privacy policy
BillBuffer is a bill tracker. To do that it has to hold some genuinely sensitive information about your money, so this policy sets out exactly what is collected, who it is shared with, and what is deliberately never collected.
Who this covers
This policy applies to the BillBuffer mobile app, the BillBuffer website at billbuffer.com.au, and the mailing list. It is written to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth).
If you only join the mailing list, the only thing collected is your email address. Everything else below applies to the app.
What is collected
- Your phone number. Used to sign you in. BillBuffer has no password; a one-time code is sent by SMS and that is the whole account.
- Your name and email address. Optional. Only stored if you enter them.
- Your bills. The name, amount, due date, category, how often it repeats, the provider's website, and any notes you add.
- Which bills you have paid. Recorded per due date so the app can tell a paid October bill from an unpaid November one.
- Your pay cycle. How often you are paid, your next payday, and optionally how much. Used to work out which bills land before your next pay.
- Documents you upload. Photos and PDFs of bills or bank statements, if you choose to use that feature. See 'AI bill scanning' below, because that one deserves its own section.
- A push notification token. So bill reminders can reach your device. Only if you turn reminders on.
- Basic app usage. Which screens are opened and which features are used. See 'Analytics' below for what is deliberately excluded.
What is deliberately NOT collected
These are design decisions in the product, not just promises:
- No bank connection. BillBuffer never asks for banking credentials and has no open-banking or CDR connection. It cannot see your transactions or your balance. Bills are the ones you add or upload.
- No card or payment details. Subscriptions are billed by Apple through the App Store. BillBuffer never sees your card number.
- No bill names or amounts in analytics. Usage events record that a bill was marked paid, never which bill or for how much.
- No amounts on your lock screen. A bill reminder says a payment is due and names the biller. The dollar figure is deliberately left out of the notification so it does not appear on a locked phone.
AI bill scanning
If you photograph a bill or upload a statement, that file is sent to OpenAI so the amount, due date and biller can be read out of it automatically. This is the only feature that sends your documents to a third party, and it only runs when you choose to upload something.
A bank statement can contain far more than the bill you are trying to add — other transactions, balances, account numbers. Only upload one if you are comfortable with that. You can always add a bill by hand instead, and the app works fully without ever using this feature.
Uploaded files are stored in BillBuffer's own storage so you can see what was scanned. PDFs sent to OpenAI are deleted from OpenAI once parsing finishes.
Who your information is shared with
BillBuffer does not sell your information and does not share it for advertising. It is shared only with the services needed to run the product:
- Supabase. Hosts the database, your account, and uploaded files.
- Twilio. Delivers the sign-in code by SMS. Receives your phone number.
- OpenAI. Reads uploaded bills and statements. Only when you upload one.
- Apple. Delivers push notifications, and bills subscriptions through the App Store.
- RevenueCat. Manages subscription status. Receives an anonymous account identifier, not your phone number or bills.
- PostHog. Product analytics. Receives usage events without bill names or amounts.
- Brandfetch. Supplies biller logos. Receives the provider's website domain, e.g. 'telstra.com.au', never your bill.
- Fly.io. Hosts the BillBuffer API.
Where your information is held
The BillBuffer API runs in Sydney. Some of the services listed above process data overseas, including in the United States. By using BillBuffer you consent to that transfer, which is what Australian Privacy Principle 8 requires be disclosed.
How long it is kept
Your information is kept while your account exists. You can delete your account from Settings inside the app, which removes your profile, bills and payment history.
Some records may persist briefly in backups and in service providers' own logs after deletion.
Your rights
You can ask for a copy of the information held about you, ask for it to be corrected, or ask for it to be deleted. Email [email protected] and it will be actioned within a reasonable time.
If you are unhappy with how a privacy issue was handled, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Sign-in tokens are held in the device keychain. Traffic to the API uses HTTPS. There is no password to leak, because BillBuffer does not use one.
No system is perfectly secure, and this cannot be promised away. If a breach occurs that is likely to cause serious harm, you will be notified as required by the Notifiable Data Breaches scheme.
Children
BillBuffer is not intended for anyone under 16 and accounts should not be created for them.
Changes
If this policy changes in a way that materially affects you, notice will be given in the app or by email before the change takes effect. The date at the top always reflects the current version.