PicoTally (“the App”) is published by Pico Apps LLC (“we”, “us”, “our”). This policy explains what data we collect, why, and how we protect it. It applies wherever you use PicoTally: the iPhone and iPad app, the Android app, and the web app at app.picotally.com.
1. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account | Email address; your name if your Google or Apple account provides one; which sign-in method you use | Authentication and account management |
| Business profile | Business name, address, phone, business email, logo, hourly rate, invoice numbering and payment terms, PayPal and Venmo handles if you enter them, and a reference to your Stripe account if you enable payment collection | Populating your invoices and quotes, and paying you |
| Customer records | Client name, email, phone, address, notes | Invoice delivery and CRM |
| Financial records | Invoices, quotes, expenses, payments, payment receipts, receipt images, job folders and notes | Core app functionality |
| Media | Photos (receipts, note attachments), voice notes | Receipt scanning, voice-to-invoice, notes |
| Subscription | Your plan, its status and renewal date, and which store or processor bills you. Never your card number. | Unlocking paid features |
| Voice usage | Minutes of real-time voice conversation used this month | Applying the Pro Max monthly limit |
| Arrival source | Which of our own ads or links brought you to us (for example “Facebook ad, September test”), or the code of a referral partner whose link you used, recorded once when you create an account. If you came through a partner, we pay that partner a share of what you pay us; they are not told who you are. It is a label we write ourselves; nothing about you is sent to any advertising network. | Seeing which of our ads bring people who stay |
| Crash reports | Error stack traces, device model, OS version (no personal identifiers) | Fixing bugs and improving stability |
| Usage analytics | A fixed set of product events (app opened, onboarding finished, invoice sent, receipt scanned, voice started, paywall viewed, free month started, subscription started), app version, platform, plan tier, a random session ID, and a one-way hash of your account ID | Seeing which features are used and where new users get stuck |
We do not collect location data, contacts, health data, browsing history, or advertising identifiers, and we do not use any of your data for advertising.
We no longer ask for a tax registration number. Older versions of the app had an optional field for an EIN or tax ID; the field was removed in September 2026 and any value previously stored has been cleared from our database.
If you turn on Face ID, Touch ID or fingerprint sign-in, your device performs the check and only tells the app whether it succeeded. Biometric data never reaches us.
To be precise about the one identifier in that table: usage analytics carry a SHA‑256 hash of your account ID. Hashing is one-way, so our analytics provider cannot work backwards from it to your identity — but it is stable across your sessions and devices, which is what lets us count one returning person rather than five strangers. We describe it as pseudonymous rather than anonymous, because that is what it is.
2. How we use your data
- Core functionality, creating invoices, tracking expenses, managing customers, generating PDFs.
- AI assistant, when you use the in-app AI assistant (by voice or by typing), the following is sent to Anthropic Claude on each turn of the conversation:
- Your message text;
- A snapshot of your business data, your customer list with outstanding balances, your recent invoices, recent expenses, recent payments, current-screen context, and current-month summary statistics, so the assistant can answer your question in the context of your business;
- If the assistant needs an exact total or a longer list to answer accurately, it may run a query against your own records and the result of that query is returned to Claude in the same conversation.
- Separately, when the app suggests a title for a new document, it sends the short job description to Claude for that purpose only.
Recorded voice notes (dictating a job) are uploaded and transcribed by Deepgram; only the resulting transcript text — not the audio — is then sent to Anthropic Claude or Google Gemini to extract the job details. When the assistant speaks back, the reply text is sent to Deepgram to be turned into speech.
Real-time voice ("Hey Pico", Pro Max) works differently. Your microphone audio streams live through LiveKit (a real-time media service) to our voice assistant, which runs on Fly.io servers in the United States, and on into Google Gemini Live, which listens and replies in the same conversation. In this mode your raw audio — not just a transcript — is handled by LiveKit, Fly.io and Google. The assistant also looks up your own business records while you talk, so that it can answer questions about them.
Receipt scanning is a separate flow again: the text read off the receipt is sent to Google Gemini for itemisation (the receipt image itself is never sent to Gemini). All AI calls are processed server-side via secure edge functions; no AI provider keys are embedded in the app. - On-device OCR. Google ML Kit extracts text from receipt images entirely on your device, so no image is sent to any AI provider to be read. The receipt photo itself is still uploaded to your own Supabase storage, so it syncs across your devices and stays attached to the expense as evidence.
- Payments, when your customer pays an invoice through its pay link or QR code, Stripe processes the transaction. We store the payment status and a reference to the Stripe session, never anyone’s card details.
- Email, sign-in, password and account emails to you, and the invoices, quotes and receipts you choose to email to a customer, are delivered through Resend.
- “Hey Pico” wake word (phone apps, Pro Max), when you turn it on, the phone listens for the phrase using a small model that runs entirely on the device. Nothing is recorded or transmitted until the phrase is detected and a voice session begins, which the app shows on screen.
- Crash reporting, if enabled, anonymous crash data is sent to Sentry. No personally identifiable information is included.
- Usage analytics, we record a small, fixed set of product events through TelemetryDeck — the app was opened, onboarding finished, an invoice was sent, a receipt was scanned, voice was started, the paywall was viewed, a free month started, a subscription started — so we can see which features earn their keep and where new users get stuck. Each signal carries your app version, platform, plan tier, a random session ID, and the hashed account ID described above. It never carries your name, email, customer records, invoice or quote contents, notes, or any dollar amount. We use this only to improve the product; it is not sold, shared, or used for advertising.
3. Third-party services
| Service | Data received | Purpose |
|---|---|---|
| Supabase | All synced business data, your account, and the files you upload | Cloud database, authentication and file storage, on servers in the United States |
| Google Sign-In / Sign in with Apple | Your name and email address from that account, only if you choose that sign-in method | Authentication |
| Google Gemini | Text read off your receipts (not the images), and transcripts of job voice notes | Itemising receipts and extracting job details |
| Google Gemini Live | Your microphone audio, live, plus the business context the assistant needs to answer you | The real-time "Hey Pico" voice assistant (Pro Max) |
| LiveKit | Your microphone audio, live | Carrying the real-time voice conversation between your phone and the assistant (Pro Max) |
| Fly.io | Your microphone audio, live, and the business records the assistant looks up to answer you | Running the voice assistant service itself, on servers in the United States (Pro Max) |
| Deepgram | Recorded voice notes (audio), and the assistant's reply text when it speaks back | Voice-to-text transcription, and text-to-speech |
| Anthropic Claude | Your assistant message (voice transcript or typed text) plus a snapshot of your business data, customer names with balances, recent invoices, recent expenses, recent payments, and current-month statistics. May also receive additional rows from your own records when the assistant runs a query mid-conversation, and short job descriptions when suggesting a document title. | Powering the in-app AI assistant: answering questions about your business and drafting invoices, expenses, and payments on command |
| Stripe (Connect) | Invoice amount and currency, and the customer name and description shown on the invoice. Your customer enters their own email and card on Stripe’s payment page, not in PicoTally. | Payment processing for invoices you send to your customers |
| Apple App Store (StoreKit) | Purchase receipt (signed by Apple) | Processing your Pro subscription if you subscribed on iPhone or iPad. Apple, not us, sees your payment method. |
| Google Play Billing | Purchase token and subscription status (signed by Google) | Processing your Pro subscription if you subscribed on Android. Google, not us, sees your payment method. |
| Stripe (Billing) | Your email address and subscription status; the card you enter is stored by Stripe | Processing your Pro or Pro Max subscription if you subscribed on the web. Stripe, not us, sees your card details. |
| Sentry | Crash logs (scrubbed of PII) | Error monitoring |
| TelemetryDeck | Product event names (e.g. “invoice sent”), app version, platform, plan tier, a random session ID, and a SHA‑256 hash of your account ID. No names, emails, customer records, document contents, or dollar amounts. | Product usage analytics — which features are used, and where new users drop off |
| Resend | The recipient's email address and the invoice, quote or receipt PDF you chose to send, plus your account email for sign-in and password emails | Delivering the documents you send to your customers, and account emails to you |
| Google ML Kit | None (on-device only) | Text recognition from images |
| Cloudflare | Standard web-server logs (IP address, browser type, pages requested) when you visit picotally.com or app.picotally.com, kept briefly by Cloudflare for security | Hosting the website and the web app |
Waitlist signups submitted through the early-access form that ran on picotally.com before launch were received by a Cloudflare Pages Function that runs on the same infrastructure as the website itself. The submission (name, email, optional trade) stays on our Cloudflare account, the same provider that hosts the marketing site, and is not shared with any third-party form processor.
Development and support tooling. When we diagnose a problem or check how the service is running, we use development tools on our own computers, including AI coding tools from Anthropic (Claude Code). These tools work from counts, dates and system records by default, through a database account that cannot read customer names, contact details, receipt images or invoice contents. Individual account data may pass through them only when a specific account needs fixing. We have opted out of model training for these tools, and we do not use them to browse customer records.
Cookies and tracking. picotally.com sets no cookies and loads no analytics or advertising scripts. app.picotally.com keeps your sign-in session in your browser’s local storage, which is required for the app to work; it uses no advertising cookies or trackers.
We do not sell, rent, or share your data with advertisers, data brokers, or any party not listed above.
4. Device permissions
- Microphone, voice-to-invoice, voice notes, the chat microphone, and the real-time voice assistant. Only active when you tap to talk, or, if you turn on the “Hey Pico” wake word in the phone apps, while the on-device listener is waiting for the phrase.
- Camera, taking photos of receipts and note attachments.
- Photo library, choosing an existing photo for receipt scanning or a note. On Android the system photo picker is used, so the app needs no library permission.
- Face ID / Touch ID / fingerprint, optional quick sign-in on the phone apps.
- In the browser, your browser asks for microphone and camera access separately and you can revoke it in the browser’s site settings.
Each permission is requested only when needed and can be revoked at any time in your device settings.
5. Data storage and security
- Cloud data is stored in Supabase (PostgreSQL) with row-level security. Each user can only access their own records, enforced at the database level, not just in app code.
- On iPhone and Android, a local copy is cached on your device in a SQLite database for offline use. The file is encrypted with SQLCipher (AES-256); the encryption key is generated on your device and stored in the iOS Keychain / Android Keystore, and never leaves the device.
- In the browser, a working copy of your data is kept in your browser’s own storage so the web app is fast and survives brief connection drops. Browser storage is not separately encrypted; it is protected by your device login and the browser’s isolation of each site. Sign out when you finish on a shared computer.
- Our servers are in the United States.
- All network communication uses HTTPS/TLS encryption.
- API keys for Google Gemini, Deepgram, Anthropic Claude, LiveKit, Resend, and Stripe live only as server-side secrets. They are never bundled into the mobile app and cannot be extracted from an installed binary.
- Crash reports sent to Sentry are passed through a PII scrubber that redacts emails, phone numbers, tokens, and truncates long free-form text before the report leaves your device.
6. Data retention and deletion
- Your data is retained for as long as your account is active.
- You can delete individual records (invoices, expenses, customers) at any time from within the app.
- You can permanently delete your entire account from Settings → Account → Delete Account. This removes all rows tied to your user ID across our database, invoices, quotes, expenses, receipts, customers, project notes, voice memos, uploaded logos and photos, plus your authentication record. The deletion is irreversible and completes within seconds. The same option is available in the web app under Settings → Account. If you no longer have access to the app, email us from the account’s address and we will delete it for you within 30 days, usually within a few business days. Full instructions, including how to request deletion if you no longer have the app installed, are on our Delete your account page.
- The same in-app deletion also wipes the encrypted local database on your device, removes the SQLCipher key from the iOS Keychain / Android Keystore, and clears any saved sign-in credentials. Use the in-app Delete Account flow rather than just uninstalling, uninstalling removes the app’s documents folder but, by default, the iOS Keychain entries survive uninstall and would persist until the device is wiped or you delete the PicoTally entries via iOS Settings.
- Audit logs of payment webhook events received from Stripe are retained for fraud-detection purposes; these contain transaction metadata (amount, currency, status) but no card numbers and no personal account information.
- Database backups taken before your deletion request may continue to hold a copy of your data for up to 7 days, after which they are rotated out and unrecoverable. We do not access these backups except to recover from infrastructure failure.
- Apple, Google and Stripe keep their own records of your subscription payments under their own policies; deleting your PicoTally account does not delete those, and does not cancel a subscription (see the Delete your account page).
7. Your rights
You have the right to:
- Access all data we hold about you (available directly in the app).
- Correct inaccurate data (editable in the app).
- Delete your data and account.
- Export your data: jobs, expenses, clients and payments as CSV from Settings → Data & privacy; the tax-time report as Excel or PDF; any invoice or quote as PDF.
If you are a resident of California, Texas or another U.S. state with a consumer privacy law, or of the EU/EEA or the United Kingdom, you may have further rights, including data portability and the right to complain to a regulator. Email us and we will honor them. We do not sell personal data, and we will never treat you differently for exercising a privacy right.
8. Children’s privacy
PicoTally is a business tool designed for adults. Our Terms of Service require you to be at least 18 years old to use the App, and we do not knowingly collect data from anyone under 18. If we learn that we have collected data from a minor, we will delete it promptly. If you believe a minor has provided us with data, contact support@picotally.com and we will remove it.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via an in-app notice. The “effective date” at the top of this page will be updated accordingly.
10. Contact
If you have questions about this privacy policy or your data, contact us at:
Email: support@picotally.com