Legal
Privacy Policy
Your receipts, the amounts on them and the photos themselves never reach us. This page says exactly what does.
Version 1.0. Effective 25 August 2026. Last updated 25 August 2026.
The short version. Your receipts, the amounts on them, the merchant names and the photos themselves never reach us. They live on your iPhone and in your own private iCloud, under your Apple Account. We have no server that stores them, no login that could reach them and no way to read them.
What does leave the phone is a small stream of usage and marketing events that carry no financial data at all. This page explains exactly what those are, who receives them, and how to turn the tracking part off.
1. Who this policy is from
DeductHound is an iPhone app published by Digital Nafta. This policy covers the app and this website at digitalnafta.com/deducthound. Write to support@digitalnafta.com about anything on this page and a person will answer.
2. What stays on your device, which is nearly everything
The whole point of the app is that the sensitive part never travels. The following is created, stored and processed only on your iPhone, inside the app's own storage, and synced only to the private iCloud database tied to your own Apple Account:
- Photographs of receipts and the thumbnails generated from them.
- The extracted total, date, merchant, sales tax and any field you correct by hand.
- The category you assign, aligned with the expense lines of IRS Schedule C.
- Notes, search history inside the app, filters and report periods.
- The CSV and PDF exports you generate, until you share them yourself.
Text recognition runs on the device using Apple's Vision framework. No receipt image, and no text read from one, is ever uploaded to us or to any optical character recognition service. The app works with the phone in airplane mode.
iCloud sync uses CloudKit private database, which means Apple stores the encrypted data under your account, not under ours. We cannot list it, read it or restore it for you. If you sign out of iCloud or turn sync off, the data stays on the device only.
3. There is no account, so there is nothing to log in to
DeductHound has no sign-up, no password and no user profile. We never ask for your name, your address, your Social Security number, your Employer Identification Number or your bank. There is no bank connection in the app, by design.
For subscription bookkeeping the app generates a random identifier (a UUID) the first time it runs, stores it on the device and sends it to Apple with the purchase. It is not derived from anything about you and it cannot be reversed into an identity.
4. What does leave the device
Two kinds of data leave the phone: crash reports and product or marketing events. Neither carries a single dollar figure, merchant name or image.
Product and marketing events
These record that something happened, never what it was worth. For example, the app records that a receipt was scanned, and whether it came from the camera, a batch import or a widget. It does not record the amount, the merchant, the category total or anything from the photo.
| Event | What it carries | What it never carries |
|---|---|---|
| Onboarding and quiz steps | Step index, step identifier, which branch you picked | Any answer that identifies you |
| receipt_scanned | Capture method (camera, batch import, widget) | Amount, merchant, date, tax, image |
| receipt_saved | Category identifier, how many fields you corrected | Amount, merchant, image |
| batch_import_completed | How many items were processed | Any content of those items |
| export_generated | Format (CSV or PDF) and period type | The file, the totals, the receipts in it |
| Paywall and purchase events | Product identifier, price, currency, result | Payment details, card, Apple Account email |
Crash reports
If the app crashes, a report goes to Firebase Crashlytics with the device model, the iOS version, the app version and the technical stack of the crash. Crash reports are not linked to your receipts.
5. The companies that receive those events
We use standard mobile measurement and advertising kits. Each one is listed here with what it does and where its own policy lives. All of them receive events, not financial content.
| Provider | What it is used for | Their privacy policy |
|---|---|---|
| Google Firebase (Analytics and Crashlytics) | Counting funnel steps and receiving crash reports | policies.google.com/privacy |
| AppsFlyer | Mobile measurement partner: tells us which advertisement an install came from | appsflyer.com/legal/privacy-policy |
| Meta (Facebook) SDK | Attribution and measurement of Meta advertising | facebook.com/privacy/policy |
| Google Ads SDK | Attribution and measurement of Google advertising | policies.google.com/technologies/ads |
| TikTok SDK | Attribution and measurement of TikTok advertising | tiktok.com/legal/privacy-policy |
| Apple AdServices and SKAdNetwork | Apple's own privacy-preserving attribution for Apple Search Ads | apple.com/legal/privacy |
| Apple StoreKit and App Store | Taking the payment and validating the subscription | apple.com/legal/privacy |
6. Tracking, the App Tracking Transparency prompt, and how to say no
Some of the kits above are advertising kits. Under Apple's rules, using the device advertising identifier (the IDFA) to measure advertising across apps and websites owned by other companies counts as tracking, and we declare it as such on the App Store listing.
The app asks for tracking permission with Apple's standard prompt, and it asks after the paywall, never during onboarding and never before you know the price. Nothing about the app changes if you say no.
If you decline, no advertising identifier is shared, the advertising kits run in their limited mode and attribution falls back to Apple's aggregated SKAdNetwork signal, which does not identify you. You can change your mind at any time in Settings, Privacy and Security, Tracking.
Apple's App Store listing for the app declares three label groups: data used to track you, data linked to you and data not linked to you. None of the categories we declare include your receipts, your amounts or your images, because those never leave the device.
7. Notifications
Reminders are scheduled and fired locally by your iPhone. There is no push server, so there is no notification token sent anywhere and no message about you sitting on somebody else's machine. The quarterly deadline reminders are computed on the device from the published IRS dates.
8. Payments
The subscription is sold through the App Store. Apple takes the payment and tells the app whether an entitlement is active. We never see your card, your billing address or your Apple Account email. Refunds are handled by Apple at reportaproblem.apple.com.
9. This website
This site is deliberately plain. It sets no cookies, loads no third-party scripts, embeds no fonts from anyone else's server, has no advertising pixel and no analytics tag. You can verify all of that in the network tab of your browser, which is the only proof worth anything.
- The tax calculator runs entirely in your browser. The numbers you type are never sent anywhere, not to us and not to a third party. Close the tab and they are gone.
- If you choose to enter your email address in one of the forms, that address is sent to our own server on this domain and written to a file that sits outside the public web directory.
- We store the address, the page it came from, the moment it arrived, your browser's user agent string, and a truncated one-way hash of your IP address used only to rate-limit abuse. The IP address itself is never stored.
- We use the address to send you the launch email and, if you asked for one, the breakdown of your calculation. It is not sold, rented or shared. Every message carries an unsubscribe instruction, and asking us at support@digitalnafta.com deletes the record.
10. Children
The app is rated 4+ because it contains nothing objectionable, not because it is meant for children. It is a bookkeeping tool for working adults, it is not directed to children under 13, and we do not knowingly collect anything from them. If you believe a child has sent us an email address, write to us and we will delete it.
11. Your rights over the little we hold
Because your financial data never reaches us, most access and deletion requests have a short answer: we do not have it, and you can delete it yourself by deleting the app and removing its iCloud data in Settings, your name, iCloud, Manage Account Storage.
For the email address you may have given us on this site, and for the analytics events tied to your device identifier, you can ask us to confirm what we hold, correct it or delete it. Write to support@digitalnafta.com and say which address or which device. We answer within thirty days.
If you are in California, the same request covers the rights the California Consumer Privacy Act gives you, including the right not to be discriminated against for making one. We do not sell personal information for money. Sharing an advertising identifier with the advertising kits above for cross-context behavioral advertising can be treated as a sale or share under that law, and declining the tracking prompt is the opt out.
If you are in the European Economic Area or the United Kingdom, our basis for the marketing email is your consent, given by ticking the box, and you can withdraw it at any time.
12. Security
On the device, the data sits in the app's sandbox protected by iOS file protection, which means it is encrypted while the phone is locked. In iCloud it is protected by Apple's encryption under your account. The subscriber file on this website is stored outside the public web directory with owner-only permissions, so no web request can reach it.
No system is perfect. If something goes wrong that affects you, we will say so on this page and by email to anyone whose address we hold.
13. Changes to this policy
The date at the top of this page is the version that applies. If a change is material we publish it here before it takes effect and, where we hold an address, we send it.
14. Contact
support@digitalnafta.com. A person reads it and answers within two business days. Never send us receipts, statements, tax returns or account numbers. We cannot see them, we do not want them, and we will never ask.