Privacy notice for the app and account

This translation is for your information. Only the German version is legally binding. Go to the German version

Last updated: 19 October 2026

This notice covers the Buchlio app and the Buchlio account. For the website, the website privacy policy applies.

1. What this is about

This notice applies to the Buchlio app (macOS, Windows, iOS, Android), the Buchlio account and the account portal at account.buchlio.de. Buchlio works locally: receipts, invoices (Rechnung), payments, contacts, text recognition and reports stay on your device and, if you set it up, in your own cloud storage. Buchlio does not receive this bookkeeping data.

2. Controller

PikCode, Mikayil Gacek (Einzelunternehmer)
Mühlstr. 32, 65760 Eschborn, Deutschland
Contact: support@buchlio.de or the contact form.

No data protection officer has been appointed.

3. What stays on your device

• Workspace: App data and original files are stored in your workspace, by default in the “Buchlio” folder in your Documents. Text recognition runs on the device. There is no transfer to external AI services. On computers, Buchlio places the file .buchlio-computer in the workspace. It contains only a hash value (SHA-256) of the operating system’s device identifier, neither the identifier itself nor a computer or user name. This lets Buchlio recognise at first start whether this computer last opened the workspace, and it does not open another computer’s database without asking. The file is part of neither backups nor the Cloud Vault; it only leaves the device if a cloud service of your choice syncs the folder.
• Credentials: Sign-in and OAuth tokens as well as mail, app and WebDAV passwords are stored encrypted in a file in the app configuration folder. The key to them is kept in the operating system’s key store (Keychain, Credential Manager, Keystore). They never get into the workspace, backups or the Cloud Vault.
• Language: The language you choose for the app is stored in a file in this device’s app configuration folder. It never gets into the workspace, backups or the Cloud Vault; each device has its own.
• Folder access (Mac App Store): The Mac App Store version may only use folders that you select yourself. For your workspace and a folder Vault, it remembers the access as a macOS bookmark in the app container. The bookmarks apply only on this Mac and never get into backups, exports or the Cloud Vault.
• Unsaved entries: If you switch to another app with unsaved changes in an editor, Buchlio places a copy of them in the local app storage so that you can restore them after the system has closed the app. Credentials are never included. The copy is deleted when you save, discard or close, and it does not leave the device.
• Bank statements: If you choose “Reconcile bank statement” in Due dates, the app reads the export file of your online banking that you chose (CAMT/XML, also as ZIP, or CSV) exclusively on your device. Neither the file nor the transactions it contains (date, amount, name, payment reference, account IBAN) are saved, synced or transferred to Buchlio or third parties; the app does not connect to your bank. Only payments that you expressly accept are saved by Buchlio like any recorded payment (date, amount, bookkeeping account) and synced through your Vault.
• Recipients of gifts to business contacts: In the “Business gifts” category, you enter the names of the people who received gifts. Tax law requires this record (§ 4 Abs. 7 EStG), and only this way can Buchlio check the €50 limit per person and Wirtschaftsjahr (fiscal year; § 4 Abs. 5 S. 1 Nr. 1 EStG). Buchlio stores the names like all other receipt data in your workspace and, if you have connected a Cloud Vault, in your own cloud storage (section 8). They appear in your exports (receipt CSV, accounting package) and never reach Buchlio or the account service. The same retention and deletion rules apply to them as to the receipt.
• Contact persons of invoice recipients: For invoices, credit notes (Gutschrift), quotes (Angebot), order confirmations (Auftragsbestätigung) and contacts, you can optionally enter a contact person. Buchlio prints them in the address field below the company and transfers them as the buyer’s contact into the e-invoice (E-Rechnung; XRechnung, ZUGFeRD) that you send to the recipient. They are stored like the other invoice and master data in your workspace and, if you have connected a Cloud Vault, in your own cloud storage (section 8), and never reach Buchlio or the account service. The same retention and deletion rules apply to them as to the invoice or the contact.
• No analysis by Buchlio: The app contains no advertising or crash reporting services and sends no usage or bookkeeping data to Buchlio. Automatically, it only queries the sign-in and subscription status from the account service (section 4), in the store versions the subscription status from RevenueCat (section 5), and whether a new version has been released: in the website version in the update feed, in the App Store versions from Apple (section 10). On Android, Google’s text recognition sends diagnostic and usage data to Google (section 10). Otherwise, diagnostic data only leaves the device if you expressly send a bug report (section 6).
• Permissions: The app only uses the camera and the photo library when you photograph a receipt, select an image or save a receipt image to your photos yourself. It only reaches devices on the local network if you set up a WebDAV or mail server there. It only reads files that you select, drag in or open with Buchlio. Notifications only appear if you allow them.
• Deletion: You remove data in the app (bin with adjustable retention; it keeps filed, paid or exported receipts until the end of their statutory retention period, 8 years after the end of the receipt’s year) or delete the workspace folder. You can permanently delete a contact that no receipt, invoice or quote refers to, for example at the contact’s request: Buchlio removes it, including its earlier versions, on this device, in your Cloud Vault and on your other devices at the next sync. Backups that you created beforehand still contain it until you delete them. Contacts with receipts can only be archived because of the retention obligation.

4. Buchlio account

Without signing in, the app opens your workspace read-only. To create and change data, you sign in with a Buchlio account, with a code sent to your email address, with Google, with Apple or with a passkey that you have added in the account portal. Sign-in happens in the browser; the app then receives a session token.

• Data processed:
  • Email address and internal account ID.
  • With Google or Apple, the identifier of the provider account as well as the name transmitted and, if applicable, the address of the profile picture, with Apple possibly a relay address.
  • Your name if you enter it in the account portal; you can change or remove it there at any time.
  • Provider tokens, stored encrypted.
  • Sessions with IP address and browser or app identifier (user agent).
  • Approvals of new devices.
  • Optionally, two-factor authentication: secret and recovery codes, encrypted.
  • Optionally, passkeys: public key, passkey identifier, signature counter, whether it is synced, supported transports, time it was added and the identifier of the authenticator model, from which the name of your password manager may be shown. Face ID, fingerprint or device PIN are checked by your device alone; Buchlio receives nothing of this.
• Sign-in codes and passkey requests: Sign-in codes are only stored as a hash and expire after five minutes. A request to add or use a passkey is also valid for at most five minutes; when adding, it contains the account ID and email address. To protect against abuse, the service counts requests per address (via a hash computed with a secret key) and per IP address in short time windows.
• In the browser: The account portal only sets technically necessary cookies for sign-in and session. During sign-in with a code, the browser tab remembers the email address entered (sessionStorage) so that reloading does not interrupt the process; it is deleted after sign-in or when the tab is closed. If the account deletion requires signing in again, the tab remembers this in the same way until the deletion opens again afterwards.
• Offline proof: A signed proof confirms write access without internet for at most seven days. It contains the internal account ID, the subscription status that decides on write access and, if set, the minimum version of the app, but no email address. It stays on the device.
• Purpose and legal basis: Providing the account and your access to the app (Art. 6(1)(b) GDPR); protection against abuse and security of the service (Art. 6(1)(f) GDPR).
• Storage period:
  • Account data until the account is deleted, passkeys until you remove them. A removed passkey stays in your password manager until you delete it there.
  • Sessions are valid for at most 30 days after the last use; signing out ends them immediately. The account service deletes expired sessions and sign-in codes automatically.
  • Counter values for abuse protection only apply to time windows of a few minutes.
  • Backups of the account database (daily and before every update) remain on the account service’s server for 15 days and are then deleted.
• Language: With every request, the app tells the account service its language (Accept-Language) and includes it in links to the account portal; otherwise, the account portal uses your browser’s language. The account service replies and sends sign-in codes in this language and does not store it.
• Operating logs: The account service logs errors only with the error class and route, without contents, email addresses or tokens.

Sign-in with Google or Apple

If you choose Google or Apple, you sign in directly with the provider. The provider transmits your account identifier, email address and, if applicable, name to Buchlio. Google and Apple process data under their own responsibility. You remove the connection in the account portal (at least one sign-in method remains) or with the provider itself.

Deleting your account

In the app under Settings › Account & subscription › “Delete account” or in the browser in the account portal at account.buchlio.de/account, you delete your account after confirmation; if you signed in there more than ten minutes ago, you sign in again first. Without the app and the account portal, an email to support@buchlio.de from your account’s address is sufficient. The following then happens:

• All sessions and device approvals end.
• A website subscription is cancelled immediately; this does not come with a refund.
• You receive a confirmation by email.
• The approval at Apple is revoked. Buchlio removes the link with Google; you can remove the “Buchlio” entry among the third-party apps of your Google Account there yourself.
• Your data is deleted at RevenueCat, and your customer account at Paddle is archived.
• After that, the account and sign-in data are removed; they disappear from the database backups when these are deleted after 15 days.

You cancel subscriptions via the App Store or Google Play there yourself. Your local bookkeeping and your Cloud Vault remain unaffected. Invoice and payment records that Paddle must retain as the seller remain there.

5. Subscriptions

• Purchase via the website: The seller is Paddle (Paddle.com Market Ltd., United Kingdom) as your contractual partner for the purchase (reseller and merchant of record). Paddle processes payment, invoice and tax data under its own responsibility (Paddle’s privacy policy). The account service creates your customer account at Paddle with the email address of your Buchlio account and the internal account ID. Buchlio receives customer and transaction identifiers and the subscription status, no payment data. To pay, the account portal forwards you to the payment page buchlio.de/kaufen (in the other languages with the language code in front, such as buchlio.de/en/kaufen). It loads the checkout script Paddle.js and opens Paddle’s checkout in it; the account portal itself does not embed any script from Paddle.
• Purchase in the apps: Subscriptions via the App Store or Google Play are handled by Apple or Google respectively, which act under their own responsibility.
• Subscription status: RevenueCat (RevenueCat, Inc., USA) assigns purchases and subscription status to your Buchlio account via the internal account ID. In the process, the internal account ID and purchase data are transmitted to the USA. So that Buchlio can find you for questions about your subscription, the account service also transmits the email address of your account and your name, if known (transmitted by Apple or Google or entered in the account portal), with every sign-in and subscription status query, even while you have no subscription. RevenueCat acts as a processor on our instructions; the transfer to the USA is safeguarded by the EU standard contractual clauses (Art. 46(2)(c) GDPR). For this, the store versions connect directly from the app to RevenueCat and transmit the internal account ID, the store’s purchase receipts and technical details such as app and system version, language, store country and IP address. Buchlio passes no further attributes or advertising identifiers to RevenueCat.
• Stored subscription status: The account service stores the last confirmed active subscription status (status, expiry date, store, renewal, payment problem, trial, time of the check). If RevenueCat or Paddle are temporarily unreachable, this status continues to apply until the end of the term so that your write access is not interrupted. It is deleted as soon as an inactive subscription is confirmed, at the latest when your account is deleted.
• Legal basis: Performance of the contract (Art. 6(1)(b) GDPR); for the email address and name at RevenueCat, our legitimate interest in quickly assigning subscription queries to your account (Art. 6(1)(f) GDPR). Retention under tax and commercial law at the respective seller (Art. 6(1)(c) GDPR).

6. Support

You expressly send bug reports and feature requests in the app. The following is transferred:

• your message and the type of request;
• the account ID and your account email address for the reply;
• the app’s language, so that the reply can take it into account;
• with a bug report, and only if you agree, a diagnostic attachment shown to you beforehand.

The attachment contains versions, platform, summarised details on the data and sync status, the text recognition used and up to ten diagnostic codes. It contains no receipts, texts from documents, credentials, file names or paths.

The request is delivered by email to the support mailbox. The legal basis is handling your request (Art. 6(1)(b) and (f) GDPR). We keep requests for as long as they are needed to handle them and to keep them traceable; statutory retention obligations remain unaffected.

7. Hosting and email sending

• Server: The account service runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany.
• Emails: Sign-in codes and confirmations are sent via the mail hosting of Hetzner Online GmbH.

8. Your own cloud storage

If you connect a Cloud Vault, the app transfers your bookkeeping data directly to the provider you chose. Buchlio does not receive this data.

• iCloud Drive (Apple, only on Apple devices): Buchlio’s container in your iCloud Drive.
• Google Drive: only Buchlio’s hidden app data area (drive.appdata). No access to your other files.
• Dropbox: only Buchlio’s app folder.
• Nextcloud/WebDAV: the folder you chose on your own server.
• Synced folder: a folder on your device that a service of your choice syncs.

For these transfers, the providers are responsible towards you in their role; their privacy policies apply. The legal basis for use in the app is Art. 6(1)(b) GDPR.

When you disconnect, the app removes its sign-in from your device. With Dropbox, it also revokes the approval. The data at the provider remains until you delete it there. With Google Drive, you do this under “Manage apps” via “Delete hidden app data”.

9. Your own email mailboxes

You connect mailboxes directly from the app: via IMAP/SMTP with TLS or by signing in with Microsoft 365 or Outlook. Messages and attachments are checked on your device; the account service is not involved.

• Gmail and Google Workspace: The app connects new Gmail accounts directly to Google’s IMAP and SMTP servers (imap.gmail.com, smtp.gmail.com), signed in with your email address and an app password that you generate at Google. The app password is stored encrypted on your device (section 3). The app now only uses sign-in with Google (OAuth) for mailboxes in the case of Gmail accounts that are already connected this way; it also uses it to connect the Google Drive Vault (section 8). For these Gmail accounts, the following still applies: read access only (gmail.readonly), and the send permission (gmail.send) only if you have turned on sending.
• Microsoft 365 and Outlook: When you sign in, Buchlio only requests read access (Mail.Read). The send permission (Mail.Send) is only added if you turn on sending.

Buchlio only sends emails after your confirmation.

Only what is recognised as an invoice is saved: the app imports attachments and invoice emails as receipts into your workspace and, if set up, into your Cloud Vault. For the next fetch, it remembers the fetch status and the identifiers of messages already imported. For emails from which it imported receipts, and for bounces and replies to emails you sent with Buchlio, it keeps a fetch log on your device with sender, subject, date and file names, at most 200 entries. It is stored in the local settings and in your backups, not in the Cloud Vault. It does not save other messages.

The app recognises bounces and replies only by the headers (Message-ID, In-Reply-To, References) and by the delivery report, never by the text: a bounce notes “Undeliverable” on the sent document with the reason from the report, and a reply notes its date. For every sending, the document also stores the recipient address. Both get into your Cloud Vault with the document. If you disconnect a mailbox, the app removes its credentials from your device; imported receipts remain until you delete them. You revoke an app password yourself at the provider, for Gmail under “App passwords” in your Google Account. For a Gmail account connected by Google sign-in, the app on macOS and Windows also revokes the approval, provided Buchlio no longer uses it for any other Gmail account or Google Drive; otherwise, you revoke it in your Google Account.

Google API data: The use and transfer of information that the app receives from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Buchlio uses this data exclusively to recognise invoices on your device and to send them at your request. It does not go to Buchlio servers or third parties and is not used for advertising or to train AI models. The app stores invoices imported as receipts only in your workspace and in the cloud storage that you connected yourself.

10. Other connections of the app

• Exchange rates: For foreign currencies, the app retrieves ECB reference rates from the European Central Bank (data-api.ecb.europa.eu). The currency and the date or month are transmitted; the ECB sees your IP address in the process.
• Mail setup: When you set up a mailbox, the app searches for suitable server settings for your mail domain. For this, it queries your provider’s autoconfiguration, Thunderbird’s public database (autoconfig.thunderbird.net) and DNS. Only the domain is transmitted, no password.
• Updates: At start and every six hours after that, the app asks whether a new version has been released and announces it in the notifications: the macOS version downloaded from buchlio.de in the update feed on buchlio.de, which involves the usual connection data such as the IP address (website privacy policy), and the App Store versions via the public query of Apple (Apple Inc., USA; itunes.apple.com), where only the app’s identifier and the usual connection data such as the IP address go to Apple (Apple’s privacy policy). Store versions can only be installed via the respective store. If your Cloud Vault reports a newer format than the app knows, it checks at most every four hours whether an update is available and then requires it. The legal basis is our legitimate interest in an up-to-date app and a working sync between your devices (Art. 6(1)(f) GDPR).
• Text recognition on Android: Android devices recognise text with Google ML Kit (Google LLC, USA). Recognition runs on the device; images and recognised texts are not transferred. However, ML Kit sends diagnostic and usage data to Google: device details (manufacturer, model, operating system version), the app’s package name and version, a per-installation identifier that is not intended to uniquely identify you or your device, as well as run times, configuration, size of inputs and outputs and error codes. According to its own information, Google uses this data for diagnostics and usage analysis, transfers it encrypted and does not pass it on to third parties (ML Kit: data disclosure). Data may be transferred to the USA in the process. The legal basis is our legitimate interest in reliable text recognition on the device (Art. 6(1)(f) GDPR).
• Sharing: Via the system’s share dialog, the app only passes files to the chosen app after your selection.

11. Your rights

Under the statutory conditions, you have the right to access, rectification, erasure, restriction of processing and data portability. Where we rely on legitimate interests, you can object on grounds relating to your particular situation. To do so, use the contact details in section 2.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).

No automated individual decision-making, including profiling, takes place.

12. Changes

If features, providers or periods change, we adapt this notice. The date at the top shows the current version.