Privacy policy

Effective 25 September 2026 · Updated 30 October 2026 · Applies to the Fullgrove app (盛林記帳 in Taiwan) for iPhone, iPad and Apple Watch, to the Android app in testing, and to fullgrove.com

1. Who we are
2. What stays on your device
3. What leaves your device
4. Anonymous usage
5. Statement passwords
6. What we never do
7. This website
8. Children
9. Keeping and deleting data
10. Your rights
11. Fullgrove for Android
12. Changes and contact

1. Who we are

Fullgrove (fullgrove.com) is based in Taiwan. We are responsible for the personal data described in this policy. You can reach us at hello@fullgrove.com.

2. What stays on your device

Everything you put into Fullgrove is stored and processed on your own device:

• ledger rows, amounts, merchants, categories, notes, budgets, goals and account names;
• the evidence behind each row: statements, bank files, receipts, e-invoices, payment screenshots and photos;
• home inventory, shopping lists and reminders;
• statement passwords (see section 5).

Reading PDFs, recognising text in photos, categorising and matching rows all happen on the device. On-device Apple Intelligence models also run on the device. Share sheet, widgets, Shortcuts and other extensions only hand files to the app; the app does the reading itself when you open it.

When you export a CSV, an archive or an encrypted backup, you choose where it is saved. If you save it to a cloud service, that service's terms apply to the copy.

3. What leaves your device

These are the only exceptions. Each connection is written to Settings › Network log.

No account

Fullgrove has no sign-in. There is no account, so nothing you do in the app is tied to your name, email or Apple ID.

Apple Private Cloud Compute

Some features can use a larger Apple model on Apple Private Cloud Compute. It is on for Premium and can be turned off in Settings › Assistant. Each request contains only what that task needs, Apple does not store it, and each one appears in the network log. Numbers the assistant shows always come from calculations made on your device.

Purchases

Subscriptions and the lifetime purchase are sold by Apple through the App Store. We never see your payment details. From version 1.0.3 the app checks which plan you have on the device with Apple's StoreKit, and no other purchase service is involved. While anonymous usage reports are on, three of the events in section 4 record which kind of plan was chosen and how the purchase ended. They carry no price and no receipt.

Versions before 1.0.3 used RevenueCat to confirm which plan you have. RevenueCat received App Store transaction details and a random anonymous id. That id was not linked to the anonymous usage id, and RevenueCat received no ledger data.

In-app payment pages

For scheduled payments, Fullgrove can open a short list of official utility, telecom and government payment pages inside the app: Taipower e-bill, Taiwan Water, Taipei Water, Taipei Gas, Shin Shin Gas, Shin Hai Gas, Chunghwa Telecom, Taiwan Mobile, Far EasTone and the Ministry of Finance tax payment site. Bank sites are never opened in the app.

• The browser session is temporary. Cookies and site data are removed when you close it.
• Fullgrove injects no scripts and reads nothing from the page or its forms. It stores no passwords.
• The address bar is always visible, so you can see which site you are on.
• A capture happens only when you tap “Capture” (擷取). The capture is saved on your device as evidence for that payment.

The site you open receives your visit as it would in any browser, and its own privacy policy applies.

4. Anonymous usage

“Share anonymous usage” is one switch in Settings › Privacy and security, and you can turn it off at any time. In versions before 1.0.2 it is off until you turn it on. From version 1.0.2 it is on by default: the setup screens show the switch, and anyone who updates is shown a notice with the choice to keep it on or turn it off. Nothing is sent before you have seen that switch or notice.

What is sent says how the app is used and where it fails: which screens and features were opened, how far setup went, whether an import or a purchase finished, and crash reports. Every value comes from a fixed list checked by tests, and counts are sent as ranges such as “11–100”. The app lists what it sends in Settings › Privacy and security › “Exactly what is shared”.

Events never contain amounts, merchants, notes, categories you named, account names, dates of your transactions or your location.

• Identifiers. Mixpanel uses a random id created for each install. Crashlytics uses its own installation id. No advertising identifier (IDFA) is collected.
• Location. Mixpanel's IP-based location is turned off, and Fullgrove includes no Google Analytics, so no region is worked out from your IP address.
• Crash reports. Firebase Crashlytics sends crash reports under the same setting.
• Advertising. Fullgrove shows no ads and does not track you across apps or websites.
• Turning it off stops sending immediately and resets the Mixpanel id on the device.

Mixpanel stores data in the EU. Firebase Crashlytics may process crash reports in the United States and other countries where Google operates.

5. Statement passwords

Passwords for locked statement PDFs are stored only in your device's Keychain. They are available only while a device passcode is set, never leave that device, and need Face ID or Touch ID each time. If your enrolled biometrics change, the saved passwords can no longer be read and you enter them again. Passwords are never logged, synced, exported or sent to any model.

6. What we never do

• Log in to your bank or ask for online banking credentials.
• Read other apps or your screen on our own. Fullgrove reads a screenshot or a screen recording only when you share it or start it yourself, after the app has told you what it will read and you have agreed.
• Open bank websites inside Fullgrove.
• Send ledger rows, evidence, amounts, merchants or passwords to analytics or crash reports.
• Sell or rent personal data, show ads or track you across apps and websites.

7. This website

fullgrove.com counts its visits with Google Analytics. For each page you open, Google receives the page's address and the page you came from, your browser, device type, screen size and language, how far you scrolled, which links you followed off the site or to a file, and whether you started or sent a form. It does not receive what you type into a form. Two cookies of this site, _ga and _ga_RHJT43FQZC, hold a random id so that a return visit counts as the same visitor; they expire 13 months after your last visit. Google works out the country, region and city from your IP address and does not store the address. Google signals, advertising features and ad personalisation are off, so your visits are not linked to a Google account or used for ads. Google Analytics may process data in the United States and other countries where Google operates.

The site does not load Google Analytics when your browser sends Global Privacy Control or Do Not Track, or when your device is set to a time zone in Europe. When Google places a visit in the European Economic Area, the United Kingdom or Switzerland, Google Analytics stores no cookie.

Apart from Google Analytics, the site loads no third-party resources except Cloudflare Turnstile on the two pages with a form. The calculators at fullgrove.com/tools run a script of ours on your device and send nothing. Our web host may keep standard request logs for security and reliability.

The beta sign-up page at fullgrove.com/get runs the form's script and loads Cloudflare Turnstile, which checks that a person is filling in the form. If you join the list, we keep your email address, the phone platform you chose, the page language, the country our host reports for your connection, and the campaign link you arrived from. We do not keep your IP address. The list is stored with Cloudflare, and iPhone invites are sent through Apple's TestFlight.

We use the email address only to send the beta invite and launch news. To be removed from the list, write to hello@fullgrove.com.

The student page at fullgrove.com/student works the same way, with the form's script and Cloudflare Turnstile. If you enter an email there, we keep the address, whether its domain is an academic one, the page language, the country our host reports for your connection, and the campaign link you arrived from. We do not keep your IP address. We use the address only to check that it is academic and to send your one-time code. To be removed from the list, write to hello@fullgrove.com.

8. Children

Fullgrove is meant for adults managing a household. It can keep a child's ledger, which a parent sets up and which stays on the parent's device like the rest of the ledger. We do not knowingly collect personal data from children. If you believe we hold personal data about a child, contact us and we will delete it.

9. Keeping and deleting data

• Ledger and evidence: deleting the app deletes them from that device. Delete any exports or backups you saved elsewhere yourself.
• Anonymous usage: turn it off in Settings › Privacy and security. Events and crash reports already sent are kept by Mixpanel and Firebase Crashlytics under our project's retention settings. Because they carry only a random install id, we cannot find them by your name.
• This website: Google Analytics keeps the events of a visit for 2 months, and what is tied to the random id for 14 months after the last visit, and then deletes them. The totals in its reports name no visitor and stay. You can delete the cookies in your browser at any time.

10. Your rights

Depending on where you live, including under Taiwan's Personal Data Protection Act and the EU General Data Protection Regulation, you may ask to access, correct or delete personal data we hold, or object to its use. Most of your data never reaches us, and you can see and delete it in the app. For anything else, write to hello@fullgrove.com. You can also complain to your local data protection authority.

11. Fullgrove for Android

The Android app is in testing. Sections 2 to 5 describe the app on Apple devices. This section says what the Android app does in their place. Sections 6 to 10 apply to both.

What stays on the phone

• The ledger: every row with its amount, shop, category and note.
• The evidence behind each row: the text of an alert, the receipt, statement or file you opened, and the lines read from it.
• The cards worked out from your own statements.

The ledger is left out of Google's cloud backup. It can move to a new phone by cable or Wi-Fi when Android transfers your data. A password for a locked PDF is used for that one read and is not kept. The Android app has no account and no sign-in.

Bank and card alerts

Notification access is a permission you grant in Android's settings. With it, Fullgrove reads alerts from the apps you switch on inside Fullgrove and from no other app. Only alerts that say money moved become rows. Verification codes, marketing messages and declined charges are ignored and not stored. The text is read on the phone and kept beside the row so you can check it. Fullgrove does not ask for permission to read SMS.

The cloud reader

When the rules on the phone cannot read a bill, a statement or an invoice, you can hand its text to a language model. The reader is off until you send a document yourself, and each time you see the exact text before it goes.

• What is sent. Text only, never the picture or the file. Card and account numbers are cut to their last four digits. Names, addresses, phone numbers, email addresses and ID numbers are masked. A name with no title or label beside it cannot be recognised, so read the text before you send it.
• Where it goes. The text is encrypted on the phone for a relay that Fullgrove runs on Cloudflare, in addition to the HTTPS connection. The relay passes it through OpenRouter to a language model. Each request requires hosts that keep no copy of the text and do not train on it.
• What the relay keeps. No text and no copy of the answer. It keeps counters: how many requests a random id has made today, how many were made in total, and what the day and the month have cost. Its log holds the model that answered, the size of the request and its cost.
• The random id. It is made when you turn the reader on and thrown away when you turn it off. It is not tied to you, an account or the phone.
• Limits. The reader has a daily limit for each phone and a daily and monthly ceiling for everyone together. When one is reached, the reader stops until the next day or month and the app says so. Where Google Play sells Premium, the reader takes three documents a month without it.
• The answer. Every amount, date and card ending in it is checked on the phone against the text you sent. Anything that is not in the text is dropped.

Cloudflare, OpenRouter and the model host handle the request under their own terms and can see the connection it arrives on, as any service does. Turn the reader off in Settings in the app.

Anonymous usage

The Android app has the switch “Share anonymous usage”, and it is on by default. The setup screens show the switch on the page “Your money stays with you”, and nothing is sent before you have seen it. After setup the switch is in Settings › Privacy, where you can turn it off at any time. If you tap “Skip setup” before reaching that page, nothing is sent until you open Settings › Privacy, where the switch is.

• What is sent. Eleven kinds of event that say how the app is used: which screens were opened, how far setup went, whether the Premium page was shown, which plan was picked and how a purchase ended, whether an import finished or failed, and how far the alert setup came. Every value comes from a fixed list, and counts are sent as ranges such as “11–100”. Settings › Privacy › “Exactly what is shared” lists every event name, field name and value.
• What is never in an event. Amounts, shops, notes, account names and dates from your ledger, the text of an alert or a document, and what you chose on the setup page “Which of these sound like you?”.
• Where it goes. Events go to Mixpanel, which stores them in the EU (api-eu.mixpanel.com), under a random id that Mixpanel's software creates for the install, and the same events go to Google Analytics for Firebase under its own app instance id. The app has no account and attaches no user id. Mixpanel's automatic events and Google Analytics' automatic screen reports are turned off.
• Device details. Mixpanel's software adds these to every event by itself: the phone's manufacturer, brand and model, the Android version, the screen size and density, the app version and build number, the name of the mobile carrier, whether the phone is on Wi-Fi, whether it has NFC and telephony, and its Bluetooth version.
• Location. Mixpanel's IP-based location is turned off. Google Analytics works out the country and region from the connection's IP address; it does not keep the address.
• Crash reports. Crash reports go to Google Firebase Crashlytics under the same switch. Crashlytics uses its own installation id.
• Purchases next to usage. While the switch is on, Adapty is given the Mixpanel id and the Google Analytics app instance id, so that a trial, a purchase or a renewal appears in Mixpanel and Google Analytics under the same install as the setup and Premium-page events. It carries no amount from your ledger.
• Advertising. The app shows no ads and collects no advertising ID. The permission to read one is removed from the app.
• Turning it off stops sending at once and resets the Mixpanel id and the Google Analytics data on the phone.

Google Analytics for Firebase and Firebase Crashlytics may process data in the United States and other countries where Google operates. Section 9 says how events and crash reports already sent are kept.

Purchases

Premium on Android is sold by Google Play as a yearly or monthly subscription or a one-time purchase. Google handles the payment, and we never see your payment details. We use Adapty (adapty.io) to confirm which plan an install has and to show the plans on sale. When the app starts, and when you buy or restore, Adapty receives the Google Play purchase, a random id it creates for the install, and the phone's model, Android version, app version, language and time zone. Adapty's collection of IP addresses and advertising IDs is turned off, and it receives nothing from your ledger. A plan bought on Google Play does not unlock the iPhone app, and a plan bought on the App Store does not unlock the Android app.

Google's software in the app

• Text in pictures is recognised on the phone by Google ML Kit. ML Kit sends Google diagnostic figures about itself: the phone model, the app version, how long recognition took and whether it failed. It does not send the picture or the text.
• The text recogniser itself is delivered by Google Play services, which downloads it once after the app is installed. Your pictures are not part of that download.
• The receipt scanner is shown by Google Play services, which downloads it once. The scanned page is handed to Fullgrove on the phone.

Pages opened inside the app

This policy, the terms and the support page open inside Fullgrove from fullgrove.com. The address stays visible, scripts are off, and no cookies or site data are kept. Before anything opens outside Fullgrove (Android's settings, the phone's browser or the camera app), the app asks first.

What the Android app does not have

No advertising and no advertising ID. It has no network log yet. If either changes, this section will say so before the version that changes it is released.

12. Changes and contact

If this policy changes, we will post the new version here with a new effective date. Questions go to hello@fullgrove.com.

Fullgrove (fullgrove.com), Taiwan.