Privacy Policy for Dyced

Effective date: June 3, 2026 · Last updated: July 31, 2026

This Privacy Policy explains how Ghulam Ali (“we,” “us,” or “our”), the individual developer of the mobile application Dyced (the “App”), collects, uses, shares, and protects your information when you use the App. By downloading, installing, or using Dyced, you agree to the practices described below.

If you have any questions about this Policy or your data, contact us at Komail.ali1@yahoo.com.

1. Who we are

Dyced is a travel and expense tracking application that lets you record expenses (including by voice), scan receipts, organize trips, view itineraries on a map, and optionally share trips and expenses with people you invite. The App is published by Ghulam Ali as an individual developer.

2. Information we collect

We collect only the information necessary to operate the App, secure your account, and provide the features you use.

2.1 Information you provide

• Account information. When you sign in, we receive your name, email address, and a unique user identifier from Sign in with Apple.
• Expense and trip content. Expense amounts, currencies, categories, dates, merchant names, notes, trip names, itinerary entries, locations you add to a trip, group memberships, and any other content you create in the App.
• Receipts and images. Photos of receipts you capture with the camera or upload from your photo library, and images you attach to expenses.
• Shared trip album (photos and videos). Photos and videos you add to a trip's shared album, together with the information the album needs to organize them: when each was taken, the exact capture coordinates (latitude and longitude) recorded by your camera, file and image details, and the face groupings and person names used to sort the album by who is in each photo. Faces are detected and matched on your device; only the resulting groupings and any names you assign are shared with the trip. Photos and videos are shared with the other members of that trip as your camera recorded them, including any location metadata carried inside the file — the same as sending someone the original photo directly. The capture coordinate is also stored as a separate field that powers the trip's itinerary map and recap, and it is never displayed in the album grid. Only members of that trip can see the album, and shared albums are stored in one trip member's personal iCloud — see Section 4.
• Voice input. Audio captured for voice-based expense entry and the transcribed text. Audio is processed using Apple's on-device or Apple-provided speech recognition (see Section 4).
• Linked email mailbox (optional). If you choose to connect a mailbox for expense and booking import, we collect the email address, the IMAP server settings, and an app-specific password you generate with your mail provider, plus the contents of the messages the App reads from that mailbox — sender, subject, date, and message body. See Section 4.2.
• Communications with us. Any information you send us by email, including the contents of support requests.

2.2 Information collected automatically

• Device and diagnostic data. Device model, operating system version, app version, language and region, anonymous installation identifier, and crash or error logs used to diagnose problems.
• Push notification token. An Apple Push Notification service (APNs) / Firebase Cloud Messaging token assigned to your device so we can send notifications you have enabled.
• Approximate usage timestamps. When records are created, modified, or synced, so that data can be ordered and reconciled across devices.

2.3 Information you grant permission for

The App requests these system permissions only at the moment a feature needs them. You can change or revoke any of these at any time in iOS Settings → Privacy & Security.

We do not access your contacts, calendars, health data, or background location.

3. How we use your information

We use the information described above only to:

• Authenticate you and keep your account secure.
• Sync your expenses, trips, and receipts across your devices and with people you have explicitly shared them with.
• Provide the App's features (voice entry, OCR/receipt capture, itinerary mapping, group expense splitting, notifications, etc.).
• Provide AI-powered features you invoke — such as extracting line items from receipts, suggesting categories, generating trip insights and recaps, and answering questions about your trip (see Section 4.1).
• Find expense and booking confirmation emails in a mailbox you have connected, and turn them into drafts for you to review (see Section 4.2). We do not use your email for any other purpose.
• Diagnose crashes and fix bugs.
• Prevent fraud, abuse, and violations of our terms.
• Respond to your support requests and legal obligations.

We do not use your information for advertising, do not sell your information, and do not use it to build profiles for marketing.

4. How information is processed and stored

The App uses Google Firebase (provided by Google LLC) as its backend infrastructure. Specifically:

• Firebase Authentication verifies your identity.
• Cloud Firestore stores your expenses, trips, and groups.
• Firebase Storage stores receipt images and other attachments.
• Cloud Functions for Firebase runs server-side logic such as invitations, notifications, and AI requests. (Currency conversion is not done here — your device fetches published reference rates directly from the providers listed in Section 11.)
• Firebase Cloud Messaging delivers push notifications.

Data is stored on Google Cloud infrastructure and is protected in transit (TLS) and at rest using industry-standard encryption. Access to your data is controlled by per-user security rules so that only you and people you have explicitly shared trips or groups with can read it.

Shared trip albums are stored differently — in a trip member's own iCloud, not on our servers. A trip's shared photo album lives in Apple iCloud (CloudKit), in the personal iCloud account of the member chosen as that album's host, and is shared with the rest of the trip through Apple's sharing mechanism. This means:

• The album's photos, videos, capture coordinates, face groupings and person names are stored in the host member's iCloud account and count against their iCloud storage — not ours. We never receive or store these files.
• Everyone on the trip can read and add to the album, including anyone who joins the trip later. Members can also caption photos and hide them from the album; permanently deleting an individual photo is done by whoever added it, and the host can delete the entire album.
• The App tells you who hosts an album (Memories Settings → Album), and the host can move an album to another member or delete it.
• Album access can outlive trip membership. The album is shared through Apple's sharing mechanism, which is separate from the trip's own membership list. If you leave a trip yourself, the App also leaves the shared album. If someone else removes you from a trip, the trip disappears from your device but you may remain a participant in the album until the host removes you or deletes it — we do not automatically revoke Apple sharing on your behalf, because doing so is irreversible and cannot be undone without a fresh invitation.
• Because the album is not on our infrastructure, the retention timelines in Section 6 do not apply to it — deleting your Dyced account does not by itself remove content you added to someone else's hosted album. See Section 6.
• Apple's privacy policy and iCloud terms govern data held in iCloud (Section 11).

Voice and speech recognition is performed using Apple's on-device or Apple-hosted Speech framework. Raw audio is not sent to our servers; only the transcribed text you confirm becomes part of your expense record.

4.1 AI-powered features

Some features use artificial intelligence to help you — for example, extracting line items from a scanned receipt, suggesting expense categories, generating trip insights and end-of-trip recaps, and answering questions about your trip.

• On-device first. Where your device supports it, this processing happens on your device using Apple's built-in intelligence and machine-learning frameworks, and no expense content leaves your device for those features.
• Cloud processing for advanced (Pro) features. For certain advanced features — primarily those in Dyced Pro — the specific content needed for the task (for example, the text of a receipt, the text of a booking confirmation email you asked us to import, or a question you ask about your trip) is sent over an encrypted connection to our AI processing provider, Anthropic, PBC, through our Cloud Functions, and the result is returned to you. We send only the data needed to perform the task you requested.
• Not used to train models. Content processed for these features is not used to train AI models, and is not retained by the provider beyond what is needed to return your result and meet limited abuse-prevention requirements.
• You stay in control. AI results are shown to you and are not saved to your records unless you choose to keep them.

4.2 Connecting an email mailbox (optional)

Dyced can read a mailbox you connect in order to find expense and booking confirmation emails and turn them into draft expenses or itinerary plans. This feature is off unless you set it up, and you can disconnect at any time in Settings → Email Import.

• How we connect. Your device connects directly to your mail provider over IMAP (Gmail, Outlook / Hotmail, Yahoo Mail, iCloud Mail, AOL Mail, or a custom IMAP server). We do not use your main account password: you generate an app-specific password with your provider and give it to the App.
• Where the credential is stored. The app-specific password is stored in the iOS Keychain on your device only. It is never uploaded to our servers, never written to Firestore, and we cannot read it.
• What we read. The App searches your mailbox for messages matching known bank, card, airline, hotel, and booking senders, and reads the sender, subject, date, and body of those messages. It does not read your whole mailbox into our systems.
• What leaves your device. Message content is processed on your device to identify amounts, merchants, dates, and booking details. For AI-assisted booking import, the text of the specific emails you asked to import is sent to Anthropic for parsing as described in Section 4.1. Whole mailboxes are never uploaded.
• What we keep. Only the drafts and the records you choose to publish — an expense, or an itinerary plan — are saved to your account. Drafts stay on your device until you publish them. We do not retain copies of your emails on our servers.
• Disconnecting. Removing the connection deletes the stored credential from your Keychain. You should also revoke the app-specific password with your mail provider.

4.3 Operational and administrative access

To keep the App running, provide support, and prevent abuse, a restricted internal administrative tool lets the developer access limited operational data — such as account identifiers, subscription status, aggregate usage, and error reports. Access is limited to the developer, requires authentication, and administrative actions are logged. We access an individual account's content only when necessary to provide support you have requested, to investigate abuse or a security issue, or to comply with a legal obligation.

5. Sharing your information

We share your information only in these limited cases:

1. People you choose. When you add a co-traveler to a trip, or invite someone to a group, the content you intentionally share becomes visible to those people through the App.
2. Service providers. Google (Firebase / Google Cloud), Apple (Sign in with Apple, APNs, Speech, and iCloud / CloudKit for shared albums), and Anthropic, PBC (AI processing for certain features — see Section 4.1) process data on our behalf, under contractual obligations that require equivalent protections to those described in this Policy. These providers are not permitted to use your data for their own purposes.
3. Legal requirements. We may disclose information if required by law, subpoena, or other valid legal process, or to protect the rights, property, or safety of users or the public.
4. Business transfer. If the App is ever transferred to another developer or entity, your data may be transferred as part of that transaction. You will be notified in advance and given the option to delete your account before any transfer takes effect.

We do not sell or rent your personal information to third parties, and we do not share it for cross-context behavioral advertising.

6. Data retention

We retain your information for as long as your account is active. When you delete your account (see Section 8), your personal data, expenses, trips, and receipts are deleted from our active systems within 30 days, and from encrypted backups within 90 days. We may retain a minimal record (e.g., the fact that an account with your user ID existed) where required by law or to prevent abuse.

Content you have shared with other users (e.g., a group expense visible to a co-traveler) may remain visible to them after your deletion, in the same way an email you sent remains in the recipient's inbox.

Shared trip albums (iCloud). These timelines cover our systems only. Album photos and videos are held in the host member's iCloud (Section 4), which we cannot reach: deleting your account does not delete content you added to an album someone else hosts. To remove it, delete the items in the album before you leave or delete your account, or ask the host — the host can delete the whole album (Settings → Albums You Host), which removes it for everyone. Content you add to an album you host is deleted with the album when you delete it, and remains in your iCloud until then.

7. Children

Dyced is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us at Komail.ali1@yahoo.com and we will delete it.

8. Your rights and choices

Regardless of where you live, you can:

• Access your data — most of it is visible directly in the App.
• Correct your data — by editing it in the App.
• Export your data — contact us at Komail.ali1@yahoo.com.
• Delete your account and all associated data — open the App and go to Settings → Account → Delete Account, or email Komail.ali1@yahoo.com. Account deletion is permanent and follows the retention timeline in Section 6.
• Revoke permissions — at any time in iOS Settings → Privacy & Security, or Settings → Notifications.

8.1 Residents of the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

You also have the right to (a) restrict or object to processing, (b) data portability, (c) withdraw consent at any time, and (d) lodge a complaint with your local data protection authority. Our legal bases for processing are: performance of a contract (providing the App's features you requested), legitimate interests (security, fraud prevention, diagnostics), consent (camera, microphone, location, notifications), and legal obligations.

8.2 Residents of California (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in Section 2 for the purposes described in Section 3. We have not sold or shared personal information for cross-context behavioral advertising, and we do not knowingly collect personal information from minors under 16. You have the right to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. To exercise them, contact Komail.ali1@yahoo.com.

8.3 Other regions

Residents of other jurisdictions (including Canada, Brazil, and Australia) have substantially similar rights and may contact us using the same email.

9. International data transfers

Firebase and Google Cloud may process data in countries other than your own, including the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and Google's data-processing terms.

10. Security

We use TLS for data in transit, encryption at rest on Google Cloud, per-user Firestore and Storage security rules, and authentication tokens scoped to the signed-in user. No system is perfectly secure; if we become aware of a breach that affects your data, we will notify you and the appropriate authorities as required by law.

11. Third-party services

The App relies on the following third-party services. Their privacy policies govern their handling of your data:

• Apple — Sign in with Apple, Push Notifications, Speech Recognition, and iCloud / CloudKit, which stores shared trip albums: apple.com/legal/privacy
• Google (Firebase / Google Cloud) — Authentication, database, storage, functions, messaging: firebase.google.com/support/privacy and policies.google.com/privacy
• Anthropic, PBC — AI processing for certain in-app features (primarily Dyced Pro): anthropic.com/legal/privacy
• Exchange-rate providers — when the App converts a foreign-currency expense it requests published reference rates directly from your device from open.er-api.com (exchangerate-api.com) and api.frankfurter.app (frankfurter.dev). Only the currency codes are sent — never an amount, an expense, or an account identifier — but because the request is made by your device, your IP address is visible to those services.
• aviationstack — flight status lookups (airline, flight number and date only; no account identifier is sent): aviationstack.com/privacy
• Your email provider (only if you connect a mailbox — Gmail, Outlook / Hotmail, Yahoo Mail, iCloud Mail, AOL Mail, or a custom IMAP server) — your device connects to it directly over IMAP using an app-specific password held in your device Keychain. We are not a party to that connection and never receive your mail credential; your provider's own privacy policy governs your mailbox.

12. Tracking

Dyced does not track you across apps or websites owned by other companies, and does not use the iOS Advertising Identifier (IDFA). The App's NSPrivacyTracking flag is set to false.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you in the App or by email before the change takes effect. Your continued use of the App after the change becomes effective constitutes acceptance of the updated Policy.

14. Contact

If you have questions, requests, or complaints regarding this Policy or your personal data, contact:

Ghulam Ali
Email: Komail.ali1@yahoo.com

We will respond within 30 days, or sooner where required by law.