Privacy Policy

By using Expio, you agree to this Privacy Policy.

1. Information we collect

Information you provide

• Your email address, your name and basic account information (you need an account to use Expio)
• Expenses you enter manually
• Receipt images you upload or scan

Apart from the account details you need to sign in, giving us this information is voluntary, but some features may not work without it.

Usage and analytics data

• How often you use the app and which features you use
• Performance metrics and crash and error reports
• Usage events, which may include details of receipts you scan or save, such as the merchant, amount and currency
• Recordings of your sessions in the app (screen replays and heatmaps)

After you sign in, this data is linked to your account ID. Analytics and session recordings are on by default. You can turn them off at any time with the Analytics switch in Settings.

Device information

• Device type
• Operating system and app version
• Technical identifiers the app needs to work, including a device identifier and a push notification identifier

Location

The app reads your device's location only if you choose to detect your tax location automatically, and only while you are using the app. The coordinates are sent to Google Maps to look up your country or state. We do not store the coordinates, and we do not store your location with your receipts. The tax country you choose is saved to your account.

Payment and subscription information

If you use paid features:

• Payments are processed by third-party payment providers (for example, Apple and Google)
• We do not store or process the credit card or bank details you pay with
• Billing data is handled under the payment provider's privacy policy
• A subscription management provider (RevenueCat) receives your account ID, email address and name so it can link your purchases to your account

2. How we use the data

We use the data we collect only to:

• Provide and maintain Expio's core features
• Analyze receipts and categorize expenses
• Sync your data securely across devices
• Improve performance, reliability and the user experience
• Run internal analytics and statistical reporting
• Process subscriptions and billing through third-party providers
• Provide customer support

We do not sell personal data.
We do not use personal data for advertising.

3. Receipt scanning and automated processing

Receipt images and other documents you scan or upload are processed by an automated AI service (Google Gemini) to extract expense information.

• This processing is limited strictly to analyzing expenses
• Receipt data is not reviewed by humans
• The data is not used to train public or third-party AI models

4. Bank and card statement uploads

If you choose to upload a bank or credit card statement (PDF, spreadsheet, CSV or image), the file and the transactions taken from it are financial information. This feature is optional and runs only when you start it.

• An automated AI service (Google Gemini) processes the statement only to extract transactions. No human reviews it, and it is not used to train AI models
• The extracted transactions keep only the last four digits of an account or card number. Full account numbers and IBANs are not saved with your transactions. The uploaded file itself may still show full numbers, and it is not deleted on a schedule. We keep it until you delete the import or your account. If you uploaded it inside an organization, deleting that organization also deletes the file
• The raw transactions extracted from the file are deleted automatically 90 days after upload. When you delete the import, we delete the file and its raw transactions right away. In both cases, raw transactions you saved as expenses during the current month may be kept longer, because they count toward the monthly limit on imported expenses. Expenses you chose to save stay as your receipts
• Statement files are visible only to the account that uploaded them, even inside a shared organization
• You can undo an import at any time in Settings > Statement imports

5. Third-party service providers

Expio uses third-party services for:

• Analytics (Mixpanel, Google Firebase Analytics)
• Hosting and cloud infrastructure
• Error tracking (Sentry, Firebase Crashlytics)
• Payment and subscription processing (Apple App Store, Google Play, RevenueCat)
• Sign-in and authentication (Firebase Authentication, Sign in with Apple, Google Sign-In, and Facebook Login where it is offered)
• AI processing of receipts, documents and statements (Google Gemini)
• Push notifications (OneSignal)
• Session recording (Microsoft Clarity)
• Location lookup for tax settings (Google Maps Platform)
• App configuration (Firebase Remote Config)

These providers receive only the minimum data they need to perform their services, and they are contractually required to protect user data.

6. Data retention

• We keep data only as long as we need it to provide the service
• We may keep data longer if the law requires it
• You may ask us to delete your data at any time
• Raw transactions from uploaded bank statements are deleted 90 days after upload. The statement file itself is kept longer, as described in section 4

7. Your rights

You have the right to:

• Access your personal data
• Ask for it to be corrected or deleted
• Object to or restrict its processing
• Stop using the service at any time

You can make a request using the contact details below.

You can delete your account and its data at any time, in the app or by email. Our Delete account page explains how, what is deleted and what is kept.

8. Data security

We use appropriate technical and administrative security measures, including encryption and access controls.

Even so, no internet-based system can be guaranteed to be 100% secure.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will tell you about significant changes in advance through in-app notifications or email. Updates take effect once they are published.

10. Governing law and limitation of liability

To the maximum extent permitted by law, the developer's liability is limited to the amount the user paid for the app.

11. Contact information

Company name: Codereltech, LLC
Address: 30 N Gould St Ste R, Sheridan, WY 82801
Web: https://www.codereltech.com
Email: [email protected]