Privacy policy of the BonBunker app

Date: 2026-10-09 This policy on the web: https://receiptify.daturex-cloud.de/privacy-policy

1. In short

• Your receipts, photos, tags and budgets stay on your phone. We do not receive them and cannot look at them.
• There is no account, no advertising and no tracking.
• Only these things go over the internet. First, the app downloads the recognition model from Hugging Face, a provider in the USA; in doing so Hugging Face learns your phone's IP address. Second, about once a day the app asks our server whether there is a new recognition model; the request contains nothing about you or your receipts. Third, you can donate receipts if you want to; then only what you select is sent, and only after you have agreed, each time. Fourth, and only if you set it up yourself: you can have your receipts read by a server of your own; the photos then go to the server you enter, not to us.
• The app sends nothing else.

2. Who is responsible

DATUREX GmbH Hermann-Reichelt-Straße 3A 01109 Dresden Germany E-mail: kontakt@daturex.de Represented by its managing director (Geschäftsführer) Marcel Kießlich Amtsgericht Dresden (commercial register), HRB 36495 VAT ID DE325253451

Contact for data protection matters: datenschutz@externer-datenschutzbeauftragter-dresden.de, or by post to the address above, marked "z. Hd. Datenschutzbeauftragter" (for the attention of the data protection officer)

If you write to us, we process your message and your e-mail address in order to answer you. The legal basis is Art. 6(1)(f) GDPR: our interest in answering enquiries. We delete your message once your matter is settled, unless the law requires us to keep it longer.

3. What the app stores on your phone

The app stores everything in its own protected storage area on your phone. Other apps cannot get at it. It stores:

• your receipts: the photo and the data read from it (store, date and time, total, items with quantity and price), including your corrections,
• your tags and which receipts and items you assigned them to,
• your budgets,
• your settings; if you have set up a server of your own for reading, also its address, the name of the model and the key,
• the recognition model (one large file per model, see section 5),
• if you donated receipts: for each donated receipt a deletion code, the checksum of the photo that was sent (a kind of digital fingerprint of the file) and the day of the donation, so that you can withdraw the donation.

Receipts are read by a model that runs on your phone. The photo is not sent to the internet for that.

Reading on a server of your own (only if you set it up): Under Settings → Advanced you can enter a server of your own in place of the model on the phone, for example a computer at home or a provider you choose. This is off until you enter an address and a model name and save them. From then on the app sends the photo of every receipt that is read to that server, together with your key for that server if you entered one. Nothing else is sent along. The photos go only to the address you enter; we do not receive them and take no part in this transfer. What the server does with the photos and how long it keeps them is up to whoever runs it. Without encryption (http://) the app only sends to addresses in your own network. Once you choose "On this phone" again, nothing more is sent there.

We have no access to this data. It exists only on your phone. We can neither look at it nor restore it if it is lost.

No copy in the cloud: The app does not take part in Android's cloud backup and is not transferred automatically to a new phone. If you want to take your data with you, use the app's backup (section 6).

4. Permissions

The app uses these Android permissions:

• Internet access: for downloading the recognition model and asking for a new one (section 5), if you donate, for sending the donation (section 7), and, if you have set up a server of your own, for sending the photos there (section 3).
• View network state: the app checks whether you are on Wi-Fi. If you are not, it asks before downloading the large model over mobile data.
• Notifications: the app shows how far reading or the download has got. Android asks you whether you allow this.
• Keep working in the foreground (foreground service): so that reading and the download continue when you leave the app. While this runs, you see a notification.
• Prevent the phone from sleeping: so that the phone does not fall asleep in the middle of reading or downloading.

The app has no permission for the camera, for your photos and files, for location, for contacts or for the microphone. When you photograph a receipt, your phone's camera opens; when you take an existing picture, Android's photo picker opens. The app receives only the picture you take or select. For the backup you choose the location and the file yourself in Android's file dialog.

5. Download of the recognition model (Hugging Face)

What happens: To read receipts the app needs a recognition model. It is a large file that is not contained in the app. There are two models: the standard model (a download of about 1.9 GB) and a larger one (about 4.3 GB) that you can choose in the settings.

The app downloads a model in two cases: when you have a receipt read for the first time (if you are not on Wi-Fi then, it asks first), or when you choose a model in the settings that is not on your phone yet and confirm the download. After that the file is on your phone, and the app makes no further connection for reading receipts. If you delete a model file in the settings and want to use that model again later, the app downloads it again.

From whom: The file is hosted by Hugging Face (huggingface.co), operated by Hugging Face, Inc., a company in the USA.

What is transmitted: As with any request on the internet, Hugging Face learns your phone's IP address, the time, which file is requested, and technical details of the request (for example which program fetches the file). The app also sends an access token that is built into the app. It only allows reading the model files and is the same for all users. From it and from the file requested, Hugging Face can tell that the request comes from an BonBunker app. Apart from that the app sends nothing about you: no receipts, no photos, no name, no device identifier. Hugging Face may use further service providers to deliver large files, for example a content delivery network. They then learn your phone's IP address as well.

What Hugging Face does with this connection data and how long it is kept there is determined by Hugging Face. We do not receive this data. More in Hugging Face's privacy policy: https://huggingface.co/privacy

USA: Your IP address thereby reaches a company in the USA, a country outside the EU. Hugging Face processes this data on its own responsibility, not on our behalf. The transfer takes place because you start the download and the app cannot do its job without it (Art. 49(1)(b) GDPR).

Legal basis: Art. 6(1)(b) GDPR: we provide the function you want to use. Storing the model file on your phone is strictly necessary for that (Section 25(2) no. 2 of the German TDDDG).

Can you avoid this? Honestly: only by not having receipts read. Without the model the app cannot read receipts, and at present there is no other way to get it. As long as you have nothing read, nothing is downloaded.

Asking for a new model: About once a day, when you open the app, it asks our server (receiptify.daturex-cloud.de, run by us on servers of Hetzner Online GmbH in Germany) whether there is a new recognition model. The request contains nothing about you, your phone or your receipts. As with any request over the internet, the server learns your phone's IP address in the process. It holds it only briefly, in memory and in a form that cannot be turned back into the address, to limit the number of requests, and does not store it. If there is a new model, the app tells you once. It is downloaded only when you want that; what is said above about the download then applies. Until then the app goes on reading with the model you have. Legal basis: Art. 6(1)(f) GDPR: our interest in being able to offer you a better model without you needing a new version of the app.

6. Backup and CSV export

Backup: You can create a backup in the app. It is a file with your receipts, photos, tags, budgets and settings and, if you donated, the deletion codes of your donations. It is encrypted with a password you choose yourself. Without the password it cannot be opened, and nobody can reset it, including us.

CSV export: You can export the receipts that have been read as a table (CSV file). This file is not encrypted. Anyone who gets it can read it.

Both files leave your phone only when you yourself save or send them somewhere, for example to a cloud storage or by e-mail. Then the rules of the service you choose apply. We never receive these files.

7. Donating receipts

If your version of the app offers "Donate receipts", you can send us receipts so that we can improve recognition. In short:

• Voluntary. The app works just the same without a donation.
• With your agreement each time. Before every donation the app shows what would be sent. Only the receipts you leave ticked are sent, and only after you have agreed.
• What is sent: the complete photo, the data read from it including your corrections, whether you corrected it, the name of the recognition model, the app version and the app language. Your tags and budgets are not sent. The app removes information in the photo file such as location and device model beforehand.
• To whom: to DATUREX GmbH. Donations are stored on servers of Hetzner Online GmbH (Gunzenhausen) in Germany, which processes them on our behalf. Apart from that we do not pass them on to anyone.
• What for: to train and test the receipt recognition models (fine-tuning). The model trained this way is distributed as part of the app; the donated photos and data themselves are not.
• Withdrawing: at any time in the app under "Settings", "Donate receipts", "Withdraw my donations". We then delete the donations from the server and do not use them for any further training. Models that were already trained with them are not changed or retrained.

Receipts can contain personal data, including other people's. The legal basis is your consent. All details are in the privacy notice for data donation: https://receiptify.daturex-cloud.de/donation-privacy

8. What the app does not do

• no analysis of how you use the app and no crash reports to us or to third parties,
• no advertising and no advertising identifier,
• no account, no sign-in, no device identifier,
• no access to location, contacts, microphone or your other photos,
• no connection to the internet other than those described in sections 3, 5 and 7,
• no automated decision about you and no profiling (Art. 22 GDPR).

When you download the app from the Google Play Store, Google processes data under its own rules. We have no influence on that.

9. How long data stays

• On your phone: until you delete it. You can delete individual receipts, tags and budgets in the app, and the model files too. Deleting a receipt on the phone does not withdraw its donation; that works only as described in section 7. If you uninstall the app or clear the app's data in the Android settings, everything is gone, including the recognition model and the deletion codes of your donations.
• Backup and CSV export: as long as you keep the files.
• Donations: until you withdraw them, or until we no longer need them for improving the recognition models; we review this at least every three years. We keep backups of the server for at most 30 days; a withdrawn donation is therefore gone from there too after 30 days at the latest. Of a withdrawn donation the server notes the checksum (a kind of digital fingerprint) of the file and the day of the deletion for 90 days, so that it can delete the donation again if it comes back with a backup.
• Connection data from the model download and from asking for a new model: we store none. What Hugging Face stores is determined by Hugging Face (section 5).

10. Your rights

Under the General Data Protection Regulation (GDPR) you have, in principle, these rights towards us:

• access to the data we process about you (Art. 15),
• rectification of incorrect data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability, that is, receiving your data in a common format (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of consent at any time with effect for the future (Art. 7(3)). This concerns donations; section 7 says how.

What this means in practice here:

• We do not have the data on your phone. You can view, change, export and delete it yourself in the app.
• We store donations without an account and without an identifier. We therefore cannot determine on our own which donations are yours, and we cannot act on a request such as "all my donations". You can exercise your rights for a specific donation by using the deletion code in the app, or by sending us a photo of the receipt so that we can look for the donation. Details are in the privacy notice for data donation.

Send requests to kontakt@daturex.de or to datenschutz@externer-datenschutzbeauftragter-dresden.de.

Complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority competent for us is:

Sächsische Datenschutz- und Transparenzbeauftragte (the Saxon data protection and transparency commissioner) Devrientstraße 5 01067 Dresden Germany

11. Children and young people

The app is not aimed at children and young people under 16.

12. Changes

Date of this policy: 2026-10-09. If what the app stores or sends changes, we will update this policy before the change takes effect. You can find the current version at https://receiptify.daturex-cloud.de/privacy-policy.