Privacy Policy

Last updated 9 November 2026

Before BillMunch opens to the public we'll add the registered name and address of the business that runs it. Everything else here describes the app as it works today.

BillMunch is a bills and budget app for households in the Philippines. This policy explains what personal information we collect, why, who sees it, how long we keep it and what you can do about it. It follows the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the rules of the National Privacy Commission (NPC).

The short version

We collect only what the app needs: who you are (name, email, photo) and the household records you choose to enter.
Only the people in your household can see your household's records. We don't sell your data, show ads or use tracking cookies.
You can download everything or delete your account yourself, in Settings, at any time.

Who is responsible for your data

BillMunch is the personal information controller for the data in the app. Our Data Protection Officer handles every privacy question and request. You can reach them at hello@billmunch.app (please put “Privacy” in the subject).

What we collect

From Google, if you sign in with Google: your name, email address, whether Google has verified that email, and the link to your Google profile photo. We never see your Google password or anything else in your Google account.
If you sign in with an email code: your email address, and the name you type in. Each code is stored scrambled (hashed), together with a scrambled copy of the network (IP) address that asked for it, so we can stop people from flooding an inbox.
What you enter about your household: bills and payments, expenses, money in, budgets, payment method names (such as “BPI Gold”) and credit limits, savings goals, categories, notes, the household's currency, and who added or paid each item.
A profile photo, if you upload one. It's shrunk to a small square on your device before it's sent.
Invites: who made each invite link and when it expires. The link itself is stored only as a scrambled fingerprint.
Your plan: whether your household is on Free or Pro, and when a trial started and ends.
Technical data: to keep the service running and safe, our hosting provider briefly records requests to our server, such as the time, the page or action, your IP address and your browser type.

We never ask for card numbers, PINs, passwords or bank logins, and you shouldn't type them in anywhere in BillMunch.

Sensitive details. BillMunch doesn't ask for sensitive personal information as the law defines it (such as health, government ID numbers, religion, age or marital status). But what you choose to record can sometimes reveal it, for example a bill from a hospital or a note about medicine. If you enter details like these, you consent to us storing them only to show them to your household, and you can edit or delete them at any time.

Why we use it, and on what basis

To give you the app you signed up for (Section 12(b) of the Data Privacy Act, to fulfil our agreement with you): your account, your household, signing in, sharing records with the people you invite, your plan and its limits.
To keep BillMunch secure and fair (Section 12(f), our legitimate interest): rate limits on sign-in codes, blocking abuse, and making sure each person and email gets only one free Pro trial.
To follow the law (Section 12(c)), for example if a court or the NPC lawfully asks us.
With your consent (Sections 12(a) and 13(a)) for anything optional, such as uploading a photo, and for any sensitive details you choose to enter.

We don't use your data for advertising, we don't sell or rent it, and we don't make automated decisions about you that have legal or similar effects. We don't read your records except when you ask us to help with a problem, or when the law requires it.

Who can see it

Your household. Everyone in your household sees the household's records, each member's name, email and photo, and who added or paid each item. Only invite people you trust.
Nobody else in BillMunch. Every request to our server is limited to the signed-in person's own household.
Our service providers, who process data only on our instructions and under their own data protection terms:
- Cloudflare, Inc. hosts the app and its database (Cloudflare Workers and D1), and protects it from attacks.
- Resend, Inc. sends our emails: sign-in codes, and notices when a way to sign in is added or removed or your account is deleted. It receives your email address and the message.
- Google LLC handles “Sign in with Google”. Your profile photo from Google loads from Google's servers.
Exchange rates come from public rate services (Frankfurter and ExchangeRate-API). Our server asks them for rates; none of your data is sent.
The law. We only share data with authorities when the law requires it, and we'll tell you unless we're not allowed to.

Where it's kept, and transfers outside the Philippines

Our database is kept in Cloudflare's Asia-Pacific region, and Cloudflare, Resend and Google may process data in other countries, including the United States. Under Section 21 of the Data Privacy Act we stay responsible for your data wherever it's processed, and we only use providers that commit to protecting it with safeguards comparable to Philippine law.

How we protect it

Everything travels over encrypted connections (HTTPS), and data is encrypted at rest by our host.
Sign-in sessions, sign-in codes and invite links are stored only as scrambled fingerprints, so a copy of our database can't be used to sign in.
Sign-in codes expire after 10 minutes, work once and allow only 5 tries. Sign-ins and invites are rate limited.
Every database query is limited to one household, and automated tests check this.
Only the people who run BillMunch can reach the systems, and only to keep them working.

If a breach ever puts your personal information at real risk, we'll tell the National Privacy Commission and you within 72 hours of finding out, as NPC rules require, with what happened and what you can do.

How long we keep it

Your account and household records: for as long as you have an account. Free shows your last 3 months, but older records are kept, not deleted, in case you move to Pro.
When you delete your account: your account and every way you sign in are deleted straight away. If you're alone in your household, the household and all its records are deleted too. If others share it, the shared records stay with them, with your name and email taken off. Deleted data can stay in our host's backups for up to 30 days before it's gone for good.
One thing we keep after deletion: if you had a Pro trial, a one-way scrambled fingerprint of your email address (never the address itself), so the same email doesn't get a second free trial. It can't be turned back into your email.
Sign-in sessions: up to 30 days, or until you sign out. Sign-in codes: 10 minutes, cleared as newer codes are sent. Invite links: 7 days, or until used or cancelled. Technical request logs: a few days.

Cookies and storage on your device

BillMunch uses only the cookies and on-device storage it needs: one to keep you signed in, one to protect the Google sign-in step, and a few small conveniences on your device. No analytics, advertising or tracking cookies.

Our Cookie Policy lists each one, what it's for and how long it lasts.

Your rights under the Data Privacy Act

You have these rights, and you can use most of them yourself in the app:

To be informed about how your data is used. That's this policy, and we'll tell you before anything changes.
To access your data: Settings → Download my data gives you everything in your household, on any plan.
To correct it: edit any record, your name or photo in the app.
To erase or block it: delete any record, or Settings → Delete account to remove your account.
To data portability: the download is a standard JSON file you can take to another service. Pro can also download CSV files for Sheets or Excel.
To object to processing, and to withdraw consent for anything optional, such as your photo, at any time.
To damages if you're harmed by inaccurate, unlawfully obtained or unauthorised use of your data.
To file a complaint with the National Privacy Commission.

For anything you can't do in the app, write to our Data Protection Officer at hello@billmunch.app. We'll answer as soon as we can, and we may ask you to confirm you own the account first. Your rights pass to your lawful heirs and assigns if you pass away or can't act for yourself.

If you're not happy with our answer, you can contact the National Privacy Commission at privacy.gov.ph or info@privacy.gov.ph.

People in your household

When you enter details about someone else, such as a family member's bill, please make sure they're OK with it. People you invite get their own account and can see, download or delete their own data the same way you can.

Children

BillMunch is for adults 18 and over. We don't knowingly collect data from children. If you think a child has an account, tell us and we'll delete it.

Changes to this policy

If this policy changes, we'll update the date above. For important changes, we'll tell you in the app before they take effect.

Back to BillMunch · Terms of Service · Cookie Policy

Secured and protected by Cloudflare