Privacy Policy

Effective date: · Version 1.0
Skyline Consulting Co d/b/a ExpenseDuck.com ("ExpenseDuck," "we," "us")

The short version

  • We follow the laws of the United States regarding your privacy. The Service is US-only and for adults 18+.
  • We never sell your data, and we never share your financial, tax, location, or receipt data with anyone for their own purposes. Data goes to the service providers listed below only as needed to run ExpenseDuck for you.
  • We never see or store your bank credentials — bank connections are handled by a dedicated aggregator.
  • Location is collected only if you enable automatic mileage tracking, and only to record your drives.
  • Your data is encrypted in transit and at rest, including backups. We don't store your full credit card number on our servers.
  • You can export everything or delete your account yourself, anytime.
  • We will disclose data if legally required (for example, a subpoena) or to prevent fraud or abuse.
  • Questions: support@expenseduck.com.

By using expenseduck.com, the ExpenseDuck mobile app, and/or an ExpenseDuck account (together, the "Service"), you consent to this Privacy Policy. Definitions from the Terms of Service apply here too.

1. Data we collect

Anonymous visitor data. We collect anonymous data from every visitor of the website to monitor traffic and fix bugs — for example web requests, the data sent in response, IP address, browser type, and page interactions. Cookies must be enabled to use the Service.

Account data. When you register we ask for your name, email address, and the information needed to run the Service for you. Payment is handled by our payment processor; your full card number is never stored on our servers.

Financial account data. When you link a bank or card account, our aggregator (Teller) provides us your transactions and account metadata (institution, account name, balances as applicable). We store an encrypted access token — never your banking username or password, which we never see. This data is used only to provide the Service and is never sold.

Tax profile data. To calculate estimates, you may provide filing status, household W-2 income and withholding, and prior-year tax figures. This is used solely to compute your estimates.

Precise location (only if you enable mileage tracking). With your consent, the mobile app collects background precise location to detect and record drives. Location is used only for mileage features. Raw GPS points are retained approximately 90 days and then purged; only the trip route line and mileage record are kept with your books. You can disable location access anytime in device settings (automatic drive detection stops while disabled). Precise geolocation is treated as sensitive personal information under applicable state privacy laws.

Receipt images and forwarded email. Receipt photos you capture and email receipts you forward are stored and processed to extract the amount, merchant, and date. Images may incidentally contain personal information; they are used only to provide the Service.

Mobile app and device data. Device identifiers, push notification tokens, app diagnostics, and the status of permissions the app uses (location, camera, notifications).

2. How we use your data

To provide the Service: importing and categorizing transactions, recording mileage, extracting receipt data, tracking invoices, calculating federal tax estimates, providing support, securing the Service, and meeting our legal obligations. Your data in the Service is not shared between accounts or with the public.

Automated processing. Transaction categorization, receipt extraction, and tax estimation are automated; receipt extraction uses an AI model running within our cloud environment (Amazon Bedrock, inside AWS). Outputs are shown to you for review and correction; no automated decision produces legal effects about you without your involvement.

3. Sharing and service providers

We share personal data only with the service providers below, only as needed to run ExpenseDuck, under agreements limiting their use of it — or when required by law (for example a subpoena), to prevent fraud or imminent harm, or with your explicit consent. We do not sell or share your personal information as those terms are defined under applicable state privacy laws.

  • Teller — bank/card connections (handles your institution login; provides us transactions — we never see your credentials)
  • Amazon Web Services — hosting, storage, and in-cloud AI receipt extraction (Bedrock)
  • Stripe — subscription payments (receives card and billing details)
  • Twilio — SMS two-factor authentication (receives your phone number)
  • Google — transactional email delivery
  • HelpScout — customer support (receives your name, email, and support conversations)
  • Bento — email communications (receives your name and email)
  • ProfitWell — subscription analytics (receives aggregated billing metrics)
  • Google Analytics and Microsoft Clarity — anonymous, aggregated site usage and diagnostics
  • Ahrefs Web Analytics — cookieless, aggregated marketing-site traffic counts (no cookies, no cross-site tracking)

Content blockers may prevent some analytics/error tools from loading; that's fine with us, though it may limit our ability to diagnose issues you report.

4. Data retention

  • Transactions, mileage records, tax records: retained while your account is active, consistent with tax record-keeping norms.
  • Bank access tokens: until you disconnect the account or delete your account.
  • Raw GPS points: ~90 days, then purged (trip records kept).
  • Receipt images: while your account is active.
  • Backups and logs: encrypted, and rotated on a 90-day schedule.
  • After account deletion, personal data is removed except records we must keep for legal, tax, or fraud-prevention reasons.

5. Your rights: export, deletion, and state privacy rights

Export, always. You can export your data — transactions, mileage, receipts, invoices, reports — anytime, from within the Service. No requests, no hoops.

Self-serve deletion. You can delete your account yourself from within the app. Deletion removes your personal data as described in Section 4.

State privacy rights. Depending on your state (including California), you may have rights to access, correct, delete, or obtain a copy of your personal information, and to limit the use of sensitive personal information. We honor these rights for all users — exercise them in-app or by emailing support@expenseduck.com. We do not sell or share personal information, and we use sensitive personal information (precise location, financial data) only to provide the Service you asked for.

The Service is offered in the United States and we do not target it to other jurisdictions; we do not claim GDPR compliance.

6. Security and breach notification

We use industry-standard techniques to protect the Service, encrypt data in transit and at rest, and encrypt off-site backups. No method of storage or transmission is 100% secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

7. Children

The Service is for adults 18 and older. We do not knowingly collect data from anyone under 18, and the Service is not directed to children (COPPA does not apply, and we intend to keep it that way).

8. Biometric login

If you enable Face ID or Touch ID to unlock the app, biometric processing happens entirely on your device, handled by the operating system. ExpenseDuck never collects, receives, or stores biometric data.

9. App store disclosures

The data practices described here are also summarized in the Apple App Store privacy label for the ExpenseDuck iOS app. If those summaries and this policy ever differ, this policy controls and we will fix the summary.

10. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Material changes will be posted here with an updated effective date and version note, and users of the Service are bound by the changes as posted; we may also notify you by email.

11. Contact

Skyline Consulting Co d/b/a ExpenseDuck.com
6300 W Plymouth Dr
Littleton, CO 80128
United States
Email: support@expenseduck.com

Change log · Version 1.0, August 1, 2026: initial release.