Privacy Policy

Amelia Financial (“Amelia”) is a receipt capture, review, and splitting app operated by Vice Robotics LLC (“Vice Robotics,” “we,” “us,” or “our”). This policy explains the information Amelia handles, why we handle it, when it is shared, and the choices available to you. It applies to the Amelia app for iPhone and iPad, this website, and related services. Receiving receipts from merchants (claim links, NFC and QR claims, the App Clip, and Square or Stripe merchant receipts) and loyalty are not yet available; the disclosures under Not yet available apply only if we enable them.

What stays on your device

Amelia works without an account. Receipts you scan, import, or type in, their photos and PDFs, splits, folders, your profile name, an optional phone number, the people you pick from your contacts, and your preferences are stored on your iPhone or iPad. Receipt photos and PDFs are read on your device using Apple’s on-device text recognition and, where available, Apple’s on-device language models; they are not sent to us or to an AI service to be read. Your phone number and the people you pick in onboarding stay on your device.

Receipt photos and documents are saved with iOS file protection, so they cannot be read until you first unlock the device after it restarts. Like other app data, information stored on your device is included in your iPhone or iPad backups according to your iOS backup settings. Camera access is used only when you choose to scan a receipt. Photo and document imports use Apple’s system pickers, so you select the specific item to provide.

Signing out ends your account session but does not by itself erase device-local receipts, attachments, splits, folders, or prepared exports. Deleting your account erases them from the device, and you can delete individual receipts at any time. Removing the app also removes its data from the device, subject to normal iOS backup behavior.

Information we handle on our servers

• Account information — when you sign in, WorkOS, our sign-in provider, handles your email address, your name, your password if you use one, and your Apple or Google sign-in. Passwords and one-time codes pass through our server to WorkOS over an encrypted connection and are not stored by Amelia. Our database keeps your WorkOS account identifier, a display name (first filled in from your name), and an optional @handle you choose. If you use friends or shared trips, it also keeps a keyed hash of your verified email address and a masked hint (such as “c•••@example.com”), so people who invite that address can find you; it does not keep the address itself.
• Cloud copy (optional, Pro or Max) — cloud copy is off until you turn it on; signing in alone does not upload your receipts. When it is on, the app uploads the receipt records on your device (such as merchant, date and time, line items, discounts, taxes, tips, totals, currency, and any payment type, card brand, or last four digits printed on the receipt) and each receipt’s attached image or PDF to your account.
• Splits — when you complete a split while signed in, the app sends the split and receipt identifiers, a checksum, and the number of people assigned, so we can apply your plan’s split allowance. This request does not include item names, amounts, or the people in the split. (If you turn on cloud copy, the receipt itself, including its line items, is uploaded as described above.)
• Friends and shared trips — if you add friends or share a folder as a trip, we store your display name and handle, the trip name, its members, expenses (descriptions, amounts, and who paid), balances, and settle-ups so every member sees the same trip. When you invite someone by email, we keep only a keyed hash of the address and a masked hint, not the address itself. Invite links stop working after 7 days. Records of friend invites you send, including the keyed hash, are kept until you delete your account; records of trip invites are kept until the trip is deleted.
• Settle-up links — a view-only settle-up link shows the trip name, each member’s handle or display name, and the amounts owed to anyone who has the link. It never shows email addresses, receipts, or line items. A link stops working after 30 days, and you can revoke it sooner from the trip. A record of each link (a hash of its token and the trip it belongs to) is kept until the trip is deleted.
• Subscriptions — when you subscribe to Amelia Pro or Max, the app sends Apple’s signed transaction to our server, which verifies it with Apple and keeps the plan, status, renewal and expiry dates, and Apple’s transaction identifiers. We keep a random account token that links your purchases to your account. Apple’s signed data is verified and then discarded, and Apple’s subscription notifications are kept for up to 60 days.
• Notifications — if you allow notifications while signed in, the app registers your device’s push token with our server so we can deliver notifications for your account. The token is encrypted before it is stored, alongside an installation identifier and the app version. Registrations that are not seen for 90 days are cleared. Recap reminders are scheduled on your device and do not involve our server.
• Technical and support information — our hosting provider, Cloudflare, logs each request to our server (including the URL, IP address, headers, and request metadata) and keeps those logs for up to 7 days. Our own server logs record events and error types and remove email addresses and tokens. When you contact support, we receive what you choose to send.

Information we do not collect

• No full payment credentials — Amelia does not receive or store your full card number, security code, bank-account credentials, or other credentials that can authorize a payment. A receipt can show limited tender information, such as payment type, card brand, and the last four digits, and that information is included in a cloud copy only if you turn cloud copy on.
• No analytics, advertising, or tracking — Amelia contains no third-party analytics, advertising, attribution, or crash-reporting software, and we do not track you across other apps or websites.
• No location, health, or browsing-history access. Amelia does not ask for access to your location, health data, or browsing history. A receipt you add can still show whatever is printed on it, such as a pharmacy purchase, and that is uploaded only if you turn on cloud copy. Amelia does not read your address book. When you pick people from your contacts, the app receives only the people you pick, and only the email address you choose to send an invite to leaves your device.

How we use your information

We use information to authenticate you; store, restore, and erase your cloud copy; apply your subscription and split allowance; operate friends, shared trips, and settle-up links that you start; deliver notifications you allow; secure and troubleshoot the service; respond to requests; enforce our terms; and comply with law. We do not sell your information or use it for advertising.

When information is disclosed

• Service providers — WorkOS provides sign-in; Cloudflare provides hosting, file storage for cloud copies, networking, request logs, and security; Neon provides our managed Postgres database; Apple provides the App Store, subscription verification, push notifications, and Sign in with Apple; and Google provides Sign in with Google. When a split is in a currency other than your default, the app asks Frankfurter (api.frankfurter.dev) for that day's approximate exchange rate; the request contains only the two currency codes, no receipt, amount, or account information, and like any web request it reaches Frankfurter from your device's network address. Each provider handles information under its own terms and privacy policy.
• Payment apps you choose — Amelia never moves money. If you choose to open Venmo, PayPal, or Cash App from a split, the app hands that app the amount and a short note, and that app’s terms and privacy policy apply.
• People you choose — a receipt, split, folder, export, trip, or settle-up link is disclosed to the people you share it with. Members of a shared trip see its name, members, expenses, balances, and settle-ups.
• Legal and business events — we may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, or transfer of assets subject to appropriate protections.

Your choices

• Export your receipts, splits, and groups from Account → Export my data, with or without signing in. The export is prepared on your device as a PDF or CSV report plus a JSON file of your data. To get a copy of information held on our servers, make a privacy request (below).
• Cloud copy — turn uploads off at any time, or choose Erase cloud copy to remove every receipt and document from our servers; the receipts on your device stay. If your Pro or Max plan ends, your cloud copy becomes read-only and is erased 30 days after your paid period ends. The receipts on your device are not affected.
• Notifications — turn notifications off in iOS Settings, and recap reminders off in Account.
• Delete your account from Account → Privacy & consent → Data controls & deletion after signing in again and confirming deletion. This deletes your Amelia account and your WorkOS sign-in account, revokes Apple sign-in where you used it, removes your cloud copy, subscription records, notification registrations, split records, friends, and the shared trips you own (including for their other members), and erases your receipts, splits, folders, and receipt documents from the device. Deletion starts right away. If the control is unavailable or deletion does not complete, email support with the subject “Privacy”; we handle it as a privacy request on the timeline below.
• What remains after deletion — to prevent misuse and keep the deletion record, we keep a keyed hash of your former account identifier, a record of the deletion steps for 30 days, hashed records of ended sign-in sessions, and revoked settle-up link records. Trips owned by other people keep the expenses and settle-ups you took part in, linked to an internal identifier instead of your account.
• Privacy rights — depending on where you live, you may request access, correction, deletion, or a portable copy; appeal certain request decisions; and opt out of any sale, targeted advertising, or profiling that produces legal or similarly significant effects. Amelia does not currently sell personal information, share it for cross-context behavioral advertising, or use it for such profiling.

To make a privacy request, email support@vicerobotics.com with the word “Privacy” in the subject. A person acknowledges your request within 2 business days (Monday to Friday, 9:00 to 17:00 U.S. Eastern Time, excluding U.S. federal holidays) and we complete it within 30 calendar days of receipt. If we need more time, we tell you why before day 30 and finish within 45 days of receipt. If you appeal a decision, we decide the appeal within 45 days. These time limits run from when we receive your request, including while we verify your identity or an authorized agent’s authority. We will not discriminate against you for exercising a privacy right.

Data retention

Information on your device stays until you delete it, delete your account, or remove the app, subject to normal iOS backup behavior. On our servers, we keep account, cloud copy, trip, and subscription information while your account is active and as needed to provide the features you choose, with the shorter periods described above: Cloudflare request logs up to 7 days, Apple subscription notifications 60 days, unused notification registrations 90 days, and cloud copies 30 days after a paid plan ends. Invite and settle-up links stop working after 7 and 30 days, but their records are kept as described above until your account or the trip is deleted. We retain limited security, support, transaction, and legal records for as long as reasonably necessary for fraud prevention, dispute resolution, accounting, or legal compliance, and then delete or de-identify them unless law requires longer retention.

Security

Every connection between the app and our servers, WorkOS, and other services uses HTTPS. Your sign-in session is kept in the iOS Keychain on this device only. Receipt documents on your device use iOS file protection. On our servers, push tokens are encrypted, invite and settle-up links are stored only as hashes, and invited email addresses are stored only as keyed hashes. Cloud copies are not end-to-end encrypted: they are stored with Neon and Cloudflare under those providers’ security controls, and Vice Robotics can access them only as needed to operate, secure, and support the service. Access is limited to what is needed to operate the service. No system is perfectly secure. Report a suspected vulnerability without including credentials, card data, or another person’s receipt at support@vicerobotics.com with the word “Security” in the subject. We acknowledge security reports within 2 business days, or by the next business day if a problem is being exploited or exposes user data, and give a first assessment within 5 business days.

Children

Amelia is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.

United States state disclosures

In the preceding 12 months, the categories described above may include identifiers; customer records; commercial information such as receipt, subscription, and purchase history; and internet or other electronic network activity. Sources include you, your device, Apple, and our identity and hosting providers. We use and disclose these categories for the business purposes described in this policy. We do not use or disclose sensitive personal information to infer characteristics about you.

Not yet available

The following features are not part of the current app. These disclosures apply only if we enable them.

• Merchant receipts and claim links — participating merchants or their service providers (such as Square and, when enabled, Stripe) could supply receipt and claim information: merchant, date and time, line items, discounts, taxes, tips, totals, currency, receipt status, limited tender information, an opaque signed claim token, and signed processor events. Claims would be opened through a claim link, QR code, NFC tap, or the Amelia App Clip. We would exchange only the information needed to validate, deliver, secure, or support the requested record, would not provide merchants your full card credentials, and would not merge processor identities across unrelated merchants. Claim tokens would expire or be removed after they are handled, and raw processor payloads would be deleted within 7 days.
• Loyalty and consent choices — merchant-specific loyalty identifiers, balances, or rewards, and your separate choices about receipt storage, loyalty enrollment, and marketing. Merchants control their loyalty programs; contact the merchant about its program.

Changes

We may update this policy as Amelia changes. We will post the revised policy with a new effective date and provide additional notice in the app or by email when required by law.

Contact

Questions or requests? Use Amelia Support or email support@vicerobotics.com. A person replies within 2 business days; Support lists the response time for each kind of request. Vice Robotics LLC is the service operator.