Privacy Policy

• Account information: name, email address, and password when you create an account
• Receipt images you upload or capture using the app
• Receipt data: store names, purchase dates, amounts, item descriptions, and tax information
• Business metadata: business purpose, project tags, and expense classifications you enter

• Device information (device type, operating system, app version)
• Usage data (features accessed, actions taken within the app)
• IP address and approximate location (country/region level only)

Qityol is built on a privacy-first architecture. The following sections describe the technical safeguards that protect your identity at every layer of our system.

2.1 Identity Masking — Your Email Is Never Stored in Readable Form

Qityol employs a zero-knowledge identity masking system. When you create an account, your real email address is immediately replaced with a randomly generated anonymous identifier in our user directory. This anonymous identifier has no connection to your real email and cannot be reversed.

This means our user directory never contains your real email address. Even Qityol team members with database access see only anonymous, meaningless identifiers — never personal emails.

2.2 Military-Grade Encryption

Your real email address is stored exclusively in a hardware-secured encrypted vault protected by AES-256-GCM encryption — the same standard trusted by banks, governments, and military organizations worldwide. Key safeguards include:

• Encrypted at rest: Your email is encrypted before it ever touches a disk.
• Hardware-managed keys: Encryption keys are maintained by dedicated security infrastructure and are never exposed to application code or personnel.
• Strictly limited access: Only automated, isolated service relays can request decryption, and only for specific, audited actions such as sending you a password reset. No human operator can manually decrypt your email.

2.3 Secure Mail Relay — Ephemeral Access Only

When Qityol needs to send you a service email (password reset, verification code, or account notification), our Mail Relay operates as follows:

• Request: The relay requests your email for the sole purpose of sending the message.
• Decrypt: Your real email is decrypted inside an isolated, automated process.
• Send: The email is dispatched via our mail provider.
• Discard: The decrypted email is immediately discarded from memory. It is never logged, cached, or written to any secondary storage.

Your real email exists in readable form only for the fraction of a second required to send the message.

2.4 Breach Protection — What an Attacker Would Find

In the unlikely event of a data breach, an attacker would find:

The result: A full data breach yields zero personally identifiable email addresses.

• Provide, operate, and improve the Service
• Process receipt images using on-device OCR and AI technology to extract tax and spending data
• Generate tax summaries, spending insights, and deductibility estimates
• Send you app notifications and alerts you have opted into
• Manage your account and subscription
• Respond to your customer support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

• AI Processing: Receipt text and images may be sent to a third-party AI provider for parsing and data extraction. This provider does not retain your data beyond the scope of each request.
• Cloud Storage & Database: Your account data and receipts are stored in a secure, hosted database with row-level security ensuring only you can access your data.
• Subscription Management: Subscription and purchase data is managed by a third-party billing provider. Payment processing is handled by the applicable platform store or payment processor.
• Social Sign-In: If you sign in using a third-party identity provider, your profile information from that provider is used solely to create and authenticate your account.

• With service providers who assist in operating the Service (listed in Section 4), under confidentiality obligations
• If required by law, court order, or governmental authority
• To protect the rights, property, or safety of Deducr, our users, or the public
• In connection with a merger, acquisition, or sale of assets, with advance notice to users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data via Settings → Delete Account
• Portability: Export your receipts as CSV or PDF from within the app
• Opt-out: Disable push notifications through your device settings