Privacy Policy for AI Expense Tracker: Notal

1. Who this is for

This Privacy Policy explains what Notal (“the app”, “we”, “us”) collects about you, why, and what you can do about it. Notal is made by theworkers.co, based in Istanbul, Türkiye. You can reach us at [email protected].

2. What we collect

• Account information: your email address, and if you sign in with Apple or Google, the identity Apple or Google shares with us for that sign-in.
• What you write or record: every entry you create, including typed text, voice recordings, and receipt or statement photos, plus the categories, tags, amounts and dates attached to it.
• Settings: your language, currency, notification preferences, quiet hours, categories and tags.
• Device push token: a device identifier from Apple or Google’s push service (through OneSignal, see below), used only to send you the notifications you have turned on.
• Purchase status: whether you are on the free or Premium plan, and the subscription state Apple or Google’s store reports to us. We do not receive or store your card number; the store handles payment directly.

We do not collect more than this. In particular, we do not track you across other apps or websites, and we do not build an advertising profile of you.

3. How your data is processed, in plain terms

Notal reads what you write with the help of third-party AI models, so it can understand it. When you write “coffee 45”, speak a note, or photograph a receipt, that text, audio or image is sent to a third-party AI provider for interpretation, to work out the amount, the category, whether it is income or an expense, and similar details. This routes through OpenRouter, an AI infrastructure provider, to the underlying model: currently a Qwen model for typed text, a Google Gemini model for photos, and OpenAI’s Whisper for voice. Which specific model is used may change over time as we improve accuracy or cost; the fact that a third-party AI model reads your text, voice or photo to interpret it does not change.

This interpretation is a proposal, never the final record. The AI never decides your balance and never has final say over what counts as income or an expense. All of your totals are calculated by our own, deterministic code, from the entries you have confirmed. You can always review, edit or correct what the AI understood before or after it is saved.

Your data is stored in Frankfurt, Germany (AWS’s eu-central-1 region), whichever country you write from. Voice recordings and receipt photos are kept as files, referenced internally and never exposed as a public link; when the app needs to show you one, it is given a link that expires after about 15 minutes.

We are not anonymous, and we do not claim to be. Your entries, recordings and photos are tied to your account so the app can show you your own ledger and calculate your own balance. “Anonymous” would mean nobody, including us, could connect this data back to you. That is not how Notal works, and this policy does not claim otherwise.

4. Who else sees your data, and why

We do not sell your data to anyone, for any reason.

5. How long we keep your data

• Deleted entries stay in a trash for 30 days, after which they are permanently removed. Restoring an entry from the trash is a Premium feature.
• Delete your account at any time, from inside the app (Settings → Account → Delete account). This permanently removes your entries, recurring templates, categories, tags, settings, notification history and sign-in record, and starts the removal of your stored voice recordings and receipt photos. This cannot be undone.
• We keep account and entry data only for as long as your account is active, plus the 30-day trash window above.

6. Your rights

Wherever the GDPR or KVKK (Türkiye’s data protection law) applies to you, you have the right to:

• Access the personal data we hold about you.
• Delete it, in full, at any time. The in-app “Delete account” action does this yourself, immediately, with no need to contact us.
• Correct it. Most of your data is something you wrote yourself and can edit directly in the app.
• Object to or restrict certain processing, and lodge a complaint with your local data protection authority.

To exercise any of these rights another way, or to ask us anything about this policy, write to [email protected].

7. Children

Notal is not directed at children, and we do not knowingly collect data from anyone under 13, or under the higher minimum age the law sets where you live. If you believe a child has given us data, write to us and we will take care of it.

8. Changes to this policy

We may update this policy as the app changes. We will note the date of the latest change at the top of this page, and material changes will be announced in the app.

9. Contact

Questions about this policy or your data go to [email protected]. See also our Terms of Use and Support page.