of digits, so account or card numbers are never logged.

1.5 Preferences

Your chosen currency and optional display name are saved with your anonymous account so they follow your data. Your appearance (light or dark) and reminder settings stay on your phone only.

1.6 Reminders

Renewal and bill reminders are scheduled on your phone. Bleed does not use push notification services and does not collect a push token.

1.7 What Bleed does not collect

Bleed contains no advertising, analytics, or tracking software. It does not collect your name (beyond the optional display name you choose), email address, phone number, contacts, location, or advertising identifier. It does not currently ask for an email address; if we add an email-based recovery option in a future version, it will be optional and this policy will be updated first.

2. How Bleed uses this information

• To run the app: storing and showing your subscriptions and bills, calculating totals and due dates, and scheduling the reminders you turn on.
• To back up your data: keeping a copy of your subscriptions, bills, saved charges and preferences on our servers under your anonymous identifier so they are not lost if the app's local storage is cleared.
• To read screenshots: identifying subscription details from text, as described in section 1.3.
• To improve the app: using unmatched search terms to expand the built-in charge dictionary.

We do not use your information for advertising, profiling, or any purpose not listed here.

3. Who receives information

• Supabase hosts our backend and stores the data described in sections 1.1, 1.2, 1.4 and 1.5. Access is restricted so that each anonymous account can only read and write its own rows.
• OpenAI receives recognised screenshot text only in the circumstances described in section 1.3, through our server, and never receives your anonymous identifier, your stored subscriptions, or the screenshot image.

We do not share personal information with anyone else, and we do not sell it. We would disclose information if required to by law, and would tell you where we are legally allowed to.

4. Where information is stored

Our backend is hosted by Supabase. Depending on where you are, this may mean your information is processed in a country other than your own, including the United States. We choose providers that commit to appropriate safeguards for international transfers.

5. How long information is kept

• Data tied to your anonymous account is kept for as long as the account exists.
• Uninstalling the app does not delete the data on our servers, because we cannot tell the difference between an uninstall and a phone change. Use the options in section 6 before uninstalling if you want it gone.
• Screenshot text sent to OpenAI is not stored by us. Any retention by OpenAI is governed by OpenAI's policy, as noted in section 1.3.
• Unmatched search terms are kept until we have used them to update the dictionary, and are not linked to you.

6. Your choices and rights

• Delete your data. Removing a subscription, a bill or a saved charge in the app also removes it from our servers the next time the app syncs. Removing all of them leaves only your currency, your display name if you set one, and the empty anonymous identifier. Because the account is anonymous, we cannot find it from an email address, so deletion has to start in the app.
• Stop scans from leaving your phone. Enter subscriptions manually instead of scanning, or scan only pages the on-device parser can read fully.
• Turn off reminders in Settings at any time, or in your phone's notification settings.
• Withdraw photo access in your phone's settings at any time. Manual entry keeps working.
• Ask us anything about this policy or your data at the contact address below.

Depending on where you live, you may have additional rights, such as to access, correct, export, or restrict the processing of your information, and to complain to a data protection authority. In the United Arab Emirates these rights come from the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). You can exercise them by contacting us, and we will answer within thirty days.

7. Children

Bleed is not directed at children under 13 (or the age of digital consent where you live), and we do not knowingly collect information from them. If you believe a child has used Bleed, contact us and we will help remove the associated data.

8. Security

Bleed communicates with our servers only over encrypted connections. Data on our servers is protected by access rules that limit each anonymous account to its own records. The sensitive-data check described in section 1.3 is designed so that card and bank details are stopped on your phone before they can be transmitted, even by mistake. No system is perfectly secure, and we cannot guarantee absolute security.

9. Changes to this policy

If we change what Bleed collects or how it is used, we will update this policy and change the effective date at the top. For significant changes we will also tell you in the app before the change takes effect.

10. Contact

Takyonics FZ-LLC
Licence No. 45038647, registered with the Government of Ras Al Khaimah
VUNE2770, Compass Building, Al Hulaila
Al Hulaila Industrial Zone-FZ
Ras Al Khaimah, United Arab Emirates
support@takyonics.com