Skarbo: Budget Expense Tracker · Last updated: 30 October 2026
Skarbo helps you track your spending and income: scan receipts, import bank statements and record Apple Pay payments automatically. This policy explains what information the app handles, where it goes, and the choices you have. It also covers our website skarboapp.com (Section 7). We built Skarbo to keep your financial data private by default.
Skarbo ("Skarbo", "the app", "we", "us") is an app for iPhone (iOS) and Android, developed and operated by Ihor Roma, an individual developer. Unless stated otherwise, this policy describes the iPhone app; the Android app is covered in Section 2k. If you have any questions about this policy or your data, contact us at cooperation.aiapp@gmail.com.
When you scan a receipt, the app captures a photo and sends that image to an AI service (see Section 4) to extract details such as the store name, date, total, individual items, and category. The extracted receipt data is then saved locally on your device.
You can import statement files (CSV / XLSX). These files are parsed on your device. When AI assistance is used for categorization, only transaction descriptions and amounts are sent — the app removes card numbers, account numbers and IBANs before anything leaves your device. Statement files themselves are not uploaded.
You can also add a screenshot or photo of a statement. In that case the image is sent to the AI service to read the transactions, and the extracted transactions are saved on your device.
When you ask the app a question about your spending, your question is sent to the AI service together with your list of expenses — store, date, amount, currency and category, and, for questions about specific products, the product names and prices — so it can answer. When you request an AI analysis of your spending, only totals (overall and by category) are sent. When you create a custom category, only the category name is sent so the app can suggest a matching emoji.
The app uses Google Firebase (Analytics and Crashlytics) to collect anonymous usage statistics and crash reports. This helps us understand how features are used and fix problems. This data concerns app behaviour and device diagnostics — it is not your receipt content.
Premium subscriptions are processed by Apple and managed through RevenueCat. When you subscribe, Apple handles the payment; RevenueCat receives subscription status tied to an anonymous identifier. We never receive or store your card details — those stay with Apple.
We also advertise Skarbo in Apple Ads (ads in App Store search results). To see whether a subscription came from these ads, the app passes RevenueCat an attribution token from Apple's AdServices framework. RevenueCat uses this token to ask Apple whether the app was downloaded from one of our Apple Ads campaigns and, if so, which campaign, ad group and keyword. The token contains no personal or financial data and does not include your device's advertising identifier, so it does not require tracking permission.
We advertise Skarbo on Facebook and Instagram. To see how many people install and open the app after our ads, the app includes the Meta (Facebook) SDK. The SDK sends Meta app events such as installs, app launches and subscription purchases (the product and price — never your payment details), together with technical information such as device model, iOS version, app version and IP address. It does not receive your receipts, transactions, budgets or any other financial records.
iOS asks whether Skarbo may track you across other companies' apps and websites. Only if you tap Allow does the SDK also share your device's advertising identifier, so Meta can link the install to an ad; if you tap Ask App Not to Track, it does not. You can change this at any time in iOS Settings → Privacy & Security → Tracking. Meta processes this data under its Privacy Policy.
If you set up the optional automation in Apple's Shortcuts app, iOS passes the details of each Apple Pay payment to Skarbo — the amount and currency, the store name, the card name and the date — and the app saves the expense on your device. These payment details are not sent to us.
For Premium users who have not chosen a category in the automation, the app first looks for the same store in your own history on the device. Only if it is not found, the store name alone (with any card or account numbers removed) is sent to the AI service to suggest a category — never the amount, card, account or date.
To keep the AI features available and protect them from abuse, the app uses Apple's App Attest: your device creates a key, Apple confirms that requests come from a genuine copy of Skarbo, and our server keeps the key's random identifier and public key to check later requests. This key is not linked to your name, Apple ID or financial data.
When the app contacts our server, the server also uses your IP address, your country (determined from the connection) and the app version to apply usage limits and block abuse. Limit counters expire automatically within 48 hours, and technical request logs are kept by Cloudflare for a few days.
Once a day, when you leave the app, Skarbo saves a backup file of your data: your records (purchases with their items, income and transfers), accounts and their balances, categories, budgets, recurring payments and income, import rules and a few app settings (such as the order of categories). You can also save one at any time with Back Up Now (Settings → iCloud → Backup). The file is stored on your device and, if iCloud Drive is available, in the Skarbo folder of your iCloud Drive (visible in the Files app). The app keeps the copies from the last 7 days plus one older safety copy and deletes older copies automatically. These files never go to our servers.
Share Backup sends the file to a place you choose, such as Files or a messenger. The file contains your financial records in readable form, so anyone who has it can read them — share it only where you trust. Restore from Backup and Choose File… read a backup file you select and add only the records that are missing in the app. After a restore, the app keeps on your device, for 30 days, a list of the restored records (to remove duplicates once iCloud sync catches up), and stores in your own iCloud an app-specific identifier of the device and the time of the restore, for up to 30 days, so that your other devices do not remove restored records by mistake.
The Android app (currently in testing on Google Play) works fully offline: it has no internet access, so it sends no data to us, to AI services or to anyone else. It does not scan receipts and does not use AI, Firebase, the Meta SDK, App Attest, Apple Ads or subscriptions — the parts of this policy about those features apply to the iPhone app only.
Everything you enter in the Android app — expenses, income, transfers, accounts and their balances, categories and settings — is stored only on your device. If Android backup is turned on, Android may include this data in your device backup to your Google account; Google makes and keeps that backup under the Google Privacy Policy, and we have no access to it.
The Android app does not ask for any device permissions. You can delete individual records in the app at any time, and uninstalling the app removes all of its data from your device. If we add features to the Android app that send data off your device, we will update this policy before releasing them.
Reading receipts and statement screenshots, sorting transactions into categories and answering spending questions are powered by Anthropic's Claude AI. To keep the AI key secure, requests pass through our infrastructure provider Cloudflare, which forwards them to Anthropic. The data sent is used solely to process your request (for example, reading a receipt, suggesting a category or answering a question) and, under Anthropic's API terms for commercial use, is not used to train AI models. We recommend reviewing Anthropic's Privacy Policy for details on their handling.
Your permission. Before the app sends anything to the AI, it shows the screen “How Skarbo uses AI”, which lists what is sent, and asks for your permission. If you choose Not now, nothing is sent to the AI: receipt and statement scans, AI categories for imported statements, questions and analysis, and the Apple Pay auto-category stay off, and you can still add and edit records by hand (Apple Pay payments then get a category from your own history on the device). You can change your choice at any time in Settings → AI.
Your receipts, transactions, income, accounts, categories and budgets are stored in the app's storage on your device. If you use iCloud on your device, the app also syncs this data through your private iCloud database (Apple CloudKit), so it appears on your other devices and comes back if you reinstall the app. This copy lives in your own iCloud account under Apple's terms — we cannot access it. Keeping your device and Apple ID secure (passcode, two-factor authentication) is an important part of protecting your data. If you back up your device to iCloud or your computer, the app's local data may also be included in that backup. The app's own backup files (Section 2j) are kept on your device and in your iCloud Drive — we cannot access them either.
| Service | Purpose | What it receives |
|---|---|---|
| Anthropic (Claude AI) | Read receipts and statement screenshots, suggest categories, answer spending questions | Receipt and statement images; transaction descriptions/amounts; store names from Apple Pay payments (Premium, see Section 2h); your list of expenses with your question, or spending totals for an AI analysis (see Section 2c); category names |
| Cloudflare | Secure request routing to the AI; usage limits and abuse protection; hosting our website and its visit counter | The above requests pass through in transit; IP address, country and app version for usage limits and short-lived logs; App Attest key identifiers (see Section 2i); website visits (see Section 7) |
| Google Firebase | Analytics & crash reporting | Anonymous usage events, crash diagnostics, device info |
| Apple | Subscription payments; iCloud sync and iCloud Drive backups; App Attest | Purchase & billing (handled entirely by Apple); your synced data and backup files in your private iCloud (we cannot access them); an app integrity check for your device |
| RevenueCat | Subscription management; measuring subscriptions from our Apple Ads | Subscription status tied to an anonymous ID; an Apple Ads attribution token, from which RevenueCat gets the campaign, ad group and keyword if the app was downloaded from our ad (see Section 2e) |
| Meta (Meta SDK, in the app) | Measuring app installs from our ads | Install, launch and subscription purchase events, device info; advertising identifier only if you allow tracking (see Section 2g) |
| Meta (Meta Pixel, on the website) | Measuring our ads on skarboapp.com | Page visits and App Store button taps, with cookie, browser and device data (see Section 7) |
| Brandfetch | Logos of subscription services (for example, Netflix) in your list of recurring payments | The service's web address (for example, netflix.com) and your IP address, as with any image download — no amounts or other financial data |
| National Bank of Ukraine (NBU) | Currency exchange rates | Rate requests only — no personal or financial data |
We advertise Skarbo on Facebook and Instagram. People who tap our ads land on our website skarboapp.com, which links to Skarbo in the App Store. This section explains what the website collects. The website has no access to the app or to your receipts and financial data.
The website uses the Meta Pixel, a measurement tool provided by Meta (the company behind Facebook and Instagram). It records when the page is opened and when the "Download on the App Store" button is tapped, so we can see which ads work. To do this, Meta may use cookies and similar technologies and receive technical information such as your IP address, browser and device details, the page address and the time of the visit, and may link it to your Facebook or Instagram account if you have one. Meta uses this information to measure and deliver ads under its own terms and Privacy Policy. We receive only aggregated reports from Meta and no information that identifies you.
To count visits and button taps, the website also sends anonymous events to our own counter, hosted on Cloudflare. The counter does not use cookies and does not save your IP address or any identifier. For each day it keeps only totals — the number of visits and taps — grouped by the ad label in the link, device type (iPhone, iPad, Android or computer), the app the page was opened in (for example, Facebook or Instagram) and the country determined from the connection. To tell a first visit from a repeat one, the page keeps a flag in your browser's session storage, which is cleared when you close the tab. For visitors outside Ukraine this flag is stored only after they allow the Meta Pixel. These daily totals contain no personal data.
We minimise what leaves your device. In particular, sensitive identifiers in imported statements (card numbers, account numbers, IBANs) are stripped out before any data is sent for AI processing. Data in transit is protected by encryption (HTTPS), and requests to our server are checked with Apple App Attest (Section 2i). No method of transmission or storage is 100% secure, but we design the app to limit exposure of your financial information.
Because your financial data is stored on your device, you are in control of it:
On our side, usage limit counters expire within 48 hours, technical request logs are kept by Cloudflare for a few days, and App Attest key records are kept only to check requests from your device.
Diagnostic data collected by Firebase is retained according to Google's standard retention periods. To manage a subscription, use your Apple ID subscription settings.
Skarbo is a personal-finance tool intended for adults. It is not directed at children, and we do not knowingly collect information from children under the age required by your local law (for example, 13 in the U.S. or 16 in parts of the EU).
Skarbo is available in many countries. Depending on where you live (for example, under the EU/UK GDPR), you may have rights to access, correct, or delete your personal data, and to object to certain processing. Because your financial data is stored on your device and largely controlled by you directly, you can exercise most of these rights within the app itself. For anything else, or to make a request, contact us at cooperation.aiapp@gmail.com.
We may update this policy as the app evolves. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.
Developer: Ihor Roma
Email: cooperation.aiapp@gmail.com
Questions or requests about your privacy? Write to the address above.