Privacy Policy

Two ways to use Even Stevens

When you first open the app you choose where your receipts live. You can switch later in Settings.

• On this device: no account. Your receipts, photos, splits and the people you add are stored only on your iPhone, and we receive none of it.
• Even Stevens Cloud: you sign in, and your library is stored on our servers so it can back up, sync between your devices and be read for you.

On this device

In this mode the app makes no requests to our servers for your receipts. Cropping, flattening and text detection run on your iPhone.

If you add your own AI service (an OpenAI-compatible provider you choose) to read receipts, the app sends each receipt photo you ask it to read, with instructions, directly from your iPhone to that provider. That provider’s own terms and privacy policy apply, not ours. Your API key is kept in the iOS Keychain on this device only. If you skip this, nothing is sent anywhere and you type the details yourself.

Deleting a receipt or deck in the app removes its files from your iPhone. Deleting the app removes everything.

Even Stevens Cloud: what we store

Sign-in codes and tokens are stored only as one-way hashes. Our hosting provider keeps routine request logs, including IP addresses, for a short time to run and secure the service.

Reading receipts with AI

In Even Stevens Cloud, when a receipt is read for you, its photo is uploaded to our servers and sent to the AI model provider we use (currently OpenAI) together with instructions to extract the merchant, date, items, taxes and totals. The provider processes the photo to return that result to us. We use the provider’s business API, not a consumer chatbot.

The result is saved with your receipt. It can be wrong, so the app always lets you check and correct it.

Contacts and camera

• Contacts: Even Stevens only reads Contacts when you choose someone from iPhone Contacts for a split. It saves that contact’s display name and identifier, never their phone numbers, email or addresses. In Even Stevens Cloud, that name and identifier sync with your list of people.
• Camera and photos: used only when you choose to scan or import a receipt.

Share links and invites

When you create a web share link, we store a snapshot of the split at that moment: its title, merchant, date and currency, each person’s name, items and total, tax, service charge, tip and total, and optionally an image of the split breakdown. A link for one person contains only that person’s part.

• Anyone who has the link can open it, so share it only with the people it is for.
• The page never updates. Later edits are not shown; to send changes you share again.
• Links expire after 30 days, and you can revoke one sooner. Share pages ask search engines not to index them.
• An invite link shows your display name to the person you send it to, and expires after 30 days.

AI assistants you connect (MCP)

You can connect your own AI assistant, such as Claude, ChatGPT or Grok, to your Even Stevens Cloud library. You approve this on our sign-in page (OAuth), or by creating a personal access token in the app. Depending on the access you approve, the assistant can:

• Read your decks, receipts, spending totals and splits;
• Write, if you allow it: save receipts it has read and send receipt images for reading.

What the assistant receives is then handled by its provider under that provider’s privacy policy. You can disconnect an assistant or delete a token in the app at any time; access tokens also expire.

Service providers

We use these providers to run Even Stevens Cloud. They process data only on our instructions.

• Cloudflare: hosting, database, image storage and request logs.
• Our AI model provider (currently OpenAI): reading receipt photos.
• Resend or Postmark: sending sign-in codes by email.
• Apple: Sign in with Apple, App Store purchases and subscriptions. Google: Sign in with Google, if you use it.

These providers may process data outside Hong Kong, including in the United States. We do not sell or rent personal data, and we do not share it for advertising.

How long we keep data, and deleting your account

• We keep your cloud data while your account exists.
• Something you delete is kept as a deletion marker for 30 days so your other devices catch up and you can undo it.
• Delete your account in the app (Settings › Data › Delete account). This deletes your stored images and all account data from our servers, signs out your devices, and revokes Sign in with Apple. Receipts on your iPhone stay there.
• Deleting your account does not cancel an App Store subscription. Cancel it in your Apple ID settings.
• Copies in our hosting provider’s backups are overwritten within about 30 days.

Security

Data is encrypted in transit with HTTPS. Access tokens are short-lived, refresh tokens rotate, and reusing an old one signs out the whole session. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Your choices and rights

You can see, correct, export and delete your data in the app. You can also ask us for a copy of your personal data, or to correct or delete it, by emailing support@evenstevens.app. Depending on where you live, including under Hong Kong’s Personal Data (Privacy) Ordinance and the GDPR, you may have further rights, such as objecting to processing or complaining to a data protection authority.

Children

Even Stevens is not directed at children under 13, and we do not knowingly collect their personal data. If you think a child has given us data, contact us and we will delete it.

Changes and contact

We will update this policy when the app changes, and tell you in the app before a significant change takes effect.

Larches Technologies Limited, Hong Kong · support@evenstevens.app