BillNudge is built so that your bills stay on your phone. This policy explains, in plain English, what the BillNudge app for Android and iOS does with your information. BillNudge is published by C2S Cosmos Pty Ltd ("we", "us", "our").
1. The short version
- BillNudge has no servers. We don't run any backend, database or cloud service for the app. We never receive your bills, emails, documents, addresses, amounts or account details.
- Your data is encrypted on your phone. Everything BillNudge saves is kept in an AES-256 encrypted database (SQLCipher) on your device. The encryption key is protected by your phone's secure hardware (Android Keystore / iOS Keychain) and never leaves the device.
- The AI runs on your phone. Bill reading, categorisation and "hard invoice" reading all run on the device. No bill, email or document is sent to any external AI service.
- Read-only email access. Gmail and Outlook are connected with read-only permissions. BillNudge can't send, delete, move or change your email.
- Backups are encrypted before they leave your phone. Optional Google Drive backups are locked with your own backup password on the phone, then stored in a hidden BillNudge-only folder in your own Drive. BillNudge can't see any of your other Drive files.
- No ads, no analytics, no tracking, no crash reporting. BillNudge contains no advertising, analytics, attribution or telemetry SDKs, and never sells or shares your data.
- You're in control. You can disconnect any account, delete your data, or delete the app at any time. Deleting the app deletes your data.
2. Information kept on your phone
To do its job, BillNudge stores the following only in the encrypted database on your phone:
- Bill details: provider, amount, due date, status, category and notes.
- Properties, vehicles and people you add to organise bills, including addresses you enter.
- If you choose to keep them, encrypted copies of bill PDFs and photos.
- The email address and display name of mail and Drive accounts you connect, so you can see which account is which.
- Your settings and the corrections you make, so the built-in classifier can learn your preferences on the device.
None of this is sent to us. We have no way to access it.
3. Connections BillNudge can make, and why
BillNudge works fully offline for camera, photo, PDF and manual bills. It only goes online in the cases below, and in each case your phone talks directly to that service. Nothing passes through a BillNudge server, because there isn't one.
| When | Service | What's sent or received | Optional? |
|---|---|---|---|
| You type in the "Search for the address" box when adding a property | LocationIQ (api.locationiq.com), an OpenStreetMap-based address lookup |
Only the text you type into that box, so it can suggest matching addresses. Nothing else about you or your bills. | Yes. Skip it and type the address yourself. Suburb and postcode lists are built into the app. |
| You choose to connect Gmail | Google (Google sign-in and the Gmail API) | Your sign-in, then read-only requests that bring your emails to your phone, where they're checked for bills. See section 4. | Yes |
| You choose to connect Outlook / Hotmail / Live / Microsoft 365 | Microsoft (Microsoft identity platform and Microsoft Graph) | Your sign-in, then read-only requests that bring your mail to your phone. See section 5. | Yes |
| You turn on Google Drive backup, or restore a backup | Google Drive (a hidden app-only folder in your own Drive) | Uploading, listing, downloading and deleting BillNudge's own backup files, which are already encrypted on your phone. See section 6. | Yes |
The address lookup is the only third-party service BillNudge uses for app features. Gmail, Outlook and Drive are your own accounts, which you connect yourself and can disconnect at any time.
4. Gmail: permissions and use
When you connect Gmail, Google shows you a consent screen listing exactly what BillNudge is asking for:
| Permission (scope) | What it allows | Why BillNudge needs it |
|---|---|---|
https://www.googleapis.com/auth/gmail.readonly | Read your email messages and settings. Read-only. | To find bills and invoices in your inbox, on your phone. |
openid | Sign you in with Google. | To confirm which Google account you connected. |
email | See your primary Google account email address. | To label the connected mailbox in the app. |
profile | See your basic profile (name and picture). | To show which account is connected. |
- BillNudge cannot send, delete, move, label, archive or change your email, and never does.
- Emails are read on your phone to find bills. Message bodies are processed in memory and not saved. Only the bill details found (for example provider, amount and due date) and, if you choose, an encrypted copy of the bill PDF are saved in the encrypted database on your phone.
- Google user data is never transferred to us or to any third party, never used for advertising, never sold, never used to determine credit-worthiness, and never used to train AI models.
- You can disconnect Gmail at any time in Settings › Mailboxes, which also revokes BillNudge's access at Google. You can also remove access at myaccount.google.com/permissions.
5. Outlook / Microsoft: permissions and use
When you connect an Outlook, Hotmail, Live or Microsoft 365 mailbox, Microsoft shows you a consent screen for these delegated permissions:
| Permission | What it allows | Why BillNudge needs it |
|---|---|---|
Mail.Read | Read your mail. Read-only. | To find bills and invoices, on your phone. |
User.Read | Sign you in and read your basic profile. | To read your account ID, email address and display name, so the mailbox can be labelled. |
offline_access | Keep access to data you've given it access to. | So BillNudge can check for new bills without asking you to sign in every time. |
openid, profile, email | Standard sign-in. | To confirm which Microsoft account you connected. |
- BillNudge only makes read (GET) requests to Microsoft Graph. It can't send, delete, move or change your mail.
- The same rules as Gmail apply: processing happens on your phone only, and nothing is transferred to us or any third party.
- Remove the mailbox in Settings › Mailboxes, and revoke consent at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
6. Google Drive backup and restore
Google Drive backup is off by default. If you turn it on, BillNudge asks Google for these permissions:
| Permission (scope) | What it allows | Why BillNudge needs it |
|---|---|---|
https://www.googleapis.com/auth/drive.appdata | See, create, update and delete only BillNudge's own files in a hidden app-data folder in your Google Drive. | To write encrypted backups, list them, read one back when you restore, and delete old ones. |
email | See your Google account email address. | To show which Drive account your backups go to. |
What BillNudge does with Drive:
- Write (backup): BillNudge makes an encrypted copy of your database on your phone, then uploads it to the hidden app-data folder. Backups can run when you tap "Back up now" or automatically on the schedule you choose. Automatic backups use Wi-Fi only, unless you allow mobile data.
- Read (restore): when you restore, BillNudge lists the backups in that folder, downloads the one you pick to your phone, and decrypts it there with your backup password.
- Delete (tidy up): BillNudge keeps the newest 3 backups for each profile and deletes older BillNudge backups. It can delete backups you choose in the app.
- Nothing else: the
drive.appdatapermission can't see, open or change any of your other Drive files, folders, Docs or photos, and BillNudge never asks for broader Drive access.
How backups are protected:
- Each backup is encrypted on your phone, before upload, with a backup password you choose. It uses SQLCipher encryption: AES-256 with a per-page HMAC, and a key derived from your password with PBKDF2-HMAC-SHA512 (256,000 iterations, random salt).
- Your backup password is stored only in your phone's secure storage (Keychain / Keystore), available only while the phone is unlocked and never synced to other devices. It's never sent to us or to Google. We can't read your backups, and neither can Google.
- So the app can show your backup list, each file carries a few small labels that are not encrypted: the profile name (up to 60 characters), when the backup was made, the number of bills, and backup format and version numbers. No bill contents, amounts, addresses or emails are in these labels.
- You choose whether backups include your stored bill documents (PDFs and photos). If included, they're encrypted inside the backup too.
To remove existing backups, delete them in the app, or in Google Drive go to Settings › Manage apps › BillNudge › Delete hidden app data. You can also revoke access at myaccount.google.com/permissions.
7. Google API Services: Limited Use disclosure
BillNudge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, Google user data (Gmail messages, your Google account email and profile, and Drive app-data files) is used only to provide BillNudge's user-facing features described above. It's processed on your phone, isn't transferred to us or any third party, isn't used for advertising, isn't read by any person, and isn't used to develop, improve or train generalised AI or machine-learning models.
8. Device permissions
| Permission | Platform | Why |
|---|---|---|
| Camera | Android, iOS | To scan paper bills. Images are processed on the phone and deleted afterwards, unless you choose to keep an encrypted copy. |
| Photos (picker only) | Android, iOS | To import a photo of a bill that you pick. BillNudge doesn't get access to your whole photo library. |
| Notifications | Android, iOS | To remind you before bills are due. Reminders are scheduled on your phone, with no push server. Lock-screen text is private by default. |
| Biometrics (fingerprint / Face ID) | Android, iOS | For the optional app lock. Your fingerprint or face data never reaches BillNudge; your phone only tells the app "success" or "fail". |
| Internet and network state | Android, iOS | Only for the optional connections in section 3, and to keep automatic backups on Wi-Fi. |
| Vibration | Android | For reminder notifications. |
BillNudge doesn't request your location, contacts, calendar, microphone, or access to all your files and photos. On Android it specifically blocks microphone, broad storage, "draw over other apps", remote push (Firebase Cloud Messaging) and install-referrer permissions. You can also share a PDF or image into BillNudge from another app, and only the file you share is received.
9. Background activity
If you've connected a mailbox or turned on automatic backups, BillNudge may occasionally run in the background, when Android or iOS allows it, to check for new bills and to make any backup that's due. This runs on your phone and uses only the connections described above.
10. Security
- Your database is encrypted with AES-256 (SQLCipher), with the key protected by Android Keystore / iOS Keychain.
- Sign-in tokens for Gmail, Outlook and Drive are stored in the phone's secure storage, never in plain files, and never sent to us.
- Android's automatic cloud backup and device-to-device transfer of BillNudge data are turned off, so your data only leaves the phone in a backup you encrypt yourself.
- All network connections use HTTPS.
11. Data retention and deletion
Your data stays on your phone until you delete it. You can delete individual bills, delete a whole profile (which destroys its encryption key), disconnect accounts, or uninstall the app. Google Drive backups stay in your Drive until you delete them, as described in section 6.
Because we hold none of your data, we can't recover it for you if you lose your phone or forget your backup password.
12. Open-source and third-party components
BillNudge is built with the following open-source software, data and platform components. None of them receive your data from BillNudge, except where a connection is described in section 3.
Open-source software
| Component | Used for | Licence |
|---|---|---|
| React and React Native | App framework | MIT |
| Expo SDK and Expo modules (including expo-router, expo-sqlite, expo-secure-store, expo-auth-session, expo-camera, expo-image-picker, expo-document-picker, expo-notifications, expo-local-authentication, expo-background-task, expo-crypto, expo-network) | Navigation, storage, secure storage, sign-in, camera, file picking, reminders, app lock, background tasks | MIT |
| SQLCipher (Community Edition, via expo-sqlite) | Encrypted database and encrypted backups | BSD-style, Zetetic LLC |
| Zustand | App state | MIT |
| react-native-reanimated, react-native-gesture-handler, react-native-screens, react-native-safe-area-context, react-native-worklets, react-native-keyboard-controller | Animations, gestures and layout | MIT |
| @react-native-community/datetimepicker | Date picker | MIT |
| Ionicons (via @expo/vector-icons) | Icons | MIT |
Open data
| Data | Used for | Licence |
|---|---|---|
| OpenStreetMap data, via LocationIQ | Optional address search | © OpenStreetMap contributors, ODbL |
| Australian Bureau of Statistics, ASGS Edition 3 (2021) | Built-in suburb and postcode list | CC BY 4.0 |
Platform components (not open source, run on your phone)
| Component | Platform | Used for |
|---|---|---|
| Google ML Kit Text Recognition (bundled model) | Android | Reading text from bill photos and scans, on the device |
| Google ML Kit GenAI Prompt API (Gemini Nano) | Android, supported phones | On-device "hard invoice" reading |
| Google Play services Auth | Android | Google sign-in for Gmail and Drive |
| Apple Vision and PDFKit | iOS | Reading text from bill photos and PDFs, on the device |
| Apple Foundation Models (Apple Intelligence) | iOS, supported iPhones | On-device "hard invoice" reading |
BillNudge's bill classifier was built by us and runs entirely on your phone.
13. Children
BillNudge is intended for adults (18+) managing household bills. It isn't directed to children, and we don't knowingly collect information from children.
14. Changes to this policy
If this policy changes, the new version will be posted at this address with a new "last updated" date. Any change that sends data off your phone in a new way will be shown in the app before it takes effect.
15. Contact
For privacy questions, requests or complaints, contact:
C2S Cosmos Pty Ltd
Email: c2scosmos@gmail.com
Sydney, NSW, Australia
BillNudge is developed in Australia. This policy is intended to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, Google Play's User Data policy, the Google API Services User Data Policy, and Apple's App Store privacy requirements. If you're not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.