--- title: "Privacy Policy · Notal: AI Expense Tracker · theworkers.co" description: "How Notal handles your data: what it collects, the third-party AI models that read your entries, where data is stored, and how to delete it." url: https://theworkers.co/notal/privacy/ lang: en --- # Privacy Policy for Notal: AI Expense Tracker Last updated: 20 October 2026[Türkçe](https://theworkers.co/notal/privacy/tr/)[Español (México)](https://theworkers.co/notal/privacy/es-mx/)[Español (España)](https://theworkers.co/notal/privacy/es-es/)[Deutsch](https://theworkers.co/notal/privacy/de/)[Français](https://theworkers.co/notal/privacy/fr/)[Italiano](https://theworkers.co/notal/privacy/it/)[Nederlands](https://theworkers.co/notal/privacy/nl/)[Português (Portugal)](https://theworkers.co/notal/privacy/pt-pt/)[Català](https://theworkers.co/notal/privacy/ca/) * * * ## 1\. Who this is for This Privacy Policy explains what Notal (“the app”, “we”, “us”) collects about you, why, and what you can do about it. Notal is made by theworkers.co, based in Istanbul, Türkiye. You can reach us at [support@theworkers.co](mailto:support@theworkers.co). * * * ## 2\. What we collect - **Account information**: your email address, and if you sign in with Apple or Google, the identity Apple or Google shares with us for that sign-in. - **What you write or record**: every entry you create, including typed text, voice recordings, and receipt or statement photos, plus the categories, tags, amounts and dates attached to it. - **Settings**: your language, currency, notification preferences, quiet hours, categories and tags. - **Device push token**: a device identifier from Apple or Google’s push service (through OneSignal, see below), used only to send you the notifications you have turned on. - **Purchase status**: whether you are on the free or Premium plan, and the subscription state Apple or Google’s store reports to us. We do not receive or store your card number; the store handles payment directly. - **Your AI consent**: whether you agreed to Notal AI reading what you write, say or photograph, and when. - **Reports of a misreading**: if you tell us Notal AI read an entry wrong, a copy of that entry. See section 3. - **Usage events**: which screens you open and what you do in the app, for example that an entry was saved. Linked to your account only if you agree, with one exception. See section 3. - **Crash reports**: a technical report when the app crashes or hits an error. See section 3. We do not collect more than this. In particular, we do not track you across other apps or websites, and we do not build an advertising profile of you. * * * ## 3\. How your data is processed, in plain terms **Notal AI reads what you write with the help of third-party AI services, so it can understand it.** When you write “coffee 45”, speak a note, or photograph a receipt, that text, audio or image is sent to a third-party provider for interpretation, to work out the amount, the category, whether it is income or an expense, and similar details. Requests go through OpenRouter, an AI infrastructure provider, to the model that does the reading. A typed note is read by a DeepSeek model that DeepInfra or CoreWeave runs in the United States; the note does not go to DeepSeek itself. A receipt photo is read by a Google Gemini model. If either is unavailable, a Google Gemini model answers instead. A voice note is first turned into text by a separate speech-to-text service (Whisper), then read like a typed note. Which model is used may change over time. That a third-party service reads your text, voice or photo does not. **Typed notes and receipt photos are not kept and not used for training.** Notal AI reads your typed notes and receipt photos only through providers that do not use them to train models. That rule is enforced on every request we send. When Notal AI reads a typed note or a receipt photo, the provider that processes it does not keep a copy. It is used to produce the reading and then discarded. **Voice is different.** A separate transcription service turns voice notes into text, and we cannot choose which one, so the two commitments above do not cover voice recordings. In our tests the service has been DeepInfra, which states that it does not store this data or train on it, but we cannot enforce or check that. **You choose whether Notal AI reads your data.** The app asks for your agreement before Notal AI reads anything you write, say or photograph for the first time. You can withdraw it at any time in Settings, under Your data, “Notal AI and your data”. After you withdraw, Notal AI stops reading new notes, recordings and photos, and the app asks again when you add something new. What you already saved stays as it is. We keep a record of whether and when you agreed. **This interpretation is a proposal, never the final record.** The AI never decides your balance and never has final say over what counts as income or an expense. All of your totals are calculated by our own, deterministic code, from the entries you have confirmed. You can always review, edit or correct what the AI understood before or after it is saved. **If you tell us Notal AI misread an entry.** At the bottom of an entry’s details you can tap “Notal AI misread this”. We then store a copy of the entry as it was at that moment, and we look at it ourselves to improve how Notal AI reads entries like it. The copy holds the note text, the transcript of a voice entry (never the recording itself), what Notal AI read from the entry, and, for a receipt entry only, the receipt photo. It also notes the app version and your language and currency settings. The copy is kept until you delete your account, even if you delete the entry first. **Your data is stored in Frankfurt, Germany** (AWS’s eu-central-1 region), whichever country you write from. Voice recordings and receipt photos are kept as files, referenced internally and never exposed as a public link; when the app needs to show you one, it is given a link that expires after about 5 minutes. **Crash reports.** When the app crashes or hits an error, it sends a technical report to Sentry, using Sentry’s EU region (Frankfurt), so we can fix the problem. A report holds technical details: the error, the device model, the operating system and the app version. It does not contain your user ID, your email address or anything you wrote, and we have turned off IP address storage in Sentry. No screenshot or screen recording is taken. Only errors and crashes are reported, not how you use the app. **Product analytics, only if you agree.** The app asks whether we may measure how you use it. This is a separate choice from the Notal AI consent. Saying no changes nothing in the app, and you can change your answer at any time in Settings, under Your data, “Usage statistics”. If you agree, the app sends PostHog events about which screens you open and what you do, for example that an entry was saved or that the Premium screen was opened. These events are linked to our internal user ID, never to your email address. They never contain amounts, what you wrote, vendor names, your email address or your IP address. Session recording and automatic tap collection are turned off. If you do not agree, our server sends PostHog a small set of usage events with no user ID, no IP address and no profile. One exception does not follow your choice: if you subscribe, RevenueCat sends your subscription events (start, renewal, cancellation) to PostHog under your user ID. We use all of this to improve the app. The legal basis is your consent; for the anonymous server events and the subscription events, it is our legitimate interest in understanding how the app and its subscriptions are used. **We are not anonymous, and we do not claim to be.** Your entries, recordings and photos are tied to your account so the app can show you your own ledger and calculate your own balance. “Anonymous” would mean nobody, including us, could connect this data back to you. That is not how Notal works, and this policy does not claim otherwise. * * * ## 4\. Who else sees your data, and why Amazon Web Services (AWS), Frankfurt, Germany (eu-central-1) Receives everything the app stores: your account, entries, settings, and your voice recordings and receipt photos as files. Why: to host the app and keep your data. OpenRouter Receives the text, voice recording or photo you enter, for that one request, and passes it to the model that reads it. Why: to route the request to the right model. DeepInfra (United States) Reads your typed notes, under the zero-retention and no-training rule in section 3. In our tests it also transcribes voice recordings; that is not covered by the rule. Why: to turn your note into an amount, category and type, and a recording into text. CoreWeave (United States) Reads your typed notes when DeepInfra cannot answer, under the zero-retention and no-training rule in section 3. Why: to turn your note into an amount, category and type when DeepInfra is unavailable. Google (Gemini models) Reads your receipt photos, and your typed notes when neither DeepInfra nor CoreWeave can answer, under the zero-retention and no-training rule in section 3. Why: to read the receipt and to keep the app working when another provider is unavailable. RevenueCat Receives your subscription status and purchase events from the store, and your email address once you sign in. Why: to keep your Premium status in sync across devices, and to find your subscription when you contact support. When you delete your account, the app asks RevenueCat to remove it. OneSignal Receives a device push token and the notification types you have opted into. Why: to deliver the reminders and summaries you have turned on. Sentry (EU region) Receives crash and error reports, as described in section 3. Why: to find and fix crashes. PostHog (EU region) Receives the usage events described in section 3, and the subscription events RevenueCat sends it. Why: to see how the app is used, so we can improve it. Apple and Google (sign-in and purchases) Receive whatever you share when you choose “Sign in with Apple” or “Continue with Google”, and your in-app purchase and subscription events. Why: to sign you in and to process your subscription payment. Several of these providers are based in the United States, so a request can leave the European Union. **We do not sell your data to anyone, for any reason.** **Exchange rates.** To convert an entry in another currency, our server gets that day’s rate from Frankfurter (api.frankfurter.dev), a public service for the European Central Bank’s reference rates. Only currency codes and a date are sent, never anything about you or your entries. **Gold and silver prices.** When an entry is gold or silver, the app can suggest its amount from that day’s price. Our server gets the price from fawazahmed0’s currency-api, served through cdn.jsdelivr.net, or from currency-api.pages.dev when that is unavailable. If neither has a price for an entry dated today, it asks gold-api.com (api.gold-api.com); that service has no Turkish lira price, so a lira amount is converted with Frankfurter’s US dollar rate. A request holds only a metal code, a currency code and a date, never anything you wrote or anything about you. * * * ## 5\. How long we keep your data - **Deleted entries** stay in a trash for **30 days**, after which they are permanently removed. Restoring an entry from the trash is a Premium feature. - **Reports of a misreading** (section 3) are kept until you delete your account, even if you delete the reported entry first. - **Delete your account** at any time, from inside the app (Settings → Account → Delete account). Deletion is immediate and cannot be undone. It permanently removes your account and sign-in, all your entries (including the ones in the trash), recurring templates, categories, tags, settings, notification history, registered devices, your reports of a misreading, and your voice recordings and receipt photos. The files are deleted right after; if that step is interrupted, a nightly clean-up finishes it. The app also asks RevenueCat to remove your email address, and your PostHog profile and its events are deleted. - **What we keep after you delete your account.** We keep purchase and subscription records: the store’s transaction IDs, the product, and the price, currency and country the store reported. We keep them for accounting, refunds and fraud prevention, and so that if you come back and restore your purchase, it can be moved to your new account. They are stored under your former internal account number, not your email address or name. We keep them for as long as the law requires. We also keep a count of the receipt photos we analysed, each as a timestamp only, with no photo, merchant or amount, for cost accounting. - **Sign in with Apple and Google.** When you delete your account, we ask Apple and Google to revoke the sign-in access you gave Notal, where we can. We cannot always. Google access can only be revoked within about an hour of your last Google sign-in; after that, you can remove Notal yourself in your Google Account settings. If this step fails, your account is still deleted. - **Deleting your account does not cancel your subscription.** If you subscribed through the App Store, cancel it in your Apple ID settings. The delete screen in the app says the same. - Apart from what is described above, we keep your account and entry data only for as long as your account is active, plus the 30-day trash window. * * * ## 6\. Your rights Wherever the GDPR or KVKK (Türkiye’s data protection law) applies to you, you have the right to: - **Access** the personal data we hold about you. - **Delete** your account and its data at any time. The in-app “Delete account” action does this yourself, immediately, with no need to contact us. The records described under “What we keep after you delete your account” in section 5 are the exception. - **Correct** it. Most of your data is something you wrote yourself and can edit directly in the app. - **Object to or restrict** certain processing, and **lodge a complaint** with your local data protection authority. To exercise any of these rights another way, or to ask us anything about this policy, write to [support@theworkers.co](mailto:support@theworkers.co). * * * ## 7\. Children Notal is not directed at children, and we do not knowingly collect data from anyone under 13, or under the higher minimum age the law sets where you live. If you believe a child has given us data, write to us and we will take care of it. * * * ## 8\. Changes to this policy We may update this policy as the app changes. We will note the date of the latest change at the top of this page, and material changes will be announced in the app. * * * ## 9\. Contact Questions about this policy or your data go to [support@theworkers.co](mailto:support@theworkers.co). See also our [Terms of Use](https://theworkers.co/notal/terms/) and [Support page](https://theworkers.co/notal/support/). * * * theworkers.co · Istanbul, Türkiye Email: support@theworkers.co Last updated: 20 October 2026