Security and privacy

Your bills say where you live, when you are away and what you can afford. This page says, way by way, what the app can see, what it keeps, what it never has, and how to take any of it back. Where something is not built yet, it says so.

The three ways in, side by side

Way	What the app can see	What it keeps	What it never has
Upload	The files you drop in	Those files, and the rows read from them	Your utility login. Nothing is fetched on your behalf, ever.
Forwarding	Only the messages your own filter forwards	The amount, the dates, the fuel, the last digits of the account, and the subject line on a log entry. Not the message.	A password or any kind of access to your mailbox. Any mail your filter did not send.
By hand	What you type	That bill	Anything else
Scan	That one image, which is sent to Google Cloud Vision to be read	The bill you confirm. Not the image, and not the text read from it.	The image, after the reading. Nothing is filed without you pressing Add bill.

Forwarding, step by step

This is the way people are most unsure about, so here is exactly what happens to one bill.

Your utility emails your mailbox, as it always has. Nothing has changed here.
Your mail provider's filter matches the sender and sends a copy of that one message to your bills address. The filter is yours, in your mailbox, under your provider's rules. The app is not involved and could not switch it on or off.
The copy reaches the operator's inbound mail service (Cloudflare, Mailgun or Postmark, depending on the server), which hands it to the app over an authenticated HTTPS request. A request without the right credential is refused before the message is looked at.
The app looks at the address it was sent to. It is bills- plus twenty-four random characters, one of roughly 10³⁶ possibilities, so it cannot be guessed. A message to an address that belongs to nobody is dropped, and the service is told it was accepted, so nobody can probe for real addresses by watching what bounces.
The app checks who sent it. Only the utility's own sender address is accepted. A message you forwarded by hand counts too, but only from the address you signed up with, and only when the utility's address is quoted inside it. A message from anyone else is logged as Not filed and nothing is read out of it. So a stranger who somehow learns your address cannot plant a bill, whether or not they know what a forwarded bill looks like.
The utility's signature is checked. Utilities sign their mail (DKIM). The app verifies the signature and, depending on how the server is set, either files an unverified bill with a note in your log or refuses it.
The amount and dates are read, and the message is discarded. What remains is a row in your bill history and a line in the log: date, outcome, subject, and a sentence saying what was done. The log keeps your last fifty lines.

Two consequences worth spelling out. If you ever stop wanting this, delete the filter in your mailbox and nothing more will arrive; there is nothing to revoke on the app's side because nothing was granted. And if the server operator's systems were ever compromised, what an attacker could find of yours is what is in the table above: bills, not mail.

Your account

Password. Hashed with argon2id. It is never stored and cannot be recovered, by you or by the operator.
Guessing. Eight wrong tries in fifteen minutes locks out that address, and that client, for a quarter of an hour.
Sessions. A signed cookie, HttpOnly, sent only over HTTPS on a hosted server, and valid for thirty days. Signing out ends it.
Other websites. A form submitted from any other site is refused outright, so another tab cannot act as you.
Google sign-in gives the app your name and email address. The request asks for nothing else, so there is no mail access to grant or revoke.
Not built yet: password reset, and confirming that a sign-up address is really yours. Both need outgoing email. If you lose your password, the operator can delete the account so you can sign up again; your bills go with it, so keep an export. If someone signs up with your address before you do, their password is discarded the moment you sign in through Google.

Where your data lives

Each account's bills, exports and settings are kept apart from every other account's, in the database of the server you signed up on. The person who runs that server can, as with any website, read its database. On the public app that person is its author; on a server a friend runs for you, it is your friend. The operators page is written for them.

Pages are sent with headers that tell browsers and anything in between not to cache them, not to frame them, and not to pass the address on.

What leaves the server, and to whom

Service	What is sent	When
Open-Meteo (weather)	Your ZIP code, and the rounded position of the town it names. Never an address.	When a home has a ZIP and the weather comparison needs the temperatures. Off entirely if the operator sets it so.
Google Cloud Vision (scans)	The one image you dropped, shrunk.	Only when you drop a scan. Only if the operator has switched scans on.
Google (sign-in)	Nothing about your bills. Google tells the app your name and email.	Only when you press Continue with Google.
Energy Switch MA (supplier offers)	Your ZIP code.	On the Rates page, for Massachusetts homes.

Nothing is sent to the utility. The app never signs in to a utility's website.

Similar homes

The checkbox under About your home lets this home's average daily usage count among homes in its state, so that it and they can see where they sit. It is on by default, so if you would rather not take part, untick it when you fill in the state. What goes into the pool is the state, the fuel and one number: the average per day. Never an address, an account, a name or a ZIP. The comparison is shown only once there are enough homes in a state to be anonymous, and unticking the box removes yours from the pool at once.

Your year has a share link. It opens a copy of the page with the numbers on it and nothing that names you: no email, no address, no account number, no home name. Anyone with the link can open it. There is no way yet to switch a link off once made, so treat it as public.

Scans

Reading the text off a photo is done by Google's Cloud Vision service. The image, shrunk in your browser to under 4 MB, is sent to Google, the text comes back, and the app keeps neither. What it keeps is the bill you confirm by pressing Add bill. If you would rather the image go nowhere, type the figures in; the form is the same.

Taking it back

Stop forwarding: delete the filter in your mailbox. Optionally press Issue a new address on Add bills so the old one no longer exists.
Leave the similar-homes pool: untick the box under About your home.
Delete a home: from Your homes. Restorable for 30 days, then gone.
Delete the account: at the foot of Add bills. Type your email address to confirm. Every bill, export, setting and log line goes with it, at once, and it cannot be undone. Export your data from the Raw data page first if you want to keep it.