MorJot reads transfer slips primarily on your device. Your journal is stored in your account so you can use it across devices. We do not sell your data, show advertising or track you across apps or websites. You can delete your data at any time.
1. What we collect
| Data | Why |
|---|---|
| Email and name from Google or Apple sign-in. With Apple's Hide My Email, we receive the relay email Apple provides. | Identify which journal belongs to you. |
| Income and expense entries: amount, recipient or sender, date and time, category, notes you type, and slip reference number. | This is your journal. |
| Slip images | Only with your consent, requested on first use, to view and re-read slips across devices and the web even after removing a local photo or changing phones. You can use the app without image backup; images then remain on your device. |
| Your image-backup consent choice, time, consent-text version and app version. | Record your choice and apply the latest choice across your account. |
| Hashed fingerprints of photos already checked. | Avoid recording the same slip twice. A hash is not an image and cannot be turned back into one. |
| Imported credit-card statement entries: date, amount and description. | View statement entries across devices. The PDF and its password stay on the importing device. |
| Device nickname, such as “iPhone”. | Identify where an entry came from when using several devices. |
| Subscription status: app store and expiry date. | Enable subscribed features on the platform where you subscribed. |
| Monthly AI-use counts by task and model, including token counts. Numbers only, without images, prompts or AI answers. | Manage quotas and service costs. Deleted with your account. |
| Device and app languages, counted as daily totals without an account or device link. | Prioritize app translations. |
| Feedback you submit: message, occupation if provided, app version, device type and account ID if signed in. | Help the team improve the app. Deleted with your account. |
What we do not collect
Location, contacts, browsing history, non-slip photos from your library, bank passwords or your bank-account credentials. MorJot does not connect to your bank; it reads slip photos already on your device.
A transfer slip often includes the recipient's name and part of their account number. If you consent to image backup, that information is stored on our servers too. Use it only as needed for your own transactions. You can turn off image backup in Settings.
2. Where data is stored
- On your device: local features work offline; slip reading is on-device by default.
- On our servers: Cloudflare D1, R2 and Workers provide sync and recovery when changing devices. Requests and slip images are restricted to the signed-in account; one user cannot read another user's data. Cloudflare servers may be outside Thailand. Journal entries are stored to provide sync; slip images are uploaded only with consent.
- Our team does not open your journal data unless you enable “Allow the team to view data to help solve a problem” in the feedback/report screen at the top of Settings. Access expires automatically after 7 days and you can turn it off sooner. Only information needed for the reported problem is viewed, with each access recorded. For operations, staff can see account details (name, email, sign-in method, signup date, last sync and plan) and AI-use counts, without entries, notes or slip images.
3. Who receives data
| Provider | What and when |
|---|---|
| Google Sign-In | Authenticates your sign-in and returns your email and name. |
| Apple | Authenticates Sign in with Apple. We store Apple's token encrypted solely to revoke the link when you delete your account. Apple processes App Store subscription payments and renewals. |
| Google Play | Processes subscription payments and renewals for the Android app. |
| RevenueCat | Validates subscription status using a random MorJot user ID and store purchase history. It receives no journal entries, slip images or card details. Apple or Google holds payment-card details; we do not see them. |
| Anthropic (Claude Haiku), Google (Gemini), OpenAI (GPT) | Claude Haiku is primary, Gemini is a fallback, and OpenAI GPT-6 Luna is the final fallback if both fail, only after consent naming the providers. Consent given before OpenAI was added does not authorize sending to OpenAI. OpenAI does not train on API data and we disable response storage. These providers are used only for:
|
| Google (Gemini): Chat with MorJot | Only after you consent and ask a question in Chat with MorJot. Your question, a few recent turns, and relevant totals or entries retrieved from your journal go to Gemini to form an answer. No slip images or full journal are sent. Chat history stays on your device. The server records message counts, tokens and costs, not message content. Exceptions are facts you explicitly ask MorJot to remember, up to 30 short facts in your account. They accompany your questions; you can view or remove them using the memory button, and they are deleted with your account. Part of MAX; currently available only to the testing team. |
| OpenAI (ChatGPT), Anthropic (Claude) | Only if you connect your own chat to MorJot and authorize it on the connection screen. Your chat can read journal summaries and entries to answer your questions under your chat account. Proposed entries require your confirmation in the app. Disconnect in Settings → Connected ChatGPT / Claude. Not available to general users during the open trial. |
| Cloudflare | Hosts the servers and database. |
We do not sell, exchange or send your data to advertisers or data brokers, or use it to track you across other apps or websites.
4. Your controls
- Turn off the slip-reading assistant: Settings → Slip reading and privacy. Reading then stays on your device.
- Turn off weekly AI checks: Settings → Weekly AI checks. Slip images are then not sent for checking.
- Withdraw image-backup consent: Settings → Back up slip images to your account. Turning it off is as easy as consenting and applies across your account. New images stay local and may be lost if you change phones or reinstall.
- Support access: Settings → Feedback / Report a problem. Off by default; expires after 7 days. While enabled it also appears under Settings privacy controls and can be disabled early.
- Export your data as CSV at any time.
- Delete backed-up slip images: when disabling backup, the app asks whether to remove existing account copies. They are removed immediately if you confirm.
- Delete your account and data: see below.
4.1 Delete your account and all data
In the iPhone or Android app: Settings → Delete account and all data.
If you no longer have the app: open MorJot on the web, sign in to the same account and use Settings → Delete account and all data. Or email admin@popnx.com from your sign-in email.
You can start deletion yourself. All signed-in devices are signed out immediately, ChatGPT and Claude connections are revoked, and we ask Apple to revoke the link for Sign in with Apple. Nobody, including staff, can open the data.
A 30-day recovery period: sign in with the same account within 30 days and choose Restore to recover your data. You can instead choose Delete immediately when starting deletion or signing in during that period.
At the deadline, entries, slip images, statements, remembered facts and settings are removed from the server. Automatic database backups expire within a further 30 days: complete removal within 60 days of requesting deletion, or 30 days if you choose immediate deletion.
The only retained records are payment evidence: payment reference, credit quantity and time, without a name, slip content or link to the deleted account. Retained for 5 years from the accounting closing date under Thailand's Accounting Act B.E. 2543, section 14.
Deleting an account does not automatically cancel a store subscription. Cancel with the store: iPhone Settings → your name → Subscriptions; Android Google Play → profile → Payments & subscriptions.
5. Retention
We keep your data while your account exists so you can refer to your journal. After you request deletion, data and slip images are held for 30 days for recovery, then permanently removed, or removed immediately if you choose. Nobody can open them in the meantime and previously signed-in devices cannot re-upload them. Automatic database backups expire within 30 days. See section 4.1.
6. Children
MorJot is designed for adults managing their own money. We do not intend to collect information from children under 13.
7. Your rights
Under Thailand's Personal Data Protection Act (PDPA), you may request access, a copy, correction or deletion of your personal data, or object to its processing. Contact the email below.
Language on introduction and document pages
The website uses the language reported by your browser to choose Thai or English. If you switch manually, the morjot_site_lang cookie stores only your language choice for up to one year. It is not linked to an account or used for tracking. Choose “Follow system” to remove the preference, or manage cookies in your browser.
8. Changes to this policy
For material changes, we update the date above and notify you in the app.
Contact
MorJot · admin@popnx.com