Privacy Policy
Version 1.7
1. Scope
This policy describes data handling in the 328 Expense iOS app and this website. The app provider is the developer identified on its App Store listing. The data involved can vary with your app version and the features you use.
2. Financial records on your device
The app stores transactions, accounts, balances, books, categories, members, notes, attachments and preferences on your device to provide record keeping, calculations, reports and search. Routine record keeping does not upload your entire ledger to this website. The current iOS app generates Excel exports on the device, after which you choose whether to share them.
3. iCloud and backups
When you use iCloud backup, backup files are stored in iCloud Drive under your Apple Account. Some preferences also use Apple’s iCloud key-value storage. Backups may contain financial records and attachments. Availability and storage management depend on your Apple Account and device settings. See Apple’s Privacy Policy.
4. Purchase, initial-use and restoration records
Older app versions send initial-use and purchase-related events to api.expendee.app to support activation, purchase verification, restoration and assistance. These may include the device identifier for vendor (IDFV), app identifier and build, locale information, iCloud availability, purchase product and date, event result and App Store receipts. Purchase restoration may also query the support service using the IDFV. Apple handles payments; the app does not receive your full payment-card number.
5. Purchase history
In the background, the app sends transactions verified by StoreKit on the device to money.wwwalterhk.workers.dev for storage in Cloudflare D1. Records include the installation identity, transaction and original transaction identifiers, product, purchase date, expiration or revocation date when available, test or production environment, ownership type, and app and iOS versions. New versions also send Apple-signed transactions for server verification. Apple sends signed renewal, expiration, refund and revocation notifications to this service. Verified records activate and restore purchase entitlements and support authorized administrator review. The service does not store complete signed payloads or raw receipts, and does not receive payment card details or Apple account credentials. Older app-reported records are retained separately and are not proof of an Apple-verified purchase.
6. App and device information on first open
On the first launch of a version supporting this feature, the app sends its version, build, iOS version, device family, model identifier, app identifier and first-observed time in the background through money.wwwalterhk.workers.dev to Cloudflare D1. A random installation identity in the device Keychain prevents duplicate records. Notification permission is not required. This record excludes email, ledger contents, balances, images and receipts. Diagnostics also include language, locale, time zone, screen and display settings, notification permissions, network type, low power mode, available storage, iCloud availability and cached purchase status. Offline attempts retain the original snapshot and retry later. For existing users, this is the first launch observed by this feature after updating, not a reconstructed historical installation date. Earlier records may receive one diagnostic snapshot with a separate capture time, without changing the original first-open information.
7. Support information you submit
The new Contact Us feature requires a valid email address and notification and alert permission. Message category, text, your contact email address, the image you choose, a random installation identifier and diagnostic information are sent through money.wwwalterhk.workers.dev with messages and metadata stored in Cloudflare D1 and selected images stored privately in Cloudflare R2. App data is separated by tenant. Diagnostics include app/build version, device model, iOS, language, region, time zone, display, network status, available storage, purchase status and notification settings. Ledger contents, balances, email and receipts are not automatically attached. A support credential is stored in the device Keychain, a push token is used for reply notifications, and the service records a 15-minute submission cooldown. Push alerts announce a new reply without displaying the conversation text. Older versions and the separate purchase-restoration support form may still send your email, purchase details, images and receipts to api.expendee.app. Review your text and images to avoid unnecessary sensitive information.
8. Photos, reminders and biometrics
Photo selection, camera and reminder features may request system permissions, which you can manage in iOS Settings. Photos attached to transactions are stored as app records and may be included in backups you create. Biometric locking uses the device’s authentication mechanism; the app does not read your Face ID or Touch ID biometric templates.
9. This website and service providers
Cloudflare delivers and protects this website. Requests involve IP addresses, browser/device information and technical data included with the request. Cloudflare processes that data under its service policies; see Cloudflare’s Privacy Policy. This site has no ledger-upload or payment feature and adds no analytics scripts, advertisements or non-essential cookies. Apple, support services and recipients you select for sharing may also process data needed for their respective services.
10. Retention, deletion and your choices
Manage device records within the app. Removing the app may remove its local data, but does not automatically remove iCloud backups or exports already shared; manage those copies separately. Submitted purchase and support records may be kept for purchases, restoration, issue investigation and applicable legal needs; this policy does not promise a fixed retention period. To ask about access, correction, deletion or applicable privacy rights for these records, use Contact in the app’s Settings. Records needed for legal obligations or ongoing processing may not be immediately removable.
11. Security, international processing and updates
The network requests described above use HTTPS. No storage or transmission method guarantees complete security; protect your device, Apple Account and backups. Service providers may process data outside your location. Changes to this policy will show a version number. For questions, use Contact / Feedback in the app or the developer information on the App Store.