Privacy

This page covers two things: the Taxfold iPhone app, and this website, taxfold.app. They are different, so we describe them separately. Both are run by Opal Harmony P.C., the company that makes Taxfold, which is the data controller for anything described here.

The app: we collect nothing

The Taxfold app sends us no data. There is no account, no sign-in, no sync server, no bank connection and no analytics or advertising code in the app. The receipts you scan, their photos and everything you type stay in the app’s storage on your iPhone. When the app is listed, its App Store privacy label will read “Data Not Collected”.

• Reading receipts happens on the iPhone, with Apple’s built-in text recognition. The images are not uploaded anywhere.
• Camera and Photos: the app asks for camera access the first time you scan. Importing uses Apple’s photo picker, so the app sees only the photos you choose.
• Exports (CSV or PDF) go only where you send them with the iPhone share sheet.
• Backups: if you back up your iPhone with iCloud Backup or to a computer, the app’s data is part of that backup, held by Apple or on your computer under your control. We have no access to it.
• Apple’s reports: purchases go through Apple. Apple gives developers sales figures and, from people who agree to share them with developers, app usage statistics and crash reports. Apple shares these without telling us who you are.

Because nothing reaches us, deleting the app deletes your Taxfold data from the phone. Export what you want to keep first.

This website: cookieless analytics

“We collect nothing” would not be true of the website, so here is what it does. taxfold.app is hosted on Cloudflare and runs Cloudflare Web Analytics to count visits.

• No cookies. In Cloudflare’s words, Web Analytics “does not use any client-side state, such as cookies or localStorage, to collect usage metrics”, and Cloudflare does not “fingerprint” individuals “via their IP address, User Agent string, or any other data for the purpose of displaying analytics.”
• What it records: page views and visits, the page visited, the referring site, the visitor’s country, device type, browser and operating system, and page-load timing. We see these only as aggregate counts in Cloudflare’s dashboard; we keep no copy of our own. A small script from static.cloudflareinsights.com loads on each page to report them.
• Delivering pages: like any web host, Cloudflare processes your IP address and browser details to serve the site and protect it from abuse. Cloudflare keeps that data under its own privacy policy.
• Search statistics: Google Search Console shows us which searches led to the site, as aggregate numbers from Google. It puts nothing on this site.

The site has no sign-up form, no ads and no other trackers.

Email

If you write to us, we receive your email address and your message, and use them only to reply. Mail to taxfold.app addresses is forwarded through Cloudflare Email Routing to a Gmail inbox, so Google also processes it. We keep a message as long as we need it to deal with what you asked, and delete it when you ask us to.

Legal basis, recipients and your rights

• Legal basis: our legitimate interests (GDPR Article 6(1)(f)) in running, measuring and protecting the website and in answering the messages you send us.
• Recipients: Cloudflare (hosting, analytics, email forwarding) and Google (our email inbox). Both are US companies and may process data outside the EU, under the safeguards they offer, such as the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Your rights: you can ask for access to, correction or deletion of what we hold about you, restrict or object to our use of it, and ask for a copy in a portable format. For the app there is nothing to ask for: the data is on your phone. Write to [email protected].
• Complaints: you can complain to your data protection authority. In Greece that is the Hellenic Data Protection Authority.

Last updated Nov 5, 2026.