rezip (找數) is a local-first, account-less trip expense splitter. This policy describes exactly what data the app handles and what, if anything, leaves your device. It is written to be accurate to how the app actually works, not aspirational.

The short version

• No account. rezip has no sign-up, no login, no email, no password. You are not identified by any personal identifier we assign to a person.
• Local-first. Your trips, members, expenses, and receipt photos live in an on-device database (SQLite) and in your device's file storage. If you never turn on sync, nothing about your trips leaves your phone except when you scan a receipt (see "Receipt scanning" below).
• No ads network, no tracking, no analytics. rezip embeds no third-party advertising SDK, no analytics SDK, and no cross-app tracking. The "free tier" ad slot is a static in-app house promotion for rezip Pro; it does not call any ad network and collects nothing.

What we store, and where

On your device (always)

• Trips, members (display name + colour you type in), expenses, splits, currency rates, and settlement records — stored in a local SQLite database.
• Receipt photos you attach — stored as ordinary files on your device. The app keeps only a local file reference to each photo.
• App settings and a local counter of how many managed receipt scans you have used (for the free-tier trial limit).

None of this requires a network connection.

In the cloud (only if you turn on sync / share a trip)

rezip offers optional cloud sync so you can back up a trip and collaborate with other people on it. Sync is opt-in and is powered by Convex (our backend provider). When sync is on for a trip, the following is sent to and stored on Convex:

• Trip details (name, dates, currencies, exchange rates, luggage labels).
• Members' display names and colours as you entered them. These are labels you choose for participants; they may be real first names of your travel companions. They are not tied to any account.
• Expenses: amounts, currency, dates, store name, parsed line items, any receipt OCR text, and notes.
• Anonymous identifiers only: an app-generated random ID for each record (localId, a ULID) and an anonymous per-device ID (deviceId). These let devices reconcile edits. They are not linked to your name, email, phone number, or any account.
• A short share code derived from the trip ID, used so others can join a trip by link or QR.

Receipt photo files are not uploaded to Convex. Only a reference/URL to a photo travels with a synced expense; the image bytes stay on your device (and, for scanning, go only to the OCR service described next).

Receipt scanning (OCR)

When — and only when — you choose to scan a receipt, the app reads that one photo and sends the image to a receipt-reading (OCR) service to extract the store name and line items. Depending on configuration, the image is sent to:

• rezip's self-hosted OCR service (operated by us), and/or
• a language-model vision provider (currently Anthropic's Claude API) that the app reaches through our Convex backend, used as a fallback for the managed parsing feature.

In this last case the receipt image is processed by Anthropic as a sub-processor. We send only the receipt image and the currency; we do not send your name, email, or device identifiers with it. The provider returns structured text (store name + items), which is written back into your expense. We do not use receipt images to train models, and we do not sell them.

If no scanning service is available, the app falls back to manual entry and no image leaves your device.

Subscriptions (rezip Pro)

rezip Pro is a subscription (indicative HK$38/month or HK$258/year) sold through the Apple App Store and Google Play. Purchases are processed by Apple / Google and entitlements are managed via RevenueCat. RevenueCat receives an anonymous app-user identifier and the purchase receipt from the store in order to tell the app whether your subscription is active. It does not receive your trip data, receipt photos, name, or email from us. Payment details are handled entirely by Apple / Google and are never seen by rezip.

What we do NOT do

• We do not require or collect your name, email, phone number, or contacts.
• We do not use advertising identifiers (IDFA / Android Advertising ID).
• We do not embed analytics, crash-tracking, or advertising SDKs.
• We do not track you across apps or websites.
• We do not sell or rent any data.

Data retention & deletion

Your on-device data stays until you delete a trip or uninstall the app. For synced trips, the cloud copy persists so collaborators keep converging; you can request deletion of a synced trip's cloud data by emailing coffeebb71@gmail.com with the trip's share code. Uninstalling the app removes all local data, including receipt photos, from your device.

Children

rezip is not directed at children and does not knowingly collect data from children under 13.

Changes

We may update this policy; the "Last updated" date above reflects the latest version. Material changes will be noted in the app's release notes.

Contact

Questions or data requests: coffeebb71@gmail.com.