Skip to main content
RyochoRyocho

Privacy Policy

Last updated: 2026-10-01

Ryocho (the “Service”) is an app that helps users track expenses, split bills, and monitor credit card rewards while traveling abroad. We value the protection of your personal information. This policy explains how we collect, use, and retain your data.

1. Data we collect

When you use the Service, we may collect the following data:

  • Account data: email address, display name, and profile picture (an emoji or an uploaded photo).
  • Third-party sign-in information: if you sign in through Google or Apple, we receive the email and profile information returned by the OAuth provider, including your Google profile picture.
  • Expense records: amounts, currencies, categories, dates, payers, split modes, linked credit card information, and similar details.
  • Expense photos and receipt images: when you choose to attach a photo to an expense or use AI OCR to recognize a receipt, images are saved on your device or in storage. Ordinary expense photos are not sent to the AI recognition service.
  • Feedback: feedback you choose to submit, your contact email, and screenshots you choose to attach.
  • Credit card settings: card names, reward schemes, and spending caps (excluding card numbers, CVCs, expiry dates, or any sensitive financial information).
  • Device and usage statistics: sign-in counts, OCR usage counts (10 free credits each month for every member, plus 50 credits each month for monthly Pro members or 750 credits each year for annual Pro members), and push tokens if you enable notifications.

2. How we use data

  • To provide account registration, sign-in, and identity verification.
  • To track travel expenses, settle shared expenses, and calculate credit card rewards.
  • To recognize receipt contents with AI models and automatically fill in expense items.
  • To send reminder notifications you choose to subscribe to, such as expense and budget reminders.
  • To receive, respond to, and troubleshoot feedback you choose to submit.
  • To maintain service quality and investigate problems.

We do not use your personal data for advertising and do not sell your expense records to third parties.

3. Third-party services

The Service uses the following third-party services to operate. Each provider has its own privacy policy:

  • Supabase (database, authentication, and storage): all structured data, such as expenses and trips, and feedback attachments are stored in Supabase cloud storage. Storage for ordinary expense photos depends on membership: for non-Pro members, original image files are stored only on your device, while the cloud stores only necessary metadata. Only photos that Pro members choose to back up have their original files uploaded to separate private cloud storage, separate from receipt image storage. Receipt images are uploaded to Supabase storage when you use OCR, for recognition and later viewing.
  • Google Gemini API (AI receipt recognition): receipt images are sent to Google only when you use OCR. Ordinary expense photos are not sent. After recognition results are returned, Google does not use the images to train its models.
  • Vercel (website hosting): hosts the Service’s website and APIs.
  • Resend (service emails): helps send feedback notifications and other service emails. Feedback notifications may include the feedback, contact information, and links to attachments that expire after a limited time.
  • Google OAuth and Sign in with Apple: third-party sign-in providers.

4. Data retention and deletion

  • Expense records, trips, and credit card settings: retained until you delete them or delete your account.
  • Expense photos and receipt images: images on the free plan may be stored on your device. Images uploaded during a paid membership are retained with their corresponding expense records and for another 60 days after paid benefits end. After the last expense referencing a photo is deleted, the image is automatically cleaned up within 90 days.
  • Feedback and attachments: retained for the time needed to process, respond to, and follow up on the issue. You may request deletion through the email address listed on this page.
  • Account deletion: in the app, go to “Settings → Account management → Delete my account.” Your account data, including trips, expense records, credit card settings, and profile picture, is removed immediately and irreversibly. Original expense photo and receipt image files stored in the cloud enter a cleanup process and are automatically removed within a period of time.

5. Your rights

Under applicable rules such as the GDPR and Taiwan’s Personal Data Protection Act, you have the following rights:

  • Access: export a trip’s expense records through “Stats → View trip summary → Export CSV.”
  • Rectification: edit your profile and expense records directly in the app.
  • Erasure: permanently delete your account and all data through Settings → Account management.
  • Data portability: take your expense records with you by exporting CSV files.

6. Children’s privacy

The Service does not actively collect personal data from children under 13. If you discover that a user under 13 has registered an account, please contact us so we can help remove it.

7. Data security

  • All data is transmitted using HTTPS encryption.
  • Passwords are stored as bcrypt hashes and cannot be decrypted by engineers.
  • The database uses Row Level Security (RLS), so each user can access only their own data.

8. Policy changes

If we make significant changes to this policy, we will announce them in the app or on the sign-in page and update the “Last updated” date on this page. We recommend checking this page regularly.

9. Contact us

If you have questions about this policy or your personal data, please email us:
support@ryocho.app