Privacy Policy

1. Who is responsible for your data

Cháy Túi is developed and operated by Cháy Túi (“we”, “us”). For the personal data described in this policy, we are the personal data controller and processor: we decide why and how the data is processed and we process it ourselves.

• Email: chaytuiapp@gmail.com
• Data protection contact: the Cháy Túi team, reachable at chaytuiapp@gmail.com

This policy follows Vietnam's Law on Personal Data Protection 2025 (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP, which details the Law. Both took effect on 1 January 2026 and replace Decree 13/2023/ND-CP. The policy also meets the App Store privacy requirements (guideline 5.1.1).

2. Scope

This policy covers the Cháy Túi app on iOS (and Android once released), its companion components such as widgets, the Share Extension and Shortcuts, and the Cháy Túi website, including the price pages, calculators, split-bill invite pages, the support page and the data request forms.

It does not cover other companies' services that you open from Cháy Túi, such as the App Store, your banking app or an advertiser's website. Those services have their own policies.

Cháy Túi is designed to be local-first: your transactions and financial figures are stored on your device. Data is only sent to a server when you use a feature that needs one: signing in, multi-device sync when you sign in, cloud AI receipt reading, AI insights, split-bill invite links and the Fire Keepers club (Hội Giữ Lửa).

3. Data we collect

The law distinguishes basic personal data from sensitive personal data. Financial data such as transactions, balances and bank account details is sensitive. We only process sensitive data with your consent and apply stronger safeguards to it.

We do not collect: bank usernames or passwords, payment card numbers, biometric data (Face ID and Touch ID are handled by iOS; the app only learns whether authentication succeeded), contacts. Location is recorded only when you choose to tag where you spent and allow it in iOS (“While using the app”); the coordinates are stored with that transaction (like other transaction data, on our servers if you turn on sync) and we do not use them for any other purpose. To show the place name or address, the app looks the coordinates up through Apple Maps (processed by Apple under Apple's policy); we do not use the lookup result for any other purpose. Password: a Cháy Túi password is optional and set by you in Settings to sign in without an email code; it is stored only as a hash and we cannot read it. It is Cháy Túi's own password, not a bank password. Credit card wallet (Pro plan): you enter the limit, statement day, payment due date and, optionally, the first 6 and last 4 digits of the card to tell cards apart; the app never receives the full number, expiry date or CVV. This is part of your wallet data and goes to our servers when you turn on sync.

Anonymous usage statistics

To learn which features are useful and where people get stuck, the Cháy Túi app sends some anonymous usage statistics to our server (Supabase, outside Vietnam, expected in Singapore). The app sends only 18 fixed types of event, for example: app opened, welcome screen completed, sign-in succeeded (with the method), first transaction saved (with how it was entered: manually, by receipt scan or by chat), receipt scan started and finished, budget set, debt or recurring transaction created, a Túi AI suggestion button shown or tapped (with the action type), widget added, paywall or plan comparison opened, a plan purchase tapped, a Free plan limit reached, and purchase completed.

Each upload contains only: the event name (with at most one value picked from a fixed list as above), the time rounded to the minute, your plan (Free/Pro/Max), the platform, the app version (without the build number), the major version of the operating system (for example 26) and a random ID the app generates on your device (the anonymous ID).

• Never sent: amounts, notes, wallet names, category names, merchant names, the content of your chats with Túi, photos, location, email, name, phone number, transaction IDs, device model, mobile carrier, language, time zone. The list of events and values is fixed in both the app and the server; the server drops anything outside the list.
• The anonymous ID is not linked to your account: it is a random string, not an account ID, email or an iOS device identifier, and the statistics tables have no column pointing to an account. The app sends statistics with the app's public key, without sign-in credentials. We do not store IP addresses next to the statistics; the IP is used only as a hash to limit bursts of requests and is deleted within 25 hours. As with any internet connection, the infrastructure provider can see your IP address when the app connects.
• A limitation to be aware of: the ID is kept stable on your device so that your uses can be chained together (needed to measure whether people come back after a few days). So this is anonymous data, not data that can never be tied back to a person; we design it to contain no identifying attributes and we do not try to match it with your account.
• The ID is kept when you reinstall the app on iPhone (stored in the device Keychain, not synced to iCloud or other devices) until you tap "Reset anonymous ID". On Android, the ID is lost when you uninstall the app.
• Retention: detailed statistics (individual events) are kept for 180 days and then deleted; active-day and device records are kept for 395 days; daily aggregates (no longer carrying an ID) are kept for up to 25 months.
• Off by default, you opt in: the app sends statistics only after you turn on "Share anonymous usage stats" in Settings › Privacy (or agree when the app first asks). You can turn it off again at any time; once off, the app stops sending immediately and deletes unsent events on the device; the ID is kept so it continues if you turn it back on.
• Reset anonymous ID: also in Settings › Privacy. It creates a new ID and asks the server to delete the statistics linked to the old one (if you are offline, the app retries on later launches for up to 7 days; detailed data is deleted after 180 days anyway). It works even if you have turned sharing off.
• Deleting your account does not delete these statistics, because they are not linked to the account. If you also want this part removed, tap "Reset anonymous ID" before uninstalling the app.
• We do not sell the statistics, do not use them for advertising, do not use them to track you across other apps or websites, and do not use a third-party analytics SDK for this.

4. Purposes and legal bases

We ask for separate consent for each purpose, at the moment you turn on the related feature. You can decline one purpose and still use the rest of the app. Silence or no response is never treated as consent. You can withdraw consent at any time (see section 12). Anonymous usage statistics (section 3) and anonymous error reports (Sentry) are also off by default and run only after you actively turn them on.

We do not buy or sell personal data (which the law prohibits), we never give transaction data to advertisers, and we do not use data for purposes other than those stated. If we need to use data for a new purpose, we will ask for your consent first.

5. AI processing

Cháy Túi uses AI to read receipts, suggest categories and comment on your spending. We process on your device first and only use server-side AI when it is really needed.

• On device first: the app reads text and amounts using iOS text recognition and an on-device AI model. At this step the photo never leaves your iPhone. On supported iOS versions, Apple's AI step may use Apple's Private Cloud Compute; according to Apple, data processed there is not retained.
• Cloud AI only when you tap: if the on-device result is uncertain, the app asks whether you want to use cloud AI. Only if you agree is the photo (downscaled, at most 2 MB) sent through our AI gateway (a Supabase Edge Function) to the Google Gemini API.
• Private mode: when enabled, the app sends no photo, only the text recognised on your device, with account numbers and phone numbers masked.
• AI insights and Q&A (Pro/Max), the Túi assistant (all plans), rule suggestions (Pro/Max) and asset comments (Max): these run only after you agree to send data to Google Gemini (see "Sending what you type and aggregated figures to third-party AI" below). AI insights receive only aggregated figures (total spending, spending by category, distribution by weekday and hour; a few top merchants with totals only if you turn on "Hỏi Túi nhắc tên quán"), never individual transactions. Q&A sends only your question; the resulting query runs on the data on your device. The Túi assistant receives the messages you send plus aggregated figures.
• AI service and data terms: cloud AI is currently the paid Google Gemini API tier. Under Google's paid-tier terms (Gemini API Additional Terms of Service), Google does not use content sent through the Gemini API (photos, text, questions) to improve Google's products and processes it under Google's data processing terms; Google may keep short-term logs to detect abuse. We do not use your data to train AI models and we do not receive your photos or scan data to improve receipt reading. Even so, for sensitive receipts or questions you should still read on device, enter manually or use private mode.
• AI logs contain no content: we only record call counts, tokens, estimated cost, model and processing tier; photos and receipt content are never stored in logs.
• Result cache: the result of reading a photo is stored against a hash of that photo for up to 30 days, so re-sending the same receipt photo does not use another credit (for statement screenshots, only within the last 10 minutes). This cache is deleted when you delete your account.
• No automated decisions with legal effects: AI results are only draft suggestions that you review and confirm before saving. AI is not used for credit scoring or any decision affecting your legal rights.

Sending receipts to third-party AI (Google Gemini)

• Only when you choose cloud scan, and we ask for consent before the first send: a receipt photo is only sent when you tap to use cloud scan for that receipt. Before the first time, the app asks, and sends the photo (or the masked text in private mode) to the Google Gemini API only after you agree. If you decline you can still read receipts on your device or enter them manually, and nothing else is lost. You can change your mind at any time in Settings.
• This is a transfer of data abroad: Google processes it on servers outside Vietnam (see sections 6 and 7). A receipt photo may contain other people's names, phone numbers or account numbers; the app tries to mask them before sending but cannot guarantee it masks everything.
• Data on Google's side: under the paid-tier terms, Google does not use the content you send to improve Google's products, but may keep short-term logs to detect abuse, for Google's retention period. This is outside our control, so after you delete your data, those logs on Google's side may remain for that period.

Sending what you type and aggregated figures to third-party AI (Google Gemini)

• Only after you agree in the app: the first time you use the Túi assistant, Ask Túi, AI insights, rule suggestions or asset comments, the app shows a dedicated dialog that says what data is sent and to whom (Google Gemini), with two equal choices, "Agree" and "On-device only". Until you choose, nothing is sent. If you decline, Túi still answers with on-device calculations and you lose no other feature. You can change your mind at any time in Settings › Security & privacy ("Cloud AI for assistant and insights"); withdrawing takes effect immediately for later sends. This consent is separate from the receipt-scan consent: agreeing to cloud receipt reading does not mean you agreed to these features.
• Data sent, by feature: Túi assistant: the messages you type, aggregated figures (total spending, change versus the previous period, spending by category, by weekday and hour, budget percentage) and a few shortened conclusions; shop names only if you also turn on "Hỏi Túi nhắc tên quán". Ask Túi: the question you type (up to 300 characters). AI insights and recaps: aggregated figures by category, day and hour. Rule suggestions: shop names, counts and most-used category, plus the names of your existing rules and recurring items. Asset comments: asset allocation, and the name of an institution with a maturing deposit with days left and value.
• Not sent: individual transactions, notes, wallet names, account numbers, phone numbers, email, photos or location. The data does not include your name or email; requests go through our AI gateway (a Supabase Edge Function) to the Google Gemini API.
• This is a transfer of data abroad: Google processes it on servers outside Vietnam (see sections 6 and 7).
• Protection on Google's side: under the paid-tier terms, Google does not use this content to improve Google's products and may keep short-term logs to detect abuse, for Google's retention period. We do not store question or message content in AI logs.

Receipt-scan data contribution: not available for now

This version has no receipt-scan data contribution feature: the app does not send receipt photos, the values you corrected or scan-quality measurements to us to improve receipt reading, and Settings has no such option. If we bring it back later, we will ask for your separate consent and update this policy before collecting any data.

6. Where data is stored and cross-border transfers

Transaction data is mainly stored on your device. When you use features that need a server, data is stored or processed by the providers listed in section 7. Their servers may be located outside Vietnam: Supabase (South-East Asia region, expected to be Singapore), Google (Gemini API), RevenueCat, Cloudflare, Sentry (United States) and Apple (possibly in the United States, the European Union or elsewhere).

When transferring personal data abroad, we prepare and keep a cross-border personal data transfer impact assessment and complete the required procedures with the specialised personal data protection authority under the Ministry of Public Security, as required by the Law on Personal Data Protection and Decree 356/2025/ND-CP. We only transfer the data each feature needs, and only use providers that commit to protecting data through contracts or data processing terms.

7. Processors and third parties

Anonymous error reports (Sentry)

This feature is off by default. Only if you turn on the error-report switch in Settings does the app send an error report when it has a problem, to the Sentry service (Functional Software, Inc.). Sentry's servers may be located outside Vietnam, so turning it on means a transfer of data abroad; the app says so when you turn it on. A report contains the error type, technical stack trace, app and operating system version and device model. Reports do not include amounts, notes, merchant or shop names, your chat with Túi, receipt photos, your email or your name, and are not linked to your account. Turning the switch off stops sending immediately.

What other users can see

• Split-bill invite links: anyone who opens the link sees the group name, members' display names, how much each person still owes, and the payment details (bank, account number) used to create the VietQR code. They cannot see your notes or any other transactions. Only share the link with people in the group.
• Fire Keepers club: friends only see your fire level (0–3), the Túi mascot's expression and your streak, never any amounts.
• Share cards (Wrapped, heat level): amounts are hidden by default; you decide whether to show them before posting.

Beyond the cases above, we only disclose personal data to competent authorities when required by law. If Cháy Túi is transferred to a new owner, we will notify you in advance and the new owner must continue to comply with this policy.

8. Advertising

The current version of the app shows no ads on any plan and includes no advertising SDK, so no advertising data is collected. If ads are added later, we will update this policy and ask for your consent (where the law requires it) before they apply.

• No tracking permission: the app does not access Apple's advertising identifier (IDFA), does not show a tracking permission prompt and does not track you across other companies' apps or websites.
• We do not share your transactions, receipt photos, financial figures or email with advertisers.

9. Cookies and website analytics

• The Cháy Túi website does not use tracking or advertising cookies, and shows no cookie banner because there is nothing that needs permission.
• We currently do not run any analytics tool (such as Umami or Google Analytics) on the website. If we add one later, we will update this section first.
• Forms (Android waitlist, data requests, account deletion) use Cloudflare Turnstile to tell humans from bots. Turnstile may process your IP address and technical browser signals for this purpose only.
• Cloudflare may set strictly necessary technical cookies for security and site operation. These cookies are not used to track you.

10. Retention

11. Security measures

• All connections between the app, the website and our servers are encrypted (HTTPS/TLS). Data on our servers is encrypted at rest by our providers.
• On your iPhone: data is protected by iOS Data Protection; sign-in tokens are stored in the Keychain; you can lock the app with Face ID, Touch ID or a passcode.
• Each account can only read and write its own data, enforced by Row Level Security on every table.
• Receipt photos are kept in private storage and can only be opened through signed links that expire within minutes.
• AI keys exist only on our servers, never in the app. The AI gateway checks sign-in, quotas, image size and request rate.
• The admin console requires two-factor authentication, and every admin action is written to an append-only audit log. Admin tools do not show the content of your transactions.
• No system is perfectly secure. We recommend enabling a screen lock and the app lock, and keeping iOS up to date.

12. Your rights and how to exercise them

Under the Law on Personal Data Protection, you (the data subject) have the following rights:

• The right to be informed about how your personal data is processed, as described in this policy.
• The right to consent or refuse for each processing purpose.
• The right to access, view and correct your data, or to ask us to correct it.
• The right to withdraw consent. Withdrawal does not affect the lawfulness of earlier processing; features that rely on that consent will stop working.
• The right to deletion, except where the law requires us to keep the data.
• The right to restrict processing.
• The right to obtain your data, including an export in JSON or CSV format.
• The right to object to processing for a specific purpose, such as anonymous error reports or anonymous usage statistics.
• The right to complain, report and bring legal action before competent authorities or the courts.
• The right to claim compensation for damage caused by a breach of personal data protection rules, as provided by law.

How to make a request

• In the app: Settings → Account to export your data (JSON/CSV) or delete your account (you confirm again with the way you sign in); Settings → Sign-in & security to set or change an optional password; edit or delete individual transactions directly; turn sync, cloud AI, private mode, anonymous error reports and anonymous usage statistics (with the Reset anonymous ID button) on or off in Settings.
• On the web: use the form on the account deletion page. We verify your identity through the email address linked to the request before deleting or providing any data.
• By email: write to chaytuiapp@gmail.com from the email address linked to your account. See also the support page.

Response times

We do not charge for these requests. If we cannot fulfil a request (for example because the law requires us to keep certain data), we will reply in writing and explain why. If you are not satisfied with how we handled it, you can complain to the specialised personal data protection authority under the Ministry of Public Security or bring an action before a competent court.

13. Children

Cháy Túi is intended for people aged 18 and over, and we do not knowingly collect children's data. If we discover that we have processed a child's data without valid consent from a parent or guardian, we will stop processing and delete that data. Parents or guardians can contact chaytuiapp@gmail.com to make a request.

14. Data breach notification

If an incident causes personal data to be exposed, lost or accessed without authorisation, we will notify the specialised personal data protection authority within 72 hours of discovering it, as required by law. Where the incident may affect you, we will notify you in the app or by email, explaining what happened, which data was affected, what we have done and what you should do.

15. Changes to this policy

We may update this policy when we add features or when the law changes. The version and effective date are always shown at the top of the page. For significant changes, such as a new processing purpose or a new provider receiving sensitive data, we will notify you in the app before the change applies and ask for your consent again where the law requires it.

16. Contact

For any question about this policy or your data, please contact Cháy Túi by email at chaytuiapp@gmail.com. See also our Terms of Use and support page.