← Back to Home

Privacy Policy

Last updated: October 29, 2026

1. Introduction

BillManager ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our bill tracking and financial management service ("the Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using the Service:

  • Account Information: Username, email address, and password when you register
  • Financial Data: Bill names, amounts, due dates, payment records, and account labels you enter into the Service
  • Profile Information: Any additional information you choose to add to your profile
  • Social and OpenID Connect Sign-In: If you choose social or OpenID Connect sign-in, we receive the provider’s account identifier and email address and, when supplied by that provider, your name (including given and family names) and profile-picture URL. We store these details in your linked sign-in record. The current app does not download or store the profile image itself.
  • Communications: Information you provide when contacting our support team
  • Payment Information: When you subscribe to a paid plan, payment details are processed by our payment provider (Stripe) - we do not store your full credit card number

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain information:

  • Usage Data: Pages viewed, features used, actions taken within the Service
  • Device Information: Device type, operating system, browser type, and version
  • Log Data: IP address, access times, and referring URLs
  • Analytics Data: Aggregated usage statistics collected through our analytics platform
  • Crash and Diagnostic Data: When the Service or the official BillManager mobile app encounters an error or crashes, we collect technical diagnostic information about the fault, including the type of error, the stack trace showing where in our code it occurred, and the release the fault occurred in. See section 5.4 for the data collected by the server and mobile app.

2.3 Cookies and Similar Technologies

We use minimal cookies essential for the Service to function:

  • Session Cookies: To maintain your logged-in state
  • Security Cookies: To prevent cross-site request forgery and other attacks

We use Umami for privacy-focused analytics, which does not use cookies and does not track personal information.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process your transactions and manage your subscription
  • Send you service-related communications (account verification, security alerts, billing notices)
  • Respond to your comments, questions, and support requests
  • Monitor and analyze usage patterns to improve user experience
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

We do not:

  • Sell your personal information to third parties
  • Use your financial data for advertising purposes
  • Share your bill details with other users without your consent
  • Access your data except when necessary to provide support or maintain the Service

4. Data Storage and Security

4.1 Where We Store Your Data

Your data is stored on secure servers. We use industry-standard encryption for data in transit (TLS/SSL) and implement appropriate security measures for data at rest.

4.2 Data Retention

We retain your data as follows:

  • Active Accounts: Data is retained for as long as your account is active
  • Deleted Accounts: Data is deleted within 30 days of account deletion request
  • Backups: Backup data may be retained for up to 90 days for disaster recovery
  • Legal Requirements: Some data may be retained longer if required by law

4.3 Security Measures

We implement various security measures including:

  • Encryption of data in transit and at rest
  • Secure password hashing
  • Regular security audits and updates
  • Access controls and authentication requirements
  • Monitoring for suspicious activity

5. Third-Party Services

We use the following third-party services that may process your data:

5.1 Stripe (Payment Processing)

We use Stripe to process payments. When you subscribe to a paid plan, Stripe collects and processes your payment information according to theirPrivacy Policy. We receive only limited payment information (last 4 digits, expiration date, billing address) necessary to manage your subscription.

5.2 Umami (Analytics)

We use Umami for privacy-focused website analytics. Umami:

  • Does not use cookies
  • Does not collect personal information
  • Does not track users across websites
  • Complies with GDPR, CCPA, and PECR

5.3 Email Services

We may use third-party email services to send transactional emails (account verification, password reset, billing notifications). These services process your email address solely for delivery purposes.

5.4 Sentry (Crash and Error Diagnostics)

We use Sentry to receive crash and error reports from the BillManager server and the official BillManager mobile app for Android and iOS, so that we can find and fix faults. Sentry processes this data on our behalf as a service provider, under itsPrivacy Policy.

Server crash reporting operates only where we have configured a reporting destination; with none configured it is off. When an unhandled server error occurs, the report contains:

  • Crash diagnostics: The class of the error and its stack trace — the file, function and line number in our deployed code, and whether the code is ours or a third-party dependency. The error’s own message text is replaced before the report is sent.
  • Release information: The release label and the deployment environment the error occurred in
  • Runtime information: The name and version of the language runtime executing our server code
  • Event identifiers: A randomly generated event identifier and the time the error occurred
  • Source IP address: Sending a report necessarily discloses the sending server’s network address to Sentry, which Sentry processes as part of receiving it

We configure server crash reporting to exclude the contents of your account. Server error reports do not carry your bill names, payee names, amounts, payment records, request URLs, query strings, headers, cookies or request bodies, authentication credentials, account or tenant identifiers, source code excerpts, or the values of variables in scope when the error occurred. We do not enable Sentry’s optional collection of personally identifying user data, and we do not enable its performance tracing, profiling or log-forwarding features.

Mobile crash reporting is always on in official app builds, regardless of whether the app connects to our hosted service or a self-hosted server. It is not tied to telemetry consent, and no in-app toggle is offered. Sentry reporting sends only the following crash diagnostics and release-health data:

  • Crash diagnostics: The exception type with its message redacted, stack frames, native debug images used for symbolication, and the time and severity of the error
  • Release information: The app release and build, platform label, environment (for example, production), and the name and version of the crash-reporting SDK
  • Release-health data: Session times, duration, status and error counts, and a random per-installation identifier generated by the crash-reporting SDK, used only to count sessions and affected installations and not linked to your account

The Sentry event allowlist scrubber excludes account contents (including bills, amounts, payees and notes), user identity (including name, email and account ID), device context, breadcrumbs and screenshots. The app does not attach IP-derived user data. Sending a report necessarily discloses the device’s network source address to Sentry as it receives the report.

Sentry retains the diagnostic events it receives according to the retention schedule of the plan we use, after which they are deleted. Crash reporting is used only to diagnose and fix faults in the Service; it is not used for advertising, profiling, or measuring individual users.

If you run the BillManager server yourself, server crash reporting is disabled unless you configure a reporting destination of your own via SENTRY_DSN. There is no built-in BillManager server reporting destination, and a self-hosted server deployment does not send diagnostics to us. Where you enable it, server reports go to your own Sentry project and you are the controller of that data. This server setting does not disable crash reporting in the official mobile app.

5.5 Mobile App Updates

Official mobile builds with Expo update checks enabled check for and download compatible code updates using Expo’s EAS Update service. In those versions, update checks occur when the app starts and send technical information such as the platform, app runtime and update identifiers, and a randomly generated app-installation identifier. Expo also receives the device’s network source address as part of those requests.

To recover from update failures, Expo Updates may include a previous fatal error’s description in a later update request. That description can contain the original error message; it is not processed by BillManager’s Sentry event scrubber. These update requests are separate from Sentry crash reporting and optional server usage telemetry and support update delivery and recovery.

Versions built with Expo update checks disabled run bundled code; code updates require installing a new app build, such as an update delivered by your app store. Installing such a version stops Expo update checks from that installation. Installed versions with update checks enabled retain that behavior until replaced.

6. Data Sharing

We may share your information in the following circumstances:

  • With Your Consent: When you explicitly authorize sharing with other users (e.g., shared bill groups)
  • Service Providers: With third-party vendors who assist in operating our Service, subject to confidentiality agreements
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to users
  • Protection of Rights: To protect the rights, property, or safety of BillManager, our users, or others

7. Your Rights and Choices

7.1 Access and Portability

You have the right to access your personal data. You can export your data at any time using the export features in the Service (CSV and PDF formats available).

7.2 Correction

You can update or correct your personal information through your account settings at any time.

7.3 Deletion

You can request deletion of your account and associated data by contacting us at [email protected]. We will process deletion requests within 30 days, subject to legal retention requirements. See Delete your BillManager accountfor request steps, account-owner scope, and data deletion and retention details.

7.4 Opt-Out

You can opt out of:

  • Marketing Communications: Use the unsubscribe link in any marketing email
  • Analytics: Our analytics platform (Umami) respects Do Not Track signals

7.5 Data Restriction

You may request that we restrict processing of your personal data in certain circumstances, such as while we verify a correction request.

8. International Data Transfers

If you access the Service from outside the United States, your data may be transferred to and processed in the United States or other countries. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable laws.

9. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child under 18, we will delete that information promptly.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the CCPA:

  • Right to Know: Request information about categories and specific pieces of personal information collected
  • Right to Delete: Request deletion of personal information
  • Right to Opt-Out: We do not sell personal information, so this right does not apply
  • Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, contact us at [email protected]. We will verify your identity before processing your request.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the GDPR including:

  • Right of Access: Obtain confirmation and access to your personal data
  • Right to Rectification: Correct inaccurate personal data
  • Right to Erasure: Request deletion of your personal data
  • Right to Restriction: Restrict processing of your personal data
  • Right to Portability: Receive your data in a portable format
  • Right to Object: Object to processing based on legitimate interests
  • Rights Related to Automated Decision-Making: We do not use automated decision-making

Our legal basis for processing your data includes: performance of our contract with you, your consent, our legitimate interests in operating the Service, and compliance with legal obligations.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last updated" date
  • Sending an email notification for significant changes

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Email: [email protected]
Website: https://billmanager.app

For data protection inquiries or to exercise your privacy rights, please email [email protected] with "Privacy Request" in the subject line.