Privacy Notice

1. Who we are

Slip Tracker is an iPhone application that reads Thai payment slips you select and turns them into a private spending record kept on your own device.

The data controller responsible for the limited personal data described in this notice is La Win Ko, an individual developer trading as Slip Tracker, referred to in this notice as "we", "us", or "Slip Tracker". You can reach us by email at privacy@sliptracker.app.

The processing described in this notice is divided as follows.

• The application processes your slips and your records on your iPhone. Slip Tracker operates no server for that data.
• We generally cannot access those records. They are held in an encrypted database on your device, and the key is held in that device's Keychain.
• We receive information that you intentionally send to support.
• Apple processes App Store purchases, and optional iCloud backup, under Apple's own terms.
• Our hosting provider may process ordinary website logs.

2. How to contact us

For any question about this notice or about your personal data:

Privacy contact

privacy@sliptracker.app

General support

support@sliptracker.app

3. Scope of this notice

This notice applies to:

• the Slip Tracker application for iPhone,
• this website, including the Privacy Notice and Terms of Use pages, and
• support correspondence you send to us.

This notice does not apply to Apple's own processing. When you buy a subscription through the App Store, or when you enable iCloud backup, Apple processes that information as its own controller under Apple's terms and privacy policy. It also does not apply to any other service you choose to send an exported file to.

4. Words used in this notice

Personal data

Information about an identifiable living natural person, as defined in Section 6 of the Personal Data Protection Act B.E. 2562 (2019).

Data controller

The person who decides the purposes and means of processing personal data.

Data processor

A person who processes personal data on a controller's instructions.

PDPA

The Personal Data Protection Act B.E. 2562 (2019) of Thailand.

PDPC

The Personal Data Protection Committee of Thailand and its Office.

Slip

An image, usually a screenshot, of a bank transfer or payment confirmation from a Thai bank or payment application.

Record

A transaction saved inside the application, whether created from a slip or entered by hand.

Your device

The iPhone on which you installed the application.

5. Slips, and what is read from them

Slip images and selected-photo access

The application reads slip images from your photo library. There are two ways it can reach one, and both are started by you.

• You pick an image. The application opens the standard iOS Photos picker, and iOS gives it only the images you selected. This path works even if you have not granted photo-library access.
• You grant photo access so the application can suggest candidates. With permission, the application can list images from a bounded window: today and yesterday, or a date range you choose, and optionally screenshots only. Every such query is limited to a window you set. There is no request that reads your entire library, and no image is read without you asking for that list.

The application has no camera feature. It never opens the camera and never records audio, and the corresponding iOS permission strings are deliberately not declared.

Album names, when the application shows them, are read live from Photos and are never stored.

The slip image itself is never saved into the application. It is read, processed on your device, and released. Your original photo remains in your photo library, under your control, exactly as before.

Information read from a slip

Text recognition uses Apple Vision, which runs entirely on your iPhone. The recognized text is analysed on your device by software bundled inside the application. If the slip carries a Bank of Thailand style verification QR code, it is decoded on your device as well.

The raw recognized text is not stored. Once the fields have been extracted it is discarded. What the application keeps is a hash of the image and a hash of the recognized text, which are one-way values it uses to recognise a slip you have already imported so it is skipped instead of being duplicated.

No slip image, no recognized text, and no extracted field is transmitted to us or to any third party at this stage. This step works with no internet connection at all.

6. Information kept on your device

Transaction values, dates, recipients, banks, categories, and notes

A saved record can contain the following, all of it on your device:

• the amount and any fee, and the currency,
• the date and time printed on the slip,
• the sender's name and bank, and the receiver's name and bank,
• the masked account identity printed on the slip, meaning the partly hidden account number, its last four digits, and a bank code,
• the transaction reference,
• which application the slip came from,
• the direction, meaning money out, money in, or a transfer,
• the category and merchant the application matched or you chose,
• any note you add yourself,
• the accounts you tell the application are your own, so it can tell spending from money received,
• a confidence value per field and a review flag, so uncertain values wait for you rather than being saved silently.

Some of this is personal data about other people, for example the name of someone you sent money to. You decide which slips to import, and that information stays on your device under your control.

Other information stored only on the device

Everything in the Transaction values, dates, recipients, banks, categories, and notes section is stored in a local database on your iPhone, encrypted with SQLCipher. The encryption key is generated on your device at first launch from the operating system's secure random source and is stored in the iOS Keychain with the device-only accessibility class, which means it is never included in an iCloud Keychain sync.

Also stored only on your device:

• your settings and display preferences,
• your merchant and category rules,
• the count of slips read in the current quota period,
• image and text hashes used to avoid duplicates,
• if you enable app lock, a salted hash of your passcode, held in the iOS Keychain as described in the App lock and biometric behaviour section.

We have no access to any of it.

App lock and biometric behaviour

App lock is optional and off by default. If you turn it on, you set a passcode. We never store the passcode itself. The application stores only a random salt and a hash derived from your passcode and that salt, in the iOS Keychain with the device-only accessibility class.

Unlocking with Face ID or Touch ID is a further option, also off by default, and the passcode always remains available as a fallback. Biometric matching is performed entirely by iOS. The application receives only a success or failure result. It never sees, receives, or stores your face or fingerprint data, and neither do we.

App lock is a screen-access control. It is separate from the database encryption described in the Other information stored only on the device section, which is always on.

7. On-device summaries

The application offers an optional feature that looks for patterns in records you have already reviewed. On an iPhone that supports Apple Intelligence, and where you have enabled it, this uses Apple's on-device Foundation Models framework. Availability depends on the device, the operating system version, and your Apple Intelligence settings.

The feature is off by default and stays off until you turn it on in the application's settings.

The model runs on your iPhone. Its input and its output do not leave the device. The design is also deliberately narrow: the model returns only a query specification, meaning a subject reference, a metric, a comparison, and a direction. It returns no amounts, no names, no dates, and no record identifiers. The application then recomputes the result from your own records and rejects anything it cannot verify, and the sentence you read is written into the application in your language.

On an iPhone that does not support the feature, the same patterns are calculated on your device with no model involved, and the application tells you which of the two you are looking at.

A separate optional feature can suggest a category for an unrecognized merchant name using the same on-device framework. It is also off by default.

8. Information we receive

What reaches the developer at all

This is the shortest section in this notice, and deliberately so.

During normal use, we do not receive or store your slip images or spending records on servers operated by Slip Tracker. There are no such servers. The application contains no usage-analytics software, no crash-reporting software, no advertising software, and no tracking technology of any kind. It contacts one outside service, RevenueCat, and only about purchases. See App Store purchases below.

We receive personal data only when:

• you contact support, in which case we receive what you chose to send (the Support communications and attachments section),
• you visit this website, in which case our hosting provider records standard access and security logs (the Website access and security logs section),
• you buy a subscription, in which case Apple provides us with the sales and subscription reporting described in the App Store purchases section, and RevenueCat checks the purchase for us.

App Store purchases

Premium is sold as an auto-renewable subscription through Apple's App Store. Apple, not us, processes the payment and holds your payment details. We never see your payment method, card number, or Apple Account credentials.

We use RevenueCat to check that a Premium purchase is real and to give it back to you when you reinstall the app or move to a new iPhone. When the app starts, when you return to it, and when you buy or restore Premium, it asks RevenueCat whether Premium is active. Your App Store purchase details are what RevenueCat checks with Apple to answer.

RevenueCat knows your app as a random id it makes up itself. That id is not your name, your email address, or your Apple Account, and we cannot turn it back into you. We have switched off the advertising and device identifiers RevenueCat is otherwise able to collect.

Your slips and your spending records are never sent to RevenueCat. Purchase information is the only thing that goes there.

Apple provides developers with sales, subscription, and payout reporting. That reporting is what we receive about purchases. We do not receive your name, your email address, or your payment details from Apple through it.

Website access and security logs

This website is static. It sets no cookies, contains no analytics, no tag manager, no advertising pixel, and no social or video embed. Its fonts are served from this same website rather than from a font network, so visiting a page here does not disclose your IP address to a third-party font host.

Like any website, it is served by a hosting provider, Vercel, which records standard server logs for delivery, security, and abuse prevention. Those logs typically include your IP address, the date and time of the request, the page requested, the referring page, and your browser's user-agent string. We use them only to keep the site available and secure, and we do not use them to build a profile of you.

Log retention is 1 hour.

Saved website language preference

If you use the language control on this website, your browser stores one short value in local storage under the key sliptracker.lang, recording whether you chose English or Thai.

This value stays in your own browser. It is never transmitted to us, it is not a cookie, and it is not used to identify or track you. It is stored only after you actively choose a language, and you can remove it at any time by clearing site data in your browser.

Support communications and attachments

If you contact support, we receive the information and attachments you choose to send. That normally includes your email address, the content of your message, and whatever you attach, which may include screenshots.

Please do not send us a slip image, an unredacted screenshot of your records, or a backup file unless we specifically ask for one and you have removed what you do not want us to see. We do not need your financial data to help you, and we would rather not hold it.

Support correspondence is handled through Google Workspace and retained for 12 months, after which we delete it.

9. Optional iCloud backup

iCloud backup is an optional feature, available with Premium, and it is off until you turn it on.

When it is on, the application writes a backup file containing your records into your own iCloud account, in the application's iCloud Drive container. It attempts this at most once every twenty-four hours, when you open the application or when it leaves the foreground, and you can also trigger a backup yourself at any time.

If you enable iCloud backup, Apple processes that backup in your iCloud account under Apple's applicable terms and privacy practices. The file goes to your iCloud, not to us. We have no access to your iCloud account and cannot read, restore, or delete that file.

A manual backup that you export and store yourself is always free and produces the same complete file.

10. Purposes of processing

We process the limited personal data we actually receive in order to:

• answer your support request and resolve a problem you report,
• deliver this website and keep it available, secure, and free from abuse,
• remember, in your own browser only, which language you chose to read this site in,
• understand aggregate sales and subscription performance from Apple's reporting, and meet our tax and accounting obligations,
• comply with a legal obligation, and establish, exercise, or defend a legal claim.

The processing that happens inside the application, on your device, serves the purpose you installed it for: reading the slips you choose, keeping the records you create, and showing you your own month.

11. Applicable legal bases under the PDPA

Where we rely on legitimate interest, we have considered whether that interest is overridden by your fundamental rights, and we have kept the processing to the minimum that achieves the purpose.

12. Required and optional information

What is required and what is optional

Nothing is required in order to use the application. You do not create an account, you do not give us your name or email address, and you do not connect a bank.

Optional, and entirely your choice:

• granting photo-library access, so the application can suggest candidates,
• enabling the on-device summary features,
• enabling app lock and biometric unlock,
• enabling daily reminders,
• enabling iCloud backup,
• buying a subscription,
• contacting support.

Required only for the thing it enables:

• to buy a subscription, Apple requires an Apple Account and a payment method, which you provide to Apple and not to us,
• to receive an answer from support, an email address or another way to reply.

Consequences of not providing information

If you do not grant photo-library access, the application still works. You pick slips yourself through the iOS Photos picker, and the application cannot offer you a suggested list.

If you do not enable iCloud backup, your records are not backed up automatically. You can still export a complete backup yourself at any time, free of charge.

If you do not buy a subscription, the free tier remains fully usable, including every record you have created and the complete data export.

If you do not give us a way to reply to a support message, we cannot answer it.

There is no consequence that makes the application unusable.

13. Recipients, processors, and international transfers

Recipients and processors

We do not sell personal data, and we do not share it for advertising or marketing.

Anywhere you export a file yourself, through the iOS share sheet, is your own choice and outside our knowledge and control.

International transfers

Your records do not leave your device because of anything we do, so there is no international transfer of them by us.

The limited personal data we do receive may be processed outside Thailand, because our hosting and support providers may operate servers in other countries, and because Apple operates globally. Where Sections 28 and 29 of the PDPA apply, we rely on one or more of the following: the destination country having adequate protection as determined by the PDPC, appropriate safeguards agreed with the recipient, necessity for the performance of a contract with you, or your explicit consent after being informed of any inadequate standard.

We do not currently claim compliance with the data protection law of any country other than Thailand. Thailand is our legal baseline. Other markets, including other ASEAN countries, would require their own country-specific review before any equivalent claim is made.

14. Retention periods

15. Security measures and breach handling

Security measures

Inside the application:

• the local database is encrypted with SQLCipher,
• the encryption key is generated on your device and stored in the iOS Keychain with a device-only accessibility class, so it is not synced to iCloud,
• your passcode is stored only as a salted hash, never in readable form,
• the application makes no network request to any server we operate, which removes an entire class of exposure,
• raw recognized text, full transaction payloads, passcodes, and backup contents are never written to logs,
• reminder notifications never contain an amount, a merchant, a category, or a total, so nothing financial appears on your lock screen.

For the limited data we receive, we use reputable providers, restrict access to those who need it, and use the security controls those providers offer.

No security measure is perfect, and no application or website can be guaranteed secure. What we can say is that the application is designed so that there is very little for anyone to take from us, because we hold very little.

Personal-data breach handling

If a personal data breach occurs in a system we control, we will assess the risk and, where the breach is likely to result in a risk to the rights and freedoms of individuals, notify the Office of the PDPC without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with Section 37(4) of the PDPA.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without delay, together with the remedial measures taken.

A breach of your device, your iCloud account, or your Apple Account is outside our systems and outside our knowledge. Section 8 explains how the data on your device is protected, and Apple's own notice covers your iCloud and Apple Account.

16. Your rights, and how to complain

Your rights under the PDPA

Under the PDPA you have the rights below. Because we hold almost no personal data about you, most of them are exercised most directly inside the application itself, where you already have complete control.

Right of access and to obtain a copy, Section 30

Everything the application holds is on your device and visible to you. You can also export a complete copy at any time from the application's settings, free of charge. For anything we hold, such as support correspondence, contact us.

Right to data portability, Section 31

The free JSON export is a complete, machine-readable copy of every field the application holds.

Right to object, Section 32

You may object to processing based on legitimate interest. In practice this applies to our website logs and to support correspondence.

Right to erasure or de-identification, Section 33

Delete a record, delete everything, or delete the application. See the How local records are deleted section. For anything we hold, contact us.

Right to restrict processing, Section 34

You may ask us to restrict our use of data we hold about you.

Right to rectification, Sections 35 and 36

Every field of every record is editable inside the application, before and after saving. For anything we hold, ask us to correct it.

Right to withdraw consent, Section 19

Where we rely on your consent, you may withdraw it at any time. Withdrawing does not affect the lawfulness of processing before the withdrawal. In the application, every optional feature can be turned off in settings, and photo access can be changed or removed in iOS Settings at any time.

To exercise a right, contact us at privacy@sliptracker.app. We will respond within 30 days. There is no charge for a reasonable request. We may need to ask for information to confirm your identity, and if we cannot identify any data we hold about you we will tell you that plainly.

Complaints

Please contact us first at privacy@sliptracker.app. We would prefer to fix a problem directly.

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee of Thailand, which under Section 73 of the PDPA is submitted for consideration by the Expert Committee. Contact details and the complaint procedure are published by the Office of the PDPC at www.pdpc.or.th.

17. Deleting your data

How local records are deleted

• One record. Open it and delete it from its detail screen.
• Everything. Settings, then Delete all data. This erases every transaction, merchant rule, category, setting, backup status entry, scan usage count, account, and saved scan marker from the encrypted database, and clears the application's preference store. The application returns to a first-launch state.
• The whole application. Deleting Slip Tracker from your iPhone removes its container and everything it stored on the device.

For completeness: Delete all data empties the database but does not itself remove the database file or its Keychain key, which are removed when you delete the application. Deleting all data also does not affect your original photos, which were never taken by the application in the first place, or any file you exported earlier.

How iCloud backups are deleted

Deleting data inside the application does not delete an iCloud backup. The backup file lives in your own iCloud account and we have no access to it, so you delete it yourself.

1. Open the Files application on your iPhone, or iCloud Drive on a Mac.
2. Go to iCloud Drive, then the Slip Tracker folder, then Backups.
3. Delete the backup file.
4. Empty Recently Deleted, so the file is not retained for a further 30 days.

You can also turn iCloud backup off in the application's settings, which stops any further backup from being written but does not remove files already there.

Files you exported through the share sheet went wherever you sent them, and you delete those in the same way you would delete any other file.

18. Children and legal capacity

Slip Tracker is a personal finance tool intended for adults. It is not directed at children and we do not knowingly collect personal data from a child.

Under Section 20 of the PDPA, where consent is required from a minor: if the minor is under ten years old, consent must be given by the person holding parental power; for a minor aged ten or above but not yet of legal age, consent is given by the minor for acts the minor may lawfully perform alone under the Civil and Commercial Code, and otherwise by the minor together with the person holding parental power.

A purchase requires an Apple Account, and Apple applies its own age requirements and Family Sharing controls, including Ask to Buy.

If you believe a child has provided us with personal data, please contact us and we will delete it.

19. Changes, effective date, and language

Changes to this notice

We may update this notice when the application changes or when the law changes. When we do, we will change the "Last updated" date at the top of this page.

If a change materially reduces your privacy protection or materially expands what we collect, we will give notice before the change takes effect, in the application or on this page, and where the law requires consent we will ask for it. Changes apply going forward and are never applied retroactively.

Previous versions are available on request.

Effective date

This notice takes effect on 31 August 2026 and was last updated on 31 August 2026.

Language and interpretation

This notice is published in English and in Thai. The two versions are intended to have the same meaning.

In the event of a conflict between them, the Thai version prevails for users resident in Thailand and for any matter governed by Thai law. Elsewhere the English version prevails.

Section headings are for convenience only and do not affect interpretation. If any part of this notice is found to be invalid or unenforceable, the rest continues to apply.